EUROPEAN COMMISSION Brussels, 6.4.2016 COM(2016) 194 final 2016/0106(COD) Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL establishing an Entry/Exit System (EES) to register entry and exit data and refusal of entry data of third country nationals crossing the external borders of the Member States of the European Union and determining the conditions for access to the EES for law enforcement purposes and



amending Regulation (EC) No 767/2008 and Regulation (EU) No 1077/2011



{SWD(2016) 114 final}

{SWD(2016) 115 final}

{SWD(2016) 116 final}



EXPLANATORY MEMORANDUM 1.CONTEXT OF THE PROPOSAL Background In February 2013, the Commission tabled a package of legislative proposals on Smart Borders to modernise the Schengen area’s external border management. The package consisted of three proposals: (1) a Regulation for an Entry/Exit System (EES) for the recording of information on the time and place of entry and exit of third country nationals entering the Schengen area, (2) a Regulation for a Registered Traveller Programme (RTP) to allow third country nationals who have been pre-vetted to benefit from facilitation of border checks at the Union external border, (3) a Regulation amending the Schengen Borders Code in order to take into account the existence of the EES and RTP. During the first examination of the package which was completed in February 2014, the co-legislators voiced technical, financial and operational concerns on certain aspects of the design of the systems. However the preferred policy options proposed in 2013 (i.e. centralised systems based on biometrics) were not questioned. The European Parliament (EP) referred the proposal to its Committee on Civil Liberties, Justice and Home Affairs (LIBE). It did not issue a legislative resolution on the proposals. In order to further assess the technical, organisational and financial impacts of the proposed policy options, the Commission initiated, with the support of both co-legislators, a so-called ‘proof of concept’ exercise consisting of two stages: A Commission-led Technical Study on Smart Borders (hereinafter 'The Technical Study') published in October 2014, and A testing phase led by eu-LISA on the impact of the use of various biometric identifiers on the border control processes (hereinafter 'The Pilot') for which a report was published in November 2015. Based on the findings of the Technical Study, the results of The Pilot, the technical discussions with co-legislators and stakeholders as well as a public consultation, the Commission prepared a detailed Impact Assessment which is accompanying this proposal. This Impact Assessment builds on the Impact Assessments accompanying the 2013 proposals, and focuses on elements of the 2013 proposals where modifications are proposed, notably (a) the architecture of the system, (b) biometrics to be used, (c) the use of process facilitators, (d) the retention of data and (e) access by law enforcement authorities. On the basis of these extensive preparations, the Commission has considered necessary improvements and simplifications to the 2013 proposals. The Commission has decided to: –revise its 2013 proposal for a Regulation for the establishment of an Entry/Exit System (EES); –revise its 2013 proposal for Regulation amending the Schengen Borders Code to integrate the technical changes that result from the new proposal for a Regulation establishing an Entry/Exit System (EES). –withdraw its 2013 proposal for a Regulation for a Registered Traveller Programme (RTP).  Rationale for the establishment of an EU Entry/Exit System As explained in the Impact Assessment, the establishment of an EU Entry/Exit System is considered necessary to address the following challenges: 1. Addressing Border check delays and improving quality of border checks for third country nationals Passenger flows at the external borders of the European Union have been growing and will continue to increase in the future. The total number of regular border crossings in 2025 is forecast to rise to 887 million, of which around one-third are expected to be by third country nationals traveling to Schengen countries for a short term visit. While 'minimum checks' are performed on EU citizens and persons enjoying the right of free movement, third country nationals crossing the Schengen area external borders are subject to ‘thorough checks’ made today manually at borders (both at entry and exit). The Schengen Borders Code has no provisions on the recording of travellers’ cross border movements into and out of the Schengen area. As a general rule, third country nationals have the right to enter for a short stay of up to 90 days within any 180 day period. Currently the stamping of the travel document indicating the dates of entry and exit is the sole method available to border guards and immigration authorities to calculate the duration of stay of third country nationals and to verify if someone is overstaying. These stamps can be difficult to interpret: they may be unreadable or the result of counterfeiting. Similarly, it is difficult for consulates having to process visa applications to establish the lawfulness of previous visas on the basis of stamps present in the travel document. As a result, the whole procedure is considered error prone and not always systematically implemented.

The introduction of the EES will ensure: - precise information, rapidly delivered on demand to border guards during border checks, by replacing the current slow and unreliable system of manual stamping of passports; this will allow for both a better monitoring of the authorised stay as well as more efficient border checks; - information to border guards on refusals of entry of third country nationals and will allow for refusals of entry to be checked electronically in the EES; - precise information to travellers on the maximum length of their authorised stay; - possibility for automated border controls for third country nationals under the supervision of the border guards in accordance with the conditions foreseen in Article 8d of the revised proposal to amend the Schengen Borders Code. 2. Ensuring systematic and reliable identification of ‘overstayers’ Irregular immigrants include both persons who crossed the borders irregularly – usually not at an official border crossing point - and the so-called “overstayers”: persons having legally entered the EU at an official border crossing point but who stayed after their entitlement to do so expired. The EES addresses this category of irregular migration. As border crossings by third country nationals are currently not registered, it is not possible to establish lists of overstayers. The introduction of EES will: - provide precise information on who is overstaying their authorised stay, which will support controls within the territory and allow to apprehend irregular migrants more efficiently; - support the identification of irregular migrants; by storing biometrics in the EES on all persons not subject to the visa requirement, and taking into account that the biometrics of visa holders are stored in the VIS, Member States' authorities will be able to identify any undocumented irregular migrant found within the territory that crossed the external border legally; this will in turn facilitate the return process; - allow for an evidence-based approach through the analysis generated by the system. In the case of visa policy for instance, the EES will provide precise data on whether there is problem with overstayers of a given nationality or not, which would be an important element when deciding whether to impose or lift visa obligations on a third country in question; 3. Reinforcing internal security and the fight against terrorism and serious crime. Criminal activities such as trafficking in human beings, people smuggling or the smuggling of illicit goods involve numerous border crossings, which are facilitated by the absence of registration of the border crossings of the third country nationals concerned. Likewise, terrorist organisations and radicalised individuals can benefit from the absence of registration of border crossings. Controls of third country nationals at external borders involve identity checks and searches against various databases of known persons or groups posing a threat to public security that should be either apprehended or denied entry to the territory. However, if a third country national destroys his/her official documentation once inside the Schengen area, it can be very difficult for law enforcement authorities to identify that person in case he/she is suspected of a crime or is a victim of crime. The introduction of EES will: - support the reliable identification of terrorists, criminals as well as of suspects and victims; - provide a record of travel histories of third country nationals including crime suspects. It would thus complement the information available in the Schengen Information System. Relevant developments since 2013 In preparing this revised proposal, the Commission also took account of relevant developments since 2013, which changed the political, legal and institutional environment compared to 2013, when the original Smart Borders proposals were submitted:

–The Visa Information System became fully operational. Its 'roll-out' to Member States consulates in all relevant third countries was concluded in November 2015. The biometric verification of visa-holders against VIS at Schengen external borders is now compulsory. Law enforcement authorities increasingly use VIS for identification and investigation purposes. –Visa liberalisation dialogues with countries in the Western Balkans and at the Eastern and South-Eastern borders of the EU were concluded or have been accelerated, which will lead to an increasing proportion of visa-exempt travellers to the EU. It is expected that this trend will continue in the coming years. –The Internal Security Fund (ISF-B) was adopted, which earmarked € 791 million for the development of Smart Borders, to be used after the adoption of the relevant legal basis. –The European Agenda on Migration identified "border management" as one of the "four pillars to manage migration better". Securing external borders and managing them more efficiently implies making better use of the opportunities offered by IT systems and technologies. Furthermore, at the Justice and Home Affairs and European Councils in December 2015, Member States emphasised the need to improve the controls at external borders through the use of new technologies. –Rapid developments in the area of biometric technology opened up new possibilities for 'lighter' and 'faster' enrolment and verification of travellers, not only for fingerprints, but also for facial images. –The Court judgment on the Data Retention Directive provided legal clarity on the conditions and safeguards that need to be respected for the storage and use of EES data. –The December 2015 political agreement of the co-legislators on the reform of EU data protection rules will put in place a modern data protection framework across the EU. The General Data Protection Regulation and the Data Protection Directive will be formally adopted by the European Parliament and Council in the course of 2016. Main elements of the revised smart borders package The scope of the new Entry Exit System includes border crossings by all third country nationals visiting the Schengen area for a short stay (maximum 90 days period in any period of 180 days), both visa-required and visa-exempt travellers,or eventually, on the basis of a touring visa (up to one year). Family members of EU citizens enjoying the right of free movement or of third country nationals who enjoy the same rights of free movement equivalent to those of Union citizens and who do not yet have a residence card should be registered in the EES but are not subject to the short stay rule, and checks on this category shall be carried out in accordance with Directive 2004/38/EC. Such family members in possession of a residence card referred to in Directive 2004/38/EC are excluded from the EES. The system will collect data and register entry and exit records with the view to both facilitating the border crossing of bona fide travellers, and better identifying overstayers. The EES will also record refusals of entry of third country nationals falling within its scope. The main differences between this modified proposal and the 2013 proposals are: - The architecture of the system: only one system is proposed, the Entry Exit System. The connection of the national border infrastructures to the EES central system will be done through a National Uniform Interface which will be identical for all Member States, and will allow the use of the existing national Entry Exit Systems. However, data from the central system cannot be copied into these existing national EES. - Interoperability is ensured between the EES and VIS in order to achieve more efficiency and rapidity at border checks. To this effect, a connection will be established between the central systems of the EES and the VIS and direct access between them will be regulated for specific purposes. This will reduce the duplication of personal data processing in accordance with the 'privacy by design' principle. - Biometric identifiers: while the 2013 EES proposals were relying on ten fingerprints, the revised EES proposals suggests a combination of four fingerprints and the facial image as biometric identifiers introduced from the start of operations of the EES. This choice will allow for sufficiently accurate verifications and identifications, considering the expected size of the EES, while keeping the amount of data to a reasonable level while at the same time speeding up border controls and enabling a wider use of self-service systems at border crossing points. The four fingerprints are used at enrolment to check if the third country national was already registered in the system while the facial image allows for a quick and reliable (automatic) verification at subsequent entry that the individual subject to the border control is the one already registered in the EES. - Personal data protection: there is a significant reduction in the volume of personal data recorded in EES: 26 data items are to be recorded in EES instead of 36. The right of access, rectification and deletion of personal data are clearly defined and safeguarded. The European Data Protection Supervisor and the national data protection authorities will be in charge of supervision for data processing. - Data retention period: The retention time for stored data is five years. The five year data retention period reduces the re-enrolment frequency and will be beneficial for all travellers, while allowing the border guard to perform the necessary risk analysis required by the Schengen Border Code before authorising a traveller to enter the Schengen area. For the border guard the systematic deletion of the EES record after 181 days as proposed in 2013 would have removed any trace of the third country national recent history of entries and exits from the Schengen area which is required for a risk analysis. It would be a regression of useful information compared to what the border guard currently uses: consulting stamps in a travel document gives in many cases information that stretches a period of several years. A longer data retention period is thus necessary to allow the border guard performing the necessary risk analysis requested by the Schengen Border Code before authorising a traveller entering the Schengen area. The processing of visa application in consular posts requires also analysing the travel history of the applicant to assess the use of previous visas and the respect of the conditions of stay. The abandoning of passport stamping will be compensated by a consultation of the EES. The travel history available in the system should therefore cover a period of time which is sufficient for the purpose of visa issuance. The longer data retention period will reduce the re-enrolment frequency and will be beneficial for all travellers as the average border crossing time will decrease as will do the waiting time at border crossing points. Even for a traveller entering only once in the Schengen area, the fact that other travellers being already registered in the EES will not have to re-enrol will reduce the waiting time at border.

A longer data retention period will also be necessary to allow for facilitation at border crossing by using process accelerators and self-service systems. Facilitation is dependent of the data registered in the system. A short data retention period would reduce the group of travellers that can benefit of such facilitation and thereby undermine the stated objective of EES to facilitate border crossing. For non EU family members of EU citizens who fall within the scope of the present Regulation, each entry/exit record shall be kept for a maximum period of one year after the last exit. Their individual file should be kept for five years so as to enable the family member to benefit of the facilitation for border crossing. For overstayers not yet found at the end of the data retention period, following a national decision, an alert based on the EES data can be created in the Schengen Information System, based upon a national decision, before deletion of the EES data. - The facilitation of border crossings: the approach for facilitation is based on the implementation of self-service systems and e-gates, which will allow third country nationals to initiate the procedure for border clearance, to be completed by providing additional information to the border guard on request. The use of these accelerators (introduced in the proposal amending the Schengen Borders Code) is optional for Member States, open to most of the travellers and does not require the development of any new system. - In addition there will be a harmonised legal basis (again introduced in the amendments to the Schengen Borders Code) for the establishment of national Registered Travellers Programmes by Member States, on a voluntary basis. - Law enforcement access: from the start of operations, Member States' law enforcement authorities and Europol will have access to the EES, under strictly defined conditions. The EES will contain reliable data on entry and exit dates of third country nationals falling within the scope of the EES that can be of decisive importance in individual law enforcement files, to which access should be given in accordance with the purpose of the instrument and with respect for data protection rules. The access to VIS data for law enforcement purpose has already proven its usefulness. Member States have reported cases of people who died violently and whose identification was only possible through accessing the VIS. Other cases reported are related to human being trafficking, terrorism or drug trafficking for which the access to VIS data allowed the investigators to make substantial progress. - The costs: in the 2013 proposals, 1,1 billion EUR was set aside as an indicative amount for the development of an EES and an RTP. For the revised proposal, based on the preferred option of a single EES system including the law enforcement access, the amount needed has been estimated at EUR 480 million. This revised proposal for a Regulation establishing an EES constitutes the core instrument for the legal framework of the EES. It also contains consequential amendments to existing EU legislation (i.e. to Regulation (EU) No 1077/2011, to Regulation (EC) No 767/2008 and to the Convention implementing the Schengen Agreement). This complementary proposal to amend the Schengen Borders Code as regards the use of the system as part of the border management process is presented in parallel with this proposal.  Existing provisions in the area of the proposal Regulation (EU) 2016/399 of the European Parliament and of the Council of 9 March 2016 on a Union Code on the rules governing the movement of persons across borders (Schengen Borders Code). Regulation of the European Parliament and of the Council (EC) No 1931/2006 laying down rules on local border traffic at the external land borders of the Member States and amending the provisions of the Schengen Convention. Regulation of the European Parliament and of the Council (EC) No 767/2008 concerning the Visa Information System (VIS) and the exchange of data between Member States on short-stay visas (VIS Regulation). Regulation of the European Parliament and of the Council (EC) No 810/2009 establishing a Community Code on Visas. Regulation of the European Parliament and of the Council (EU) No 1077/2011 establishing a European Agency for the operational management of large-scale IT systems in the area of freedom, security and justice. Regulation (EU) No 515/2014 of the European Parliament and of the Council of 16 April 2014 establishing as part of the Internal Security Fund, the Instrument for financial support for external borders and visa and repealing Decision No 574/2007/EC. 2.CONSULTATION OF INTERESTED PARTIES AND IMPACT ASSESSMENT Consultation of interested parties A detailed description of stakeholder consultation is included in the accompanying impact assessment in Annex 2. During 2015 the Commission carried out targeted consultations for the preparation of its revised Smart Borders proposals with the EDPS in a workshop on the preparation of the revised Smart Borders proposals of 20 March 2015, with civil society in a meeting of 5 May 2015, with carriers, transport, tourism and infrastructure operators in a meeting of 28 May 2015 and with the Fundamental Rights Agency in two meetings of 22 June and 23 July 2015. In addition, the Commission organised a meeting with law enforcement practitioners of the Member States on 9 July 2015 and two technical meetings with Member States’ experts on 24 September 2015 and on 26 October 2015 A public consultation, that took place from the 29 July to the 29 October 2015, collected the views of individuals, organisations, carriers and public authorities (the results of the public consultation are explained in detail in Annex 2 of the Impact Assessment).

The LIBE Committee of the European Parliament organised an inter-parliamentary committee with national parliaments on Smart Borders on 23-24 February 2015. Impact assessment A first impact assessment was carried out in 2008 when preparing the Commission Communication on this subject and a second one was finalised in 2012 in preparation of the 2013 proposals. The third Impact Assessment was finalised in 2016. Taking into account the Technical Study, the report on the Pilot Project, the result of the consultation of interested parties and the discussions in the Council and the European Parliament, the impact assessment analysed key implementation options and suboptions for both the EES and the RTP. The preferred options resulting from the Impact Assessment are directly reflected in the main changes included in the current proposal as compared to the 2013 proposals (See point I "Main elements of the revised proposal") The Regulatory Scrutiny Board (RSB) reviewed the draft impact assessment and delivered its positive opinion on 22 January 2016 3.LEGAL ELEMENTS OF THE PROPOSAL Summary of the proposed actions The purposes, functionalities and responsibilities for the EES must be defined. Furthermore, a mandate needs to be given to the Agency for the operational management of large-scale IT systems in the area of freedom, security and justice (eu-LISA) to develop and operationally manage the system. A detailed explanation of the present revised proposal by article can be found in a separate Commission Staff Working Paper. Consequential amendments to this proposal need to be adopted to Regulation (EU) No 1077/2011, Regulation (EC) No 767/2008 and the (Convention implementing the Schengen Agreement) as referred to under point 1. Legal basis The present revised proposal uses Article 77(2)(b) and (d) of the Treaty on the Functioning of the European Union as the legal basis for this Regulation. Article 77(2)(b) and (d) is the appropriate legal basis for further specifying the measures on the crossing of the external borders of the Member States and developing standards and procedures to be followed by Member States in carrying out checks on persons at such borders. Article 77(2)(b) and (d) is the legal basis of the establishment of the EES. In addition, the revised proposal relies on Article 87(2)(a) as a legal basis to allow access for law enforcement purposes and Article 88(2)(a) to allow access by Europol, both under strict conditions Both these additional legal bases for the law enforcement and Europol access to EES data command the same ordinary legislative procedure which is applicable under Article 77(2)(b) and (d). Subsidiarity principle Under Article 77(2)(b) of the Treaty on the Functioning of the European Union, the Union has the power to adopt measures relating to the checks on persons and efficient monitoring of the crossing of external borders of the Member States. The current EU provisions on the crossing of the external borders of the Member States need to be modified to take into account that there are currently no reliable means to monitor the travel movements of third country nationals admitted for a short stay given the complexity and slowness of the current stamping obligation, which is insufficient for allowing Members States' authorities to assess the authorised stay at the border check of the traveller or at checks within the territory and the very limited value of national systems for such purposes in an area without internal border control. The information on who has been refused entry into EU territory, on who is on EU territory and who complies with the maximum allowed short stay of 90 days within 180 days, on nationalities and groups (visa exempt/required) of travellers overstaying and to support random checks within the territory to detect irregularly staying persons should be available to increase the efficiency of migration management. A common regime is needed in order to establish harmonised rules on the records of refusals of entry, cross border movements and monitoring of authorised short stays for the Schengen area as a whole. Therefore, this objective of the proposal cannot be sufficiently achieved by the Member States. A revision of the 2013 EES proposal is also required in order to allow law enforcement access to data in the EES for the purpose of the fight against terrorism and serious crime and ensure a high level of internal security. This objective cannot be sufficiently achieved by the Member States, since such an amendment can only be proposed by the Commission. Proportionality principle Article 5 of the Treaty on the European Union states that action by the Union shall not go beyond what is necessary to achieve the objectives of the Treaty. The form chosen for this EU action must enable the proposal to achieve its objective and be implemented as effectively as possible. The proposed initiative constitutes a further development of the Schengen acquis in order to ensure that common rules at external borders are applied in the same way in all the Member States which have abolished controls at internal borders. It creates an instrument providing to the European Union information on how many third country nationals enter and leave the territory of the EU, which is indispensible for sustainable and evidence based policy making in the field of migration and visa. It also grants access to the EES to law enforcement authorities, which is a timely, accurate, secure and cost-efficient way to identify visa exempt nationals who are suspects (or victims) of terrorism or of a serious crime and to enable them to consult the travel history of both visa holder and visa exempt third country nationals who are suspects (or victims) of such crimes. The proposal which conception is driven by the privacy by design principles is proportionate in terms of the right to protection of personal data in that it does not require the collection and storage of more data for a longer period than is absolutely necessary to allow the system to function and meet its objectives. In addition, all the safeguards and mechanisms required for the effective protection of the fundamental rights of travellers particularly the protection of their private life and personal data will be foreseen and implemented.

No further processes or harmonisation will be necessary at EU level to make the system work; thus the envisaged measure is proportionate in that it does not go beyond what is necessary in terms of action at EU level to meet the defined objectives. The preferred option is also proportionate in terms of costs, taking into account the benefits the system will provide to all Member States in managing the common external border and progressing towards a common EU migration policy. The proposal therefore complies with the proportionality principle. Choice of instrument Proposed instruments: Regulation. Other means would not be adequate for the following reason(s): The present proposal will set up a centralised system through which Member States cooperate with each other, something which requires a common architecture and operating rules. Moreover it will lay down rules on border checks at the external borders and on access to the system including for the purpose of law enforcement which are uniform for all Member States. As a consequence, only a Regulation can be chosen as a legal instrument. Fundamental rights The proposed Regulation has an impact on fundamental rights, notably on right to dignity (Article 1 of the Charter of Fundamental Rights of the EU); the prohibition of slavery and forced labour (Article 5 of the Charter); right to liberty and security (Article 6 of the Charter), respect for private and family life (Article 7 of the Charter), the protection of personal data (Article 8 of the Charter), right to asylum (Article 18 of the Charter) and protection in the event of removal, expulsion or extradition (Article 19 of the Charter), the right to non-discrimination (Article 21 of the Charter), the rights of the child (Article 24 of the Charter) and the right to an effective remedy (Article 47 of the Charter). The prohibition of slavery and forced labour as well as the right to liberty and security are positively affected by the implementation of an EES. A better and more accurate identification (through the use of biometrics) of third country national crossing the external border of the Schengen area supports the detection of identity fraud, human being trafficking (particularly in the case of minors) and cross border criminality and thus contributes to improving the security of the citizens present in the Schengen area. Concerning the right to protection of personal data, the proposal contains safeguards as regards personal data, in particular access thereto, which should be strictly limited only to the purpose of this Regulation and to the therein designated competent authorities. Safeguards as regards personal data also include the right of access to or the right of correction or deletion of data. The limitation of the retention period of data referred to above in chapter 1 of this explanatory memorandum also contributes to the respect for personal data as a fundamental right. The proposal provides for access to the EES for the prevention, detection or investigation of terrorist offences or other serious criminal offences for the purposes of identification of third country nationals crossing the external borders and for the purpose of accessing data on their travel history. As stipulated by Article 52(1) of the Charter, any limitation to the right to the protection of personal data must be appropriate for attaining the objective pursued and not going beyond what is necessary to achieve it. Article 8(2) of the European Convention of Human Rights also recognises that interference by a public authority with a person’s right to privacy may be justified as necessary in the interest of national security, public safety or the prevention of crime, as it is the case in the current proposal. The ECJ has also recognised that the fight against terrorism and serious crime, in particular against organised crime and terrorism, is indeed of the utmost importance in order to ensure public security and its effectiveness may depend to a great extent on the use of modern investigation techniques and hence, access to personal data granted for those specific purposes could be justified if considered necessary. The proposal provides for access to the EES for the prevention, detection or investigation of terrorist offences or other serious criminal offences for the purposes of identification of third country nationals crossing the external borders and for the purpose of accessing data on their travel history. Access to the EES for identification purposes should only be possible where a prior search has been conducted in national databases without success and, in the case of searches with fingerprints where a prior search has been conducted in the automated fingerprint verification system under Decision 2008/615/JHA. Although data exist in the VIS on visa holders, neither data on visa exempt nationals or data on travel movements are available in any other EU database. Access to EES data for law enforcement purposes may only be granted for the prevention, detection or investigation of criminal offences or other serious criminal offences as defined in Council Framework Decisions 2002/475/JHA on combatting terrorism and 2002/584/JHA on the European arrest warrant and only if it is necessary for a specific case. Moreover, designated law enforcement authorities may only request access to EES data if there are reasonable grounds to consider that such access will substantially contribute to the prevention, detection or investigation of the criminal offence in question. Such request are verified by a designated law enforcement authority in order to check whether the strict conditions for requesting access to the EES for law enforcement purposes are fulfilled. Furthermore, the proposal also lays down strict data security measures to ensure the security of personal data processed and establishes supervision of the processing activities by independent public data protection authorities and documentation of all searches conducted. The proposal also states that the processing of all personal data carried out by law enforcement authorities on the EES once they have been extracted is subject to Council Framework Decision 2008/977/JHA. The proposal establishes strict access rules to the EES system and the necessary safeguards. It also foresees the individuals' rights of access, correction, deletion and redress in particular the right to a judicial remedy and the supervision of processing operations by public independent authorities,. Therefore, the proposal fully complies with the Charter of Fundamental Rights of the European Union, in particular as regards the right to the protection of personal data, and is also in line with Article 16 TFEU which guarantees everyone the right to protection of personal data concerning them. 4.BUDGETARY IMPLICATIONS In the 2013 EES proposal, reference was made to the Commission's proposal for the next multi-annual financial framework (MFF) which included a proposal of 4,6 billion EUR for the Internal security Fund (ISF) for the period 2014-2020. In the 2013 EES proposal, 1,1 billion EUR was set aside as an indicative amount for the development of an EES and an RTP assuming development costs would start from 2015. This amount was calculated on the basis of the development and operational management of two separate systems and on 3 years of development and 4 years of operations. Regulation (EU) No 515/2014 of the European Parliament and of the Council of 16 April 2014 establishing as part of the Internal Security Fund, the instrument for financial support for external borders and visa and repealing Decision No 574/2000/EC (ISF Borders Regulation) provided in Article 5.5b) that EUR 791 million should be allocated for developing IT systems, based on existing and/or new IT systems, supporting the management of migration flows across the external borders. The amount of EUR 791 million corresponded to 3 years of development (2017-2019 inclusive) with already some preparatory activities in 2016 with operations starting in 2020.

Following the technical study and the Impact Assessment, the current proposal is based on the preferred option of a single EES system and the amount needed has been assessed as EUR 480 million which takes also into account the purpose of law enforcement access. Consequently, a proposal for the amendment of the ISF Borders Regulation is included in the present proposal to align it to the new reduced amount. This financial support would cover not only the costs of central components for the entire MFF period (EUR 288 million – at EU level, both development and operational cost via indirect management) but also the costs for the integration of the existing national border infrastructures in Member States with the EES via the National Uniform Interfaces (NUI) (EUR 120 million - via direct management). Providing financial support for national integration costs would ensure that difficult economic circumstances at national level do not jeopardise or delay the projects. During the development phase (2017-2019) the Commission will spend a total amount of 52,7 mio € (via direct management) for the expenses related to the operations in the Member States. Once the new system would be operational, future operational costs in the Member States could be supported by their national programmes in the framework of the ISF (shared management). An amount of EUR 20 million has been earmarked for this purpose within the overall envelope of EUR 480 million. This will include operational support for one year. The cost model applied is explained in Annex 6 - Cost Model for EES System of the Impact Assessment. 5.ADDITIONAL INFORMATION Participation This proposal builds upon the Schengen acquis in that it concerns the crossing of external borders. Therefore the following consequences in relation to the various protocols and agreements with associated countries have to be considered: Denmark: In accordance with Articles 1 and 2 of the Protocol (no 22) on the position of Denmark, annexed to the Treaty on European Union (TEU) and the Treaty on the Functioning of the European Union (TFEU), Denmark does not take part in the adoption by the Council of measures pursuant to Title V of part Three of the TFEU. Given that this Regulation builds upon the Schengen acquis, Denmark shall, in accordance with Article 4 of that Protocol decide within a period of six months after the Council has decided on this Regulation whether it will implement it in its national law. United Kingdom and Ireland: In accordance with Articles 4 and 5 of the Protocol integrating the Schengen acquis into the framework of the European Union and Council Decision 2000/365/EC of 29 May 2000 concerning the request of the United Kingdom of Great Britain and Northern Ireland, and Council Decision 2002/192/EC of 28 February 2002 concerning Ireland's request to take part in some of the provisions of the Schengen acquis, the United Kingdom and Ireland do not take part in Regulation (EU) 2016/399 (Schengen Borders Code) nor in any other of the legal instruments which are commonly known as the "Schengen acquis", viz. the legal instruments organising and supporting the abolition of controls at internal borders and the flanking measures regarding the controls at external borders. This Regulation constitutes a development of this acquis, and therefore, the United Kingdom and Ireland are not taking part in the adoption of this Regulation and are not bound by it or subject to its application. In line with the judgment of the Court of Justice in case C-482/08, United Kingdom v. Council, ECLI:EU:C:2010:631, the circumstance that this Regulation has Articles 87(2)a) and Article 88(2)a) as legal bases alongside Article 77(2)b) and (d) TFEU does not affect the above conclusion, as the access for law enforcement purposes is ancillary to the establishment of the Entry/Exit System. Iceland and Norway: The procedures laid down in the Association Agreement concluded by the Council and the Republic of Iceland and the Kingdom of Norway concerning the latter's association with the implementation, application and development of the Schengen acquis are applicable, since the present proposal builds on the Schengen acquis as defined in Annex A of this Agreement. Switzerland: This Regulation constitutes a development of the provisions of the Schengen acquis, as provided for by the Agreement between the European Union, the European Community and the Swiss Confederation on the latter's association with the implementation, application and development of the Schengen acquis. Liechtenstein: This Regulation constitutes a development of the provisions of the Schengen acquis, as provided for by the Protocol between the European Union, the European Community, the Swiss Confederation and the Principality of Liechtenstein on the accession of the Principality of Liechtenstein to the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation's association with the implementation, application and development of the Schengen acquis. Croatia, Cyprus, Bulgaria and Romenia: This Regulation establishing the EES replaces the obligation to stamp the passport of third country nationals. This provision was to be applied by the acceding Member States upon accession to the European Union. 2016/0106 (COD) Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL establishing an Entry/Exit System (EES) to register entry and exit data and refusal of entry data of third country nationals crossing the external borders of the Member States of the European Union and determining the conditions for access to the EES for law enforcement purposes and



amending Regulation (EC) No 767/2008 and Regulation (EU) No 1077/2011





THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION, Having regard to the Treaty of the Functioning of the European Union, and in particular, Article 77(2)(b) and (d), Article 87(2)(a) and Article 88(2)(a) thereof , Having regard to the proposal from the European Commission, After transmission of the draft legislative act to the national parliaments, Having regard to the opinion of the European Economic and Social Committee, Having regard to the opinion of the Committee of the Regions, Acting in accordance with the ordinary legislative procedure, Whereas: (1)The Communication of the Commission of 13 February 2008 entitled 'preparing the next steps in border management in the European Union' outlined the need, as part of the European integrated border management strategy, to establish an Entry/Exit System (EES) which registers electronically the time and place of entry and exit of third country nationals admitted for a short stay to the Schengen area and which calculates the duration of their authorised stay. (2)The European Council of 19 and 20 June 2008 underlined the importance of continuing to work on the development of the EU's integrated border management strategy, including better use of modern technologies to improve the management of external borders. (3)The Communication of the Commission of 10 June 2009, entitled 'An area of freedom, security and justice serving the citizens', advocates establishing an electronic system for recording entry to and exit from Member States' territory via the crossing of external borders to ensure more effective management of access to this territory. (4)The European Council of 23 and 24 of June 2011 called for work on "smart borders" to be pushed forward rapidly. The Commission published a Communication "Smart borders – options and the way ahead" on 25 October 2011. (5)The European Council in its Strategic guidelines adopted in June 2014 stressed that “the Schengen area, allowing people to travel without internal border controls, and the increasing numbers of people travelling to the EU require efficient management of the EU’s common external borders to ensure strong protection. The Union must mobilise all the tools at its disposal to support the Member States in their task. To this end: integrated Border Management of external borders should be modernised in a cost efficient way to ensure smart border management inter alia with an entry-exit system and supported by the new agency for large-scale IT systems (eu-LISA)". (6)The Communication of the Commission of 13 May 2015 entitled “A European agenda on migration” noted that "a new phase would come with the “Smart Borders” initiative to increase the efficiency of border crossings, facilitating crossings for the large majority of ‘bona fide’ third country travellers, whilst at the same time strengthening the fight against irregular migration by creating a record of all cross-border movements by third country nationals, fully respecting proportionality". (7)It is necessary to specify the objectives of the Entry/Exit System (EES) and its technical architecture, to lay down rules concerning its operation and use and to define responsibilities for the system, the categories of data to be entered into the system, the purposes for which the data are to be entered, the criteria for their entry, the authorities authorised to access the data and further rules on data processing and the protection of personal data. (8)The EES should apply to third country nationals admitted for a short stay to the Schengen area. It should also apply to third country nationals whose entry for a short stay has been refused. (9)The EES should have the objective of improving the management of external borders, preventing irregular immigration and facilitating the management of migration flows. The EES should, in particular and when relevant, contribute to the identification of any person who does not or no longer fulfils the conditions of duration of stay within the territory of the Member States. (10)To meet those objectives, the EES should process alphanumeric data and biometric data (fingerprints and facial image). The use of biometrics, despite its impact on the privacy of travellers, is justified for two reasons. Firstly, biometrics are a reliable method to identify third country nationals within the territory of the Member States not in possession of travel documents or any other means of identification, a common modus operandi of irregular migrants. Secondly, biometrics provide for the more reliable matching of entry and exit data of legal travellers. Where facial images are used in combination with fingerprint data, it allows for the reduction of fingerprints registered while enabling the same result in terms of accuracy of the identification. (11)Four fingerprints of visa exempt third country nationals should be enrolled in the EES, if physically possible, to allow for accurate verification and identification (ensuring that the third country national is not already enrolled under another identity or with another travel document) and to guarantee that sufficient data is available in every circumstance. The check of the fingerprints of visa holders will be done against the Visa Information System. (VIS) established by Council Decision 2004/512/EC. The facial image of both visa exempt and visa holding third country nationals should be registered in the EES and it should be used as the main biometric identifier for verifying the identity of third country nationals who have been previously registered in the EES and for as long as their individual file has not been deleted. Alternatively, that verification should be performed using fingerprints. (12)The EES should consist of a Central System, which will operate a computerised central database of biometric and alphanumeric data, a National Uniform Interface in each Member State, a Secure Communication Channel between the EES Central System and the VIS Central System and the Communication Infrastructure between the Central System and the National Uniform Interfaces. Each Member State should connect its national border infrastructures to the National Uniform Interface.

(13)Interoperability should be established between the EES and the VIS by way of a direct communication channel between the Central Systems to enable the border authorities using the EES to consult the VIS in order to retrieve visa-related data to create or update the individual file; to enable the border authorities to verify the validity of the visa and the identity of a visa holder by means of fingerprints directly against the VIS at the external borders and to enable the border authorities to verify the identity of visa exempt third country nationals against the VIS with fingerprints. Interoperability should also enable the border authorities using the VIS to directly consult the EES from the VIS for the purposes of examining visa applications and decisions relating to those applications and enable visa authorities to update the visa-related data in the EES in the event that a visa is annulled, revoked or extended. Regulation (EC) No 767/2008/EC of the European Parliament and of the Council should be amended accordingly. (14)This Regulation should define the authorities of the Member States which may be authorised to have access to the EES to enter, amend, delete or consult data for the specific purposes of the EES and to the extent necessary for the performance of their tasks. (15)Any processing of EES data should be proportionate to the objectives pursued and necessary for the performance of tasks of the competent authorities. When using the EES, the competent authorities should ensure that the human dignity and integrity of the person, whose data are requested, are respected and should not discriminate against persons on grounds of sex, colour, ethnic or social origin, genetic features, language, religion or belief, political or any other opinion, membership of a national minority, property, birth, disability, age or sexual orientation. (16)In the fight against terrorist offences and other serious criminal offences, it is imperative that law enforcement authorities have the most up-to-date information if they are to perform their tasks. Access to VIS data for law enforcement purpose has already proven its usefulness in identifying people who died violently or for helping investigators to make substantial progress in cases related to human being trafficking, terrorism or drug trafficking. Access to the information contained in the EES is necessary to prevent, detect and investigate terrorist offences as referred to in Council Framework Decision 2002/475/JHA or other serious criminal offences as referred to in Council Framework Decision 2002/584/JHA. The data generated by the EES may be used as an identity verification tool both in cases where the third country national has destroyed his/her documents and where law enforcement authorities are investigating a crime through the use of fingerprints or facial image and wish to establish an identity. It may also be used as a criminal intelligence tool to construct evidence by tracking the travel routes of a person suspected of having committed a crime or a victim of crime. Therefore, the data in the EES should be available, to the designated authorities of the Member States and the European Police Office ('Europol'), subject to the conditions set out in this Regulation. (17)Moreover, Europol plays a key role with respect to cooperation between Member States’ authorities in the field of cross-border crime investigation in supporting Union-wide crime prevention, analyses and investigation. Consequently, Europol should also have access to the EES within the framework of its tasks and in accordance with Council Decision 2009/371/JHA. (18)Access to the EES for the purpose of preventing, detecting or investigating terrorist offences or other serious criminal offences constitutes an interference with the fundamental rights to respect for the private life of individuals and to protection of personal data of persons whose personal data are processed in the EES. Any such interference must be in accordance with the law, which must be formulated with sufficient precision to allow individuals to adjust their conduct and it must protect individuals against arbitrariness and indicate with sufficient clarity the scope of discretion conferred on the competent authorities and the manner of its exercise. Any interference must be necessary in a democratic society to protect a legitimate and proportionate interest and proportionate to the legitimate objective to achieve. (19)Comparisons of data on the basis of a latent fingerprint, which is the dactyloscopic trace which may be found at a crime scene, is fundamental in the field of police cooperation. The possibility to compare a latent fingerprint with the fingerprint data which is stored in the EES in cases where there are reasonable grounds for believing that the perpetrator or victim may be registered in the EES should provide the law enforcement authorities of the Member States with a very valuable tool in preventing, detecting or investigating terrorist offences or other serious criminal offences, when for example the only evidence at a crime scene are latent fingerprints. (20)It is necessary to designate the competent authorities of the Member States as well as the central access point through which the requests for access to EES data are made and to keep a list of the operating units within the designated authorities that are authorised to request such access for the specific purposes for the prevention, detection or investigation of terrorist offences or of other serious criminal offences. (21)Requests for access to data stored in the Central System should be made by the operating units within the designated authorities to the central access point and should be justified. The operating units within the designated authorities that are authorised to request access to EES data should not act as a verifying authority. The central access points should act independently of the designated authorities and should be responsible for ensuring, in an independent manner, strict compliance with the conditions for access as established in this Regulation. In exceptional cases of urgency, where early access is necessary to respond to a specific and actual threat related to terrorist offences or other serious criminal offences, the central access point should be able to process the request immediately and only carry out the verification afterwards. (22)To protect personal data and to exclude systematic searches, the processing of EES data should only take place in specific cases and when it is necessary for the purposes of preventing, detecting or investigating terrorist offences or other serious criminal offences. The designated authorities and Europol should only request access to the EES when they have reasonable grounds to believe that such access will provide information that will substantially assist them in preventing, detecting or investigating a terrorist offence or other serious criminal offence. (23)In addition, access to the EES for identification of unknown suspects, perpetrators or victims of terrorist offences or other serious criminal offences should be allowed only on the condition that searches with the national fingerprint databases of the Member State and with the automated fingerprinting identification systems of all other Member States under Council Decision 2008/615/JHA did not lead to the establishment of the identity of the data subject Furthermore, access to the EES to consult the entry/exit records of a known person should be duly justified. (24)For the purpose of efficient comparison and exchange of personal data, Member States should fully implement and make use of the existing international agreements as well as of Union law concerning the exchange of personal data already in force, in particular of Decision 2008/615/JHA. (25)The personal data stored in the EES should be kept for no longer than is necessary for the purposes of the EES. It is appropriate to keep the data related to third country nationals for a period of five years for border management purposes in order to avoid the need for third country nationals to re-enrol in the EES before that period has lapsed. For third country nationals who are family members of a Union citizen to whom Directive 2004/38/EC applies or of a national of a third country enjoying the right of free movement under Union law and who do not hold a residence card referred to under Directive 2004/38/EC, it is appropriate to store each coupled entry/ exit reccord for a maximum period of one year after the last exit. (26)A five year data retention period is necessary to allow the border guard performing the necessary risk analysis requested by the Schengen Borders Code before authorising a traveller entering the Schengen area. The processing of visa application in consular posts requires also analysing the travel history of the applicant to assess the use of previous visas and the respect of the conditions of stay. The abandoning of passport stamping will be compensated by a consultation of the EES. The travel history available in the system should therefore cover a period of time which is sufficient for the purpose of visa issuance. The five year data retention period will reduce the re-enrolment frequency and will be beneficial for all travellers as the average border crossing time will decrease as will do the waiting time at border crossing points. Even for a traveller entering only once in the Schengen area, the fact that other travellers being already registered in the EES will not have to re-enrol will reduce the waiting time at border. This data retention period will also be necessary to allow for facilitation for the border crossing by using process accelerators and self-service systems. Such facilitation is dependent of the data registered in the system. A shorter data retention period would have a negative impact on the duration of border controls. A shorter data retention period would also reduce the group of travellers that can benefit of such facilitation and thereby undermine the stated objective of EES to facilitate border crossing. (27)The same retention period of five years would be necessary for data on persons who have not exited the territory of the Member States within the authorised period of stay in order to support the identification and return process and for persons whose entry for a short stay {or on the basis of a touring visa} has been refused. The data should be deleted after the period of five years, unless there are grounds to delete it earlier. (28)Precise rules should be laid down as regards the responsibilities for the development and operation of the EES and the responsibilities of the Member States for the connection to the EES. The Agency for the operational management of large-scale information systems in the area of freedom, security and justice, established by Regulation (EU) No 1077/2011 of the European Parliament and of the Council, should be responsible for the development and operational management of a centralised EES in accordance with this Regulation and the relevant provisions of Regulation (EU) No 1077/2011 should be amended accordingly. (29)Rules on the liability of the Member States in respect to damage arising from any breach of this Regulation should be laid down. (30)Directive 95/46/EC of the European Parliament and of the Council applies to the processing of personal data by the Member States in application of this Regulation unless such processing is carried out by the designated or verifying authorities of the Member States for the purposes of the prevention, detection or investigation of terrorist offences or of other serious criminal offences. (31)The processing of personal data by the authorities of the Member States for the purposes of the prevention, detection or investigation of terrorist offences or of other serious criminal offences pursuant to this Regulation should be subject to a standard of protection of personal data under their national law which complies with Council Framework Decision 2008/977/JHA . (32)Personal data obtained by Member States pursuant to this Regulation should not be transferred or made available to a third country, an international organisation or any private party established in or outside the Union except if necessary in individual cases in order to assist the identification of a third country national in relation to his/her return and subject to strict conditions.

(33)Regulation (EC) No 45/2001 of the European Parliament and the Council applies to the activities of the Union institutions or bodies when carrying out their tasks as responsible for the operational management of EES. (34)The independent supervisory authorities established in accordance with Article 28 of Directive 95/46/EC should monitor the lawfulness of the processing of personal data by the Member States, whilst the European Data Protection Supervisor as established by Regulation (EC) No 45/2001 should monitor the activities of the Union institutions and bodies in relation to the processing of personal data. The European Data Protection Supervisor and the supervisory authorities should cooperate with each other in the monitoring of the EES. (35)National supervisory authorities established in accordance with Article 25 of Council Framework Decision 2008/977/JHA should monitor the lawfulness of the processing of personal data for law enforcement purposes by the Member States, and the national supervisory authorities established in accordance with Article 33 of Decision 2009/371/JHA should monitor the lawfulness of data processing activities performed by Europol. (36)"(...) The European Data Protection Supervisor was consulted in accordance with Article 28(2) of Regulation (EC) No 45/2001 and delivered an opinion on … (37)The proposal establishes strict access rules to the EES system and the necessary safeguards. It also sets out the individuals' rights of access, correction, deletion and redress, in particular the right to a judicial remedy and the supervision of processing operations by public independent authorities. This Regulation therefore respects the fundamental rights and observes the principles recognised by the Charter of Fundamental Rights of the European Union, in particular the right to dignity (Article 1 of the Charter); the prohibition of slavery and forced labour (Article 5 of the Charter); the right to liberty and security (Article 6 of the Charter), respect for private and family life (Article 7 of the Charter), the protection of personal data (Article 8 of the Charter), the right to non-discrimination (Article 21 of the Charter), the rights of the child (Article 24 of the Charter), the rights of elderly (Article 25 of the Charter ), the rights of persons with disabilities (article 26 of the Charter) and the right to an effective remedy (Article 47 of the Charter). (38)The effective monitoring of the application of this Regulation requires evaluation at regular intervals. The Member States should lay down rules on penalties applicable to infringements of the provisions of this Regulation and ensure that they are implemented. (39)In order to ensure uniform conditions for the implementation of this Regulation, implementing powers should be conferred on the Commission. Those powers should be exercised in accordance with Regulation (EU) No 182/2011 of the European Parliament and of the Council. (40)The establishment of a common EES and the creation of common obligations, conditions and procedures for use of data cannot be sufficiently achieved by the Member States and can therefore, by reason of the scale and impact of the action, be better achieved at Union level in accordance with the principle of subsidiarity as set out in Article 5 of the Treaty on European Union. In accordance with the principle of proportionality, as set out in that Article, the Regulation does not go beyond what is necessary in order to achieve this objective. (41)Following the entry into operation of the Entry/Exit System, Article 20(2) of the Convention implementing the Schengen Agreement should be amended as it is incompatible with Article 77(2)(a) and (c) of the Treaty on Functioning of the European Union due to the fact that the common policy on visas cannot be based on the existence or non-existence of bilateral visa waiver agreements concluded by Member States and the authorised length of stay of third country nationals should not depend on the number and content of such bilateral agreements. Furthermore the Entry/Exit system could not take into account of and calculate the authorised length of stay of visa free third country nationals benefitting from such agreements and they should be eliminated. (42)The projected costs of the EES are lower than the budget earmarked for Smart Borders in Regulation (EU) 515/2014 of the European Parliament and the Council. Accordingly, following the adoption of this Regulation, pursuant to Article 5(5)(b) of Regulation (EU) 515/2014, the Commission should, by means of a delegated act, re-allocate the amount currently attributed for developing IT systems supporting the management of migration flows across the external borders. (43)This Regulation establishing the EES replaces the obligation to stamp passports of third country nationals which is applicable by all acceding Member States. Stays in Member States which are not yet fully applying the Schengen acquis in accordance with their respective Acts of Accession should not be taken into account in the calculation of the duration of the authorised stay in the Schengen area. Such Member States should register in the EES the stay of third country nationals but the automated calculator in the system should not compute it as part of the authorised length of stay. (44)This Regulation is without prejudice to the application of Dreictive 2004/38/EC. (45)In accordance with Articles 1 and 2 of Protocol No 22 on the position of Denmark, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, Denmark is not taking part in the adoption of this Regulation and is not bound by it or subject to its application. Given that this Regulation builds upon the Schengen acquis, Denmark shall, in accordance with Article 4 of that Protocol, decide within a period of six months after the Council has decided on this Regulation whether it will implement it in its national law. (46)This Regulation constitutes a development of the provisions of the Schengen acquis in which the United Kingdom does not take part, in accordance with Council Decision 2000/365/EC; the United Kingdom is therefore not taking part in the adoption of this Regulation and is not bound by it or subject to its application. (47)This Regulation constitutes a development of the provisions of the Schengen acquis in which Ireland does not take part, in accordance with Council Decision 2002/192/EC; Ireland is therefore not taking part in the adoption of this Regulation and is not bound by it or subject to its application. (48)As regards Iceland and Norway, this Regulation constitutes a development of the provisions of the Schengen acquis within the meaning of the Agreement concluded by the Council of the European Union and the Republic of Iceland and the Kingdom of Norway concerning the latters' association with the implementation, application and development of the Schengen acquis which fall within the area referred to in Article 1, point A of Council Decision 1999/437/EC . (49)As regards Switzerland, this Regulation constitutes a development of the provisions of the Schengen acquis within the meaning of the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation's association with the implementation, application and development of the Schengen acquis which fall within the area referred to in Article 1, point A of Council Decision 1999/437/EC read in conjunction with Article 3 of Council Decision 2008/146/EC and with Article 3 of Council Decision 2008/149/JHA. (50)As regards Liechtenstein, this Regulation constitutes a development of the provisions of the Schengen acquis within the meaning of the Protocol between the European Union, the European Community, the Swiss Confederation and the Principality of Liechtenstein on the accession of the Principality of Liechtenstein to the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation's association with the implementation, application and development of the Schengen acquis which fall within the area referred to in Article 1, point A of Council Decision 1999/437/EC read in conjunction with Article 3 of Council Decision 2011/350/EU and with Article 3 of Council Decision 2011/349/EU. (51)This Regulation constitutes an act building upon, or otherwise relating to, the Schengen acquis within, respectively, the meaning of Article 3(2) of the 2003 Act of Accession, Article 4(2) of the 2005 Act of Accession and Article 4(2) of the 2011 Act of Accession,

HAVE ADOPTED THIS REGULATION: CHAPTER 1

General Provisions Article 1

Subject matter 1. This Regulation establishes an 'Entry/Exit System' (EES) for the recording and storage of information on the date, time and place of entry and exit of third country nationals crossing the external borders of the Member States, for the calculation of the duration of their stay, and for the generation of alerts to Member States when authorised periods for stay have expired as well as for the recording of the date, time and place of refusal of entry of third country nationals whose entry for a short stay {or on the basis of a touring visa} has been refused as well as the authority of the Member State which refused the entry and the reasons for the refusal. 2.This Regulation also lays down in its Chapter IV the conditions under which Member States' designated law enforcement authorities and the European Police Office (Europol) may obtain access for consultation of the EES for the purposes of the prevention, detection and investigation of terrorist offences or of other serious criminal offences. Article 2

Scope 1.This Regulation applies to third country nationals admitted for a short stay {or on the basis of a touring visa} in the territory of the Member States subject to border checks in accordance with Regulation (EU) 2016/399 when crossing the external borders of the Member States. When entering and exiting the territory of the Member States, it applies to third country nationals who are family members of a Union citizen to whom Directive 2004/38/EC applies or of a national of a third country enjoying the right of free movement under Union law and who do not hold a residence card referred to under Directive 2004/38/EC. 2.This Regulation also applies to third country nationals whose entry for a short stay {or on the basis of a touring visa} to the territories of the Member States is refused in accordance with Article 14 of Regulation (EU) 2016/399. 3.This Regulation does not apply to: (a) family members of a Union citizen to whom Directive 2004/38/EC applies who hold a residence card pursuant to that Directive; (b) family members of third country nationals enjoying the right of free movement under Union law who hold a residence card pursuant to Directive 2004/38/EC; (c) holders of residence permits referred to in point 16 of Article 2 of Regulation (EU) 2016/399 other than those covered by points (a) and (b) of this paragraph; (d) holders of long-stay visas; (e) nationals of Andorra, Monaco and San Marino; (f) persons or categories of persons exempt from or benefiting from facilitation of border crossing as referred to in Article 6a (3)(d),(e) and (f) of Regulation (EU) 2016/399. This Regulation does not apply to family members referred to in points (a) and (b) of the first subparagraph even if they are not accompanying or joining the Union citizen or a third country national enjoying the right of free movement.. 4.The provisions of this Regulation regarding the calculation of the duration of stay and the generation of alerts to Member States when authorised periods for stay have expired do not apply to third country nationals who are family members of a Union citizen to whom Directive 2004/38/EC applies or of a national of a third country enjoying the right of free movement under Union law and who do not hold a residence card referred to under Directive 2004/38/EC. Article 3

Definitions 1. For the purposes of this Regulation, the following definitions apply: (1)‘external borders' mean external borders as defined in Article 2(2) of Regulation (EU) 2016/399;

(2)'border authorities' mean the competent authorities assigned, in accordance with national law, to carry out checks on persons at the external border crossing points in accordance with Regulation (EU) 2016/399; (3)‘immigration authorities’ mean the competent authorities assigned, in accordance with national law, to examineand take decisions related to the stay of third country nationals on the territory of the Member States; (4)'visa authorities' mean the competent authorities, including the central visa authorities and the authorities responsible for issuing visas at the external border, which are responsible in each Member State for examining visa applications, for taking decisions on visa applications and for taking decisions on whether to annul, revoke or extend visas, (5)'third country national' means any person who is not a citizen of the Union within the meaning of Article 20 of the Treaty, with the exception of persons who enjoy rights of free movement equivalent to those of Union citizens under agreements between the Union, or the Union and its Member States on the one hand, and third countries on the other hand ; (6)‘travel document’ means a passport or other equivalent document, entitling the holder to cross the external borders and to which a visa may be affixed; (7)'short stay' means stays in the territory of the Member States of a duration of no more than 90 days in any 180 day period; (8)‘short stay visa’ means an authorisation issued by a Member State with a view to an intended stay on the territory of the Member States of a duration of no more than 90 days in any 180 day period; (9)‘touring visa’ means an authorisation issued by a Member State with a view to an intended stay in the territory of two or more Member States for a duration of more than 90 days in any 180 day period, provided that the applicant does not intend to stay for more than 90 days in any 180 day period in the territory of the same Member State; (10)‘carriers’ mean any natural or legal person whose profession it is to provide transport of persons; (11)'Member State responsible’ means the Member State which has entered the data in the EES; (12)'verification’ means the process of comparing of sets of data to establish the validity of a claimed identity (one-to-one check); (13)'identification’ means the process of determining a person’s identity through a database search against multiple sets of data (one-to-many check); (14)'alphanumeric data’ means data represented by letters, digits, special characters, space and punctuation marks; (15)‘fingerprint data’ means the data relating to fingerprints of the index, middle finger, ring finger and little finger from the right hand, where present, and otherwise from the left hand, or a latent fingerprint; (16)‘facial image’ means digital images of the face with sufficient image resolution and quality to be used in automated biometric matching; (17)‘biometric data’ means fingerprint data and facial image; (18)‘overstayer’ means a third country national who does not fulfil, or no longer fulfils the conditions relating to the duration of a short stay on the territory of the Member States; (19)‘eu-LISA’ means the European Agency for the operational management of large-scale information systems in the area of freedom, security and justice established by Regulation (EU) No 1077/2011; (20)'Frontex' means the European Agency for the Management of Operational Cooperation at the External Borders of the Member States of the European Union established by Regulation (EC) No 2007/2004; (21)'supervisory authority' means the supervisory authorities established in accordance with Article 28 of Directive 95/46/EC;

(22)‘national supervisory authority’ as regards law enforcement purposes means the supervisory authorities established in accordance with Article 25 of Council Framework Decision 2008/977/JHA; (23)‘national supervisory body’ means the supervisory bodies established in accordance with Article 33 of Decision 2009/371/JHA; (24)‘EES data’ means all data stored in the Central System in accordance with Articles 13, 14, 15, 16, 17 and 18; (25)'law enforcement' means the prevention, detection or investigation of terrorist offences or other serious criminal offences; (26)'terrorist offences' mean the offences under national law which correspond or are equivalent to those referred to in Articles 1 to 4 of Framework Decision 2002/475/JHA; (27)'serious criminal offences' means the offences which correspond or are equivalent to those referred to in Article 2(2) of Framework Decision 2002/584/JHA, if they are punishable under national law by a custodial sentence or a detention order for a maximum period of at least three years; 2. The terms defined in Article 2 of Directive 95/46/EC shall have the same meaning in this Regulation in so far as personal data are processed by the authorities of Member States for the purpose laid down in Article 5 of this Regulation. 3. The terms defined in Article 2 of Framework Decision 2008/977/JHA shall have the same meaning in this Regulation in so far as personal data are processed by the authorities of the Member States for law enforcement purposes. Article 4

Set-up of the EES The Agency for the operational management of large-scale information systems in the area of freedom, security and justice ('eu-LISA') shall develop the EES and ensure its operational management, including the functionalities for processing biometric data referred to in Article 14(1)(f) and Article 15. Article 5 Purpose of the EES By recording, storing and providing access to Member States to the date, time and place of the entry and exit and refusals of entry of third country nationals at external borders, the EES shall: (a)enhance the efficiency of border checks by calculating and monitoring the duration of the authorised stay at entry and exit of third country nationals admitted for a short stay {or on the basis of a touring visa}; (b)assist in the identification of any person who does not, or does no longer fulfil the conditions for entry to or stay on the territory of the Member States; (c)allow to identify and detect overstayers (also within the territory) and enable competent national authorities of the Member States to take appropriate measures including to increase the possibilities for return (d)allow to electronically check refusals of entry in the EES; (e)free up border control resources from performing checks that can be automated and enable better focus on the assessment of third country nationals; (f)enable consulates to have access to information on the lawful use of previous visas; (g)inform third country nationals of the duration of their authorised stay;

(h)gather statistics on the entries and exits, refusals of entry and overstays of third country nationals to improve the assessment of the risk of overstays and to support evidence-based Union migration policy making; (i)combat identity fraud; (j)contribute to the prevention, detection and investigation of terrorist offences or of other serious criminal offences; (k)enable identifying and apprehending terrorist, criminal suspects as well as of victims crossing the external borders; (l)enable generating information on travel histories of terrorist, criminal suspects as well as of victims for investigations related to terrorism or serious crime. Article 6 Technical architecture of the EES 1.The EES shall be composed of: (a)a Central System; (b)a National Uniform Interface (NUI) in each Member State based on common technical specifications and identical for all Member States enabling the connection of the Central System to the national border infrastructures in Member States; (c)a Secure Communication Channel between the EES Central System and the VIS Central System; (d)a Communication Infrastructure between the Central System and the National Uniform Interfaces. 2. The EES Central System shall be hosted by eu-LISA in its two technical sites. It shall provide the functionalities laid down in this Regulation in accordance with the conditions of availability, quality and speed pursuant to Article 34(3). 3. Without prejudice to Commission Decision 2008/602/EC, some hardware and software components of the Communication Infrastructure of the EES shall be shared with the communication infrastructure of the VIS referred to in Article 1(2) of Decision 2004/512/EC. A separate virtual private network dedicated to the EES shall be established in addition to the existing private virtual network of the VIS to ensure the logical separation of VIS and EES data. Article 7

Interoperability with the VIS 1.eu-LISA shall establish a Secure Communication Channel between the EES Central System and the VIS Central System to enable interoperability between the EES and the VIS. Direct consultation between the systems shall only be possible if both this Regulation and Regulation (EC) No 767/2008 provide for it. 2.The interoperability requirement shall enable the border authorities using the EES to consult the VIS from the EES in order to: (a)retrieve and import the visa related data directly from the VIS in order to create or update the individual file of a visa holder in the EES in accordance with Article 13, 14 and 16 of this Regulation and Article 18a of Regulation (EC) No 767/2008; (b)retrieve and import the visa related data directly from the VIS in order to update the EES in the event that a visa is annulled, revoked or extended in accordance with Article 17 of this Regulation and Articles 13, 14 and 18a of Regulation (EC) No 767/2008;

(c)verify the authenticity and validity of the visa or whether the conditions for entry to the territory of the Member States in accordance with Article 6 of Regulation (EU) 2016/399 are fulfilled pursuant to Article 21 of this Regulation and Article 18(2) of Regulation (EC) No 767/2008; (d)verify at the external borders whether a visa exempt third country national has been previously registered in the VIS in accordance with Article 21 of this Regulation and Article 19a of Regulation (EC) No 767/2008; (e)where the identity of a visa holder cannot be verified against the EES, verify at the external borders the identity of a visa holder with fingerprints against the VIS in accordance with Article 21 of this Regulation and Article 18(6) of Regulation (EC) No 767/2008. 3. The interoperability requirement shall enable the visa authorities using the VIS to consult the EES from the VIS in order to: (a)examine visa applications and adopt decisions relating to those applications in accordance with Article 22 of this Regulation and Article 15(4) of Regulation (EC) No 767/2008; (b)update the visa related data in the EES in the event that a visa is annulled, revoked or extended in accordance with Article 17 of this Regulation and Articles 13 and 14 of Regulation (EC) No 767/2008. Article 8

Access to the EES for entering, amending, deleting and consulting data 1.Access to the EES for entering, amending, deleting and consulting the data referred to in Articles 13, 14, 15, 16, 17 and 18 shall be reserved exclusively to duly authorised staff of the authorities of each Member State which are competent for the purposes laid down in Articles 21 to 32. That access shall be limited to the extent needed for the performance of the tasks in accordance with this purpose, and proportionate to the objectives pursued. 2.Each Member State shall designate the competent national authorities, including border, visa and immigration authorities. The duly authorised staff shall have access to the EES to enter, amend, delete or consult data. Each Member State shall communicate a list of these authorities to eu-LISA without delay. That list shall specify for which purpose each authority shall have access to the data in the EES. Within three months after the EES has started operations in accordance with Article 60, a consolidated list of those authorities shall be published in the Official Journal of the European Union. Where there are amendments thereto, eu-LISA shall publish an updated consolidated list once a year. Article 9

General principles 1.Each competent authority authorised to access the EES shall ensure that the use of the EES is necessary, appropriate and proportionate. 2.Each competent authority shall ensure that in using the EES, it does not discriminate against third country nationals on the grounds of sex, racial or ethnic origin, religion or belief, disability, age or sexual orientation and that it fully respects human dignity and the integrity of the person. Particular attention shall be paid to the specific situation of children, the elderly and persons with a disability. In particular, when retaining a child's data, the best interest of the child shall be a primary consideration. Article 10

Automated calculator and obligation to inform third country nationals on the remaining authorised stay 1.The EES shall include an automated calculator that indicates the maximum authorised duration of stay in accordance with Article 6(1) of Regulation (EU) 2016/399 for third country nationals registered in the EES admitted for a short stay {or on the basis of a touring visa}. The calculator shall not apply to third country nationals who are family members of a Union citizen to whom Directive 2004/38/EC applies or of a national of a third country enjoying the right of free movement under Union law and who do not hold a residence card referred to under Directive 2004/38/EC. 2.The automated calculator shall: (a)inform the competent authorities of the authorised length of stay on entry and whether the number of authorised entries of the single or double entry visas have been previously used; (b)identify third country nationals upon exit who have overstayed. 3. The border authorities shall inform the third country national of the maximum number of days of authorised stay which shall take into account the number of entries and the length of stay authorised by the visa {or the touring visa}, in accordance with Article 8(9) of Regulation (EU) 2016/399.

4.Stays in Member States which are not yet fully applying the Schengen acquis in accordance with their respective Acts of Accession shall not be taken into account in the calculation of the duration of the authorised stay in the Schengen area. Those Member States shall register the stays of third country nationals in the EES. The automated calculator in the system shall not however compute stays in Member States which are not yet fully applying the Schengen acquis as part of the authorised length of stay. Article 11

Information mechanism 1.The EES shall include a mechanism that shall automatically identify which entry/exit records do not have exit data immediately following the date of expiry of the authorised length of stay and identify records for which the maximum stay allowance has been exceeded. 2.A list generated by the system containing the data referred to in Article 14 and 15 of all identified overstayers shall be available to the designated competent national authorities. Article 12

Web service 1. In order to enable third country nationals to verify at any moment the remaining authorised length of stay, a secure internet access to a web service hosted by eu-LISA in its two technical sites shall allow those third country nationals to provide the data required pursuant to Article 14(1)(b) together with the anticipated entry and exit dates. On that basis, the web service shall provide them with an OK/NOT OK answer. The web service shall use a separate read-only database updated on a daily basis via a one-way extraction of the minimum necessary subset of EES data. 2. Carriers may use the secure internet access to the web service referred to in paragraph 1 to verify whether or not third country nationals holding a single or double entry visa have already used the visa. The carrier shall provide the data listed in Article 14(1)(d). The web service shall on that basis provide the carriers with an OK/NOT OK answer. Carriers may store the information sent and the answer received. 3. Detailed rules on the conditions for operation of the web service and the data protection and security rules applicable to the web service shall be adopted in accordance with the examination procedure referred to in Article 61(2). CHAPTER II

Entry and use of data by border authorities Article 13

Procedures for entering data in the EES 1. Border authorities shall verify, in accordance with Article 21, whether a previous individual file has been created in the EES for the third country national as well as their identity. Where a third country national uses a self-service system for pre-enrolment of data or for the performance of border checks [should this self-service system not be defined or explained?] , a verification may be carried out through the self service system. 2.Where a previous individual file has been created, the border authority shall, if necessary, update the individual file data, enter an entry/exit record for each entry and exit in accordance with Articles 14 and 15 or, where applicable, a refusal of entry record in accordance with Article 16. That record shall be linked to the individual file of the third country national concerned. Where applicable, the data referred to in Article 17(1) shall be added to the individual file and the data referred to in Article 17(3) and (4) shall be added to the entry/exit record of the third country national concerned. The different travel documents and identities used legitimately by a third country national shall be added to the third country national's individual file. Where a previous file has been registered and the third country national presents a travel document which differs from the one which was previously registered, the data refered under Article 14(1)(f) shall also be updated if the facial image reccorded in the chip of the new travel document can be extracted electronically. 3. Where it is necessary to create or update the individual file data of a visa holder, the border authorities may retrieve and import the data provided for in Article 14(1) (d), (e) and (g) directly from the VIS in accordance with Article 18a of Regulation (EC) No 767/2008. 4. In the absence of a previous registration of a third country national in the EES, the border authority shall create the individual file of the person by entering the data referred to in Articles 14, 15 and 16 as applicable. 5. Where a third country national uses a self-service system for pre-enrolment of data, Article 8c of Regulation (EU) 2016/399 shall apply. In that case, the third country national may pre-enrol the individual file data or, if applicable, the data that needs to be updated. The data shall be confirmed by the border guard when the decision to authorise or to refuse entry has been taken in accordance with Regulation (EU) 2016/399. The verification referred to in paragraph 1 of this Article shall be carried out through the self service system. The data listed in Article 14(1)(d), (e) and (g) may be retrieved and imported directly from the VIS. 6 Where a third country national uses a self-service system for the performance of the border checks, Article 8d of Regulation (EU) 2016/399 shall apply. In that case, the verification referred to in paragraph 1 of this Article shall be carried out through the self service system. 7. Where a third country national uses an e-gate for crossing the external border, Article 8d of Regulation (EU) 2016/399 shall apply. In that case, the corresponding registration of the entry/exit record and the linking of that record to the concerned individual file shall be carried out through the e-gate. 8. Where it is necessary to create an individual file or to update the facial image referred to in Article 14(1)(f), the facial image can only be extracted electronically from the electronic Machine Readable Travel Documents (eMRTD) and inserted into the individual file where it has been verified that the facial image recorded in the chip of the eMRTD corresponds to the live facial image of the concerned third country national. Article 14

Personal data for visa holders 1.The border authority shall create the individual file of the visa holding third country national by entering the following data:

(a)surname (family name); first name(s) (given names); date of birth; nationality or nationalities; sex; (b)type, number and three letter code of the issuing country of the travel document or documents; (c)the date of expiry of the validity of the travel document(s); (d)the short stay visa sticker number, including the three letter code of the issuing Member State, the type of visa, the date of end of maximum duration of the stay as authorised by the visa which needs to be updated at each entry and the date of expiry of the validity of the visa, if applicable; (e)at the first entry on the basis of the short stay visa, the number of entries and the authorised period of stay as indicated on the visa sticker; (f) the facial image, where possible extracted electronically from the eMRTD, and where this is not possible, taken live; (g)the visa sticker number of the touring visa, the type of visa and the date of expiry of the validity of the visa, if applicable. 2.On each entry of the visa holding third country national, the following data shall be entered in an entry/exit record. That record shall be linked to the individual file of that third country national using the individual reference number created by the EES upon creation of that file: (a)date and time of the entry; (b)the border crossing point and authority that authorised the entry; 3.On each exit, the following data shall be entered in the entry/exit record linked to the individual file of that visa holding third country national: (a)date and time of the exit; (b)the border crossing point of the exit. 4.Where there is no exit data immediately following the date of expiry of the authorised length of stay, the entry/exit record shall be identified with a mark or flag by the system and the data of the visa holding third country national identified as an overstayer shall be entered into the list referred to in Article 11. 5. In order to create the individual file of a visa holding third country national the data provided for in paragraph 1 (d), (e) and (g) may be retrieved and imported directly from the VIS by the border authority in accordance with Article 18a of Regulation (EC) No 767/2008. Article 15

Personal data for third country nationals exempt from the visa obligation 1.For third country nationals exempt from the visa obligation, the border authority shall enter into their individual file the data provided for in Article 14(1)(a), (b), (c) and (f). In addition it shall enter into that individual file the four fingerprint of the index, middle-finger, ring-finger and little finger from the right hand, and where this is not possible the same fingers from the left hand, in accordance with the specifications for the resolution and use of fingerprints adopted by the Commission in accordance with Article 61(2). For third country nationals exempt from the visa obligation, Articles 14(2) to 14(4) shall apply. 2.Children under the age of 12 shall be exempt from the requirement to give fingerprints for legal reasons. 3.Persons for whom fingerprinting is physically impossible shall be exempt from the requirement to give fingerprints for factual reasons. However, where the physical impossibility is of a temporary nature, the person shall be required to give the fingerprints at the subsequent entry. The border authorities shall be entitled to request further clarification on the grounds for the temporary impossibility to provide fingerprints.

Member States shall ensure that appropriate procedures guaranteeing the dignity of the person are in place in the event of difficulties encountered in capturing fingerprints. 4.Where the person concerned is exempt from the requirement to give fingerprints for legal or factual reasons pursuant to paragraphs 2 or 3, the specific data field shall be marked as ‘not applicable’. The system shall allow a distinction to be made between the cases where fingerprints are not required to be provided for legal reasons and the cases where they cannot be provided for factual reasons. Article 16Personal data for third country nationals who have been refused entry 1.Where a decision has been taken by the border authority, in accordance with Article 14 of Regulation (EU) 2016/399 and Annex V thereto, to refuse the entry of a third country national referred to in Article 2(2) of this Regulation to the territories of the Member States, and where no previous file has been registered in the EES for that third country national the border authority shall create an individual file in which it shall enter the data required pursuant to Article 14(1) in the case of visa holding third country nationals and the data required pursuant to Article 15(1) in the case of visa exempt third country nationals. 2.In order to create the individual file of visa holder third country nationals, the data provided for in Article 14 (1) (d), (e) and (g) may be retrieved and imported directly from the VIS into the EES by the competent border authority in accordance with Article 18a of Regulation (EC) No 767/2008. 3. For both visa holding and visa exempt third country nationals the following data shall be entered in a separate refusal of entry record: (a) the date and time of refusal of entry, (b) the border crossing point, (c) the authority that refused the entry, (d) the letter(s) corresponding to the reason(s) for refusing entry, in accordance with Annex V, Part B of Regulation (EU) 2016/399. 4.Where a previous file already exists in the EES the data provided for in paragraph 2 shall be added to the existing file. Article 17Data to be added where an authorisation to stay is revoked, annulled or extended 1.Where a decision has been taken to revoke or annul an authorisation to stay or a visa or to extend the duration of the authorised stay or visa, the competent authority that has taken the decision shall add the following data to the individual file: (a)the status information indicating that the authorisation to stay or the visa has been revoked or annulled or that the duration of the authorised stay or the visa has been extended; (b)the identity of the authority that revoked or annulled the authorisation to stay or the visa or extended the duration of t