EUROPEAN COMMISSION Brussels, 14.10.2016 SWD(2016) 328 final COMMISSION STAFF WORKING DOCUMENT Evaluation of the implementation of Regulation (EC) No 767/2008 of the European Parliament and Council concerning the Visa Information System (VIS) and the exchange of data between Member States on short-stay visas (VIS Regulation) / REFIT Evaluation Accompanying the document REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL on the implementation of Regulation (EC) No 767/2008 of the European Parliament and of the Council establishing the Visa Information System (VIS), the use of fingerprints at external borders and the use of biometrics in the visa application procedure/REFIT Evaluation



{COM(2016) 655 final}

{SWD(2016) 327 final}



TABLE OF CONTENTS 1.Introduction 2.Background to the VIS regulatory framework 2.1.Objectives of the VIS 2.2.Description of the VIS and its functions 2.3.Scope 3.Evaluation criteria and questions 4.Method and Consultation 5.Implementation state of play (results) 6.Evaluation of VIS according to the evaluation criteria 6.1.Effectiveness 6.1.1.Facilitation of the visa application procedure 6.1.2.Preventing applicants from bypassing the criteria for determining which Member State is responsible for examining the application 6.1.3.Facilitating the fight against fraud 6.1.4.Facilitating checks at external border crossing points and within the territory of the Member States 6.1.5.Assisting in the identification of any person who may not, or may no longer, fulfil the conditions for entry to, stay or residence on the territory of the Member States 6.1.6.Facilitating the application of Regulation (EC) No 343/2003 (as replaced by Regulation 604/2013, the ‘Dublin III Regulation’) 6.1.7.Contributing to the prevention of threats to the internal security of any of the Member States 6.1.8.Ensuring appropriate protection of data subjects in the visa application process

6.2.Efficiency 6.3.Utility 6.4.Relevance 6.4.1.Assessment of the continuing validity of the VIS as an instrument for supporting the implementation of the common EU visa policy 6.4.2.Assessment of the continuing validity of the VIS for performing biometric matching, primarily of fingerprints, for identification and verification purposes 6.5.Acceptability 6.6.Coherence with other EU policies 6.7.EU added value 7.Conclusions Annex 1: Procedural information concerning the process to prepare the evaluation Annex 2: Summary of findings on the implementation of the Visa Information System (VIS) Regulation based on Member States and eu-LISA reporting I.Results achieved against objectives 1.1Facilitation of the visa application procedure 1.2Preventing bypassing of the criteria for determining the Member State responsible for examining the application 1.3Facilitating the fight against fraud 1.4Facilitating checks at external border crossing points and within the territory of the Member States 1.5Assisting in the identification of any person who may not, or may no longer, fulfil the conditions for entry to, stay or residence on the territory of the Member States 1.6Facilitating the application of Regulation (EC) No 343/2003 (as replaced by Regulation 604/2013, the ‘Dublin III Regulation’) 1.7Contributing to the prevention of threats to the internal security of any of the Member States (on the basis of Council Decision 2008/633/JHA of 23 June 2008 concerning access for consultation of the Visa Information System (VIS) by designated authorities of Member States and by Europol for the purposes of the prevention, detection and investigation of terrorist offences and of other serious criminal offences) II.Assessment of the continuing validity of the underlying rationale for the system

2.1Assessment of the continuing validity of the VIS as an instrument for supporting the implementation of the common EU visa policy 2.2Assessment of the continuing validity of the VIS for performing biometric matching, primarily of fingerprints, for identification and verification purposes III.The application of the VIS Regulation 3.1Entry and use of data by visa authorities 3.1.1Use of the procedures for entering data upon application 3.1.2Use of the data to be entered 3.1.3Use of the VIS to examine applications 3.1.4Use of the data for reporting and statistics 3.2Access to data by other authorities 3.2.1Use of the data for verification at external border crossing points 3.2.2Use of the data for verification within the territory 3.2.3Use of the data for identification 3.2.4Use of the data for determining responsibility for asylum applications 3.2.5Use of the data for examining the application for asylum 3.3Retention period, amendment and deletion of data 3.4VIS operation and responsibilities 3.4.1State of play of the VIS roll-out 3.4.2Operational management of the VIS 3.4.3Use of the VIS for consultation and requests for documents (VISION, VIS Mail 2) 3.4.4Communication infrastructure

3.4.5Relationship between the VIS and national systems 3.4.6Technical incidents caused by the VIS or national systems 3.4.7Training activities for authorised staff 3.4.8Responsibility for using data and keeping it in national files 3.4.9Member States’ liability towards the VIS 3.4.10Keeping of records 3.4.11Self-monitoring and penalties 3.5The costs of setting up and operating the VIS 3.6Data protection in the visa application procedure related to the VIS 3.6.1.Right of information 3.6.2.Access, rectification and erasure of data 3.6.3.Member States cooperation on data protection 3.6.4.Remedies on data protection 3.6.5.Liability towards individuals 3.6.6.Supervision by the national supervisory authority (DPA) and EDPS 3.6.7.Data protection supervision of external service providers (ESPs) IV.The application of the VIS Decision 4.1Access to data by designated law enforcement authorities 4.2Procedures for access to the VIS by designated authorities 4.3Conditions for access by designated authorities

4.4Conditions for access by designated authorities of Member States not participating in the VIS 4.5Access to the VIS by Europol 4.6Data protection by law enforcement authorities 4.6.1Protection of personal data in the process of access by designated authorities under the VIS Decision 4.6.2Keeping of VIS data in national files 4.6.3Access, correction and deletion of data related to them by persons concerned 4.6.4Keeping of records on the processing operations resulting from accessing VIS data 4.6.5Member States’ liability in case of damage to persons V.The security of the VIS VI.The use made of the provisions referred to in Article 31 and implications for future operations Communication of data to non-EU countries or international organisations Annex 3: Summary of findings on the implementation of VIS-related provisions of the Visa Code, based on Member States’ and eu-LISA reporting, Local Sschengen Cooperation and Schengen evaluations ICollection and use of biometric identifiers 1.1.Implementation of the obligation to collect biometric identifiers 1.2.Implementation of the technical requirements for collecting biometric identifiers, including the use of appropriate standards 1.3.Quality of data collected 1.3.1.Statistical data for cases in which fingerprints could factually not be provided 1.3.2.Information/statistical data on cases in which fingerprints were not required for legal reasons 1.3.3.Comparison between the number of cases in which fingerprints could factually not be provided or were legally not required and the number of cases in which fingerprints were taken 1.4.Cases of visa refusal where a person could not physically provide fingerprints

1.5.Implementation of the 59-month rule for copying fingerprints 1.6.Suitability of the chosen International Civil Aviation Organisation standard IIOrganisation of application-related procedures 2.1Operational cooperation between Member States 2.2Experience with external service providers (ESPs) 2.2. 1Member States’ use of ESPs 2.2. 2Legal instrument governing cooperation between a Member State and an ESP 2.2. 3Organisation and implementation of services 2.2. 4The service fee 2.2. 5Quality of the collection of biometrics by ESPs 2.3Equipment for the collection of biometric identifiers 2.4Encryption and secure transfer of data IIIReliability of fingerprints of children under the age of 12 for the purposes of identification and verification 3.1Evolution of fingerprints with age (based on a study carried out under the Commission’s responsibility) 3.2Impact of the evolution of fingerprints with age on the reliability of their use for the purposes of the person’s identification and verification Annex 4: Technical progress made regarding the use of fingerprints at external borders on the basis of Article 50(5) of Regulation 767/2008 (the VIS Regulation) Annex 5 – VIS evaluation questionnaire Annex 6 – VIS adopted legislation Introduction Purpose of the evaluation

In August 2014, the Commission launched an overall evaluation of the VIS Regulation and of the VIS founding Decision . The evaluation also looked at how the VIS is used for the purpose of law enforcement access and the use of biometrics in the visa application procedure. The purpose of the evaluation was to analyse the performance of the VIS as a system, how the VIS Regulation has been implemented in practice, the extent to which the VIS has achieved its policy objectives, and whether the VIS Regulation remains fit for purpose in terms of effectiveness, efficiency, relevance, coherence and added value for the EU visa policy. This was the first time the VIS Regulation was evaluated since it entered into force in 2011. The evaluation was part of the Commission’s REFIT programme, which underlined the importance of assessing the relevance of the VIS Regulation for its stakeholders, whether its underlying rationale remains valid and the impact of the system on the various policies it has supported (visa, border management, migration management, asylum, law enforcement) and on the data subjects (third-country nationals obliged to obtain a Schengen visa). Scope of the evaluation Article 50(4) of the VIS Regulation requires the Commission to produce a report on the overall evaluation of the VIS three years after it was brought into operation and every four years thereafter. The evaluation should examine the results achieved against objectives and assess: the continuing validity of the underlying rationale; the application of the VIS Regulation; the security of the VIS; the use made of the provisions on the communication of data to third countries or international organisations referred to in Article 31; any implications for future operations. Article 50(5) of the VIS Regulation requires the Commission to produce a report on the technical progress made regarding the use of fingerprints at external borders and its implications for the duration of searches at borders, including whether the duration of these searches entails excessive waiting time at border crossing points. Furthermore, in order to ensure the regular monitoring and evaluation of the system put in place by the VIS Regulation, Article 57(3) of the Visa Code requires the Commission to present, three years after the VIS is brought into operation and every four years thereafter, a report on the implementation of the VIS-related provisions of the Visa Code (i.e. Articles 13, 17 and 40-44). Thus, the assessment of how Member States implement the provisions on the use of biometrics in the visa application procedure and organise procedures relating to applications, including their practical cooperation, is relevant for and should be considered part of the overall VIS evaluation covering the VIS Regulation and the VIS Founding Decision. However, a distinction should be made between: a) the overall evaluation of the implementation of the Visa Code, covered by the ‘Commission Staff Working Document (SWD(2014) 101 final) on the Evaluation of the Implementation of the Visa Code’, published in April 2014; and b) the report to the European Parliament and to the Council referred to in Articles 57(3) and (4) of the Visa Code, covered by the evaluation detailed in this Commission Staff Working Document. The objective of b) is to verify and monitor: the implementation of the provisions concerning the collection and use of biometric identifiers; the suitability of the International Civil Aviation Organisation (ICAO) standard chosen; compliance with data protection rules in visa application procedures;

Member States’ experience of cooperation with external service providers, in particular as regards the collection of biometric data; the implementation of the 59-month rule for the copying of fingerprints; and the organisation of application procedures. As required under Article 57(4) of the Visa Code, the report on the implementation of the provisions on collecting and using biometric identifiers also had to address the issue of whether the fingerprints of children under the age of 12 were sufficiently reliable for identification and verification purposes, and how fingerprints evolve with age. Finally, Article 17(4) of the Decision on the law enforcement access to the VIS (‘the VIS Law Enforcement Access (LEA) Decision’) requires the Commission to produce an overall evaluation of the VIS. This evaluation is complementary to the evaluation of the European Agency for the operational management of large-scale IT systems in the area of freedom, security and justice (eu-LISA) which was carried out by the Commission in close consultation with the Management Board of eu-LISA, as required under Article 31(1) of the eu-LISA founding Regulation. The eu-LISA evaluation examined the way and extent to which the Agency effectively contributes to the operational management of large-scale IT systems in the area of freedom, security and justice, including the VIS, and fulfils its tasks laid down in its founding Regulation. It also assessed the Agency’s role in the Union strategy aimed at achieving a coordinated, cost-effective and coherent IT environment at Union level that is to be established in the coming years. The eu-LISA evaluation was completed in March 2016 and, based on its findings, the Commission, after consulting the eu-LISA Management Board, will issue recommendations regarding possible changes to the eu-LISA founding Regulation to bring it further in line with the Union strategy. The Commission will then forward its recommendations, together with the opinion of the Management Board, to the European Parliament, the Council and the European Data Protection Supervisor. 2.Background to the VIS regulatory framework Baseline When establishing an area of freedom, security and justice, the European Union committed to ensuring the free movement of people and a high level of security. In this context, the EU has prioritised the development and establishment of the VIS as a system for exchanging visa data between Member States. Before the VIS was put in place in 2011, around 12 million Schengen visas were issued every year by the 25 countries of the Schengen area, and numbers were growing (see graph below). The Seville European Council of 21 and 22 June 2002 considered the establishment of a common identification system for visa data a top priority and called for its introduction as soon as possible. In response to this request, the Commission presented a feasibility study in May 2003. The Council welcomed the study and invited the Commission to continue its preparatory work to develop the VIS. The Thessaloniki European Council of 19 and 20 June 2003 deemed that guidelines should be drawn up for planning the development of the VIS. A legal basis permitting establishment of the VIS and engaging the necessary financial means was also to be adopted. According to the common visa policy developed following the Schengen Agreement of 1985, uniform short-stay visas were to be issued to third-country nationals, allowing them to travel freely throughout the Schengen area. The common visa policy also harmonised the criteria and conditions for issuing a Schengen visa in a uniform format. Citizens from 134 countries were required to apply for a visa before entering Schengen states. However, information from the visa application was routinely held only by the Member State which issued the visa, making it difficult to implement a common visa policy. If a bona fide traveller applied for a Schengen visa again, but to the authorities of another Member State, the record of his or her past visa application was not readily available to the consular authorities of that Member State. Some important visa data were exchanged, but the exchange was partial, inefficient and time consuming. As shown in the impact assessment leading to the establishment of the VIS, the system for delivering, monitoring and verifying visas was struggling to cope with such big numbers. A sizeable proportion of people tried to obtain a Schengen visa on dubious grounds. It was not always easy to prevent fraud and abuse, and the application process was often cumbersome for those legitimately seeking a short-stay visa for travel within the EU. Member States also had difficulties in ascertaining whether a visa applicant was using a false identity to obtain a Schengen visa. Statistics showed high levels of travel document fraud. Another phenomenon developing at that time was ‘visa shopping’, i.e. bypassing the criteria for determining which Member State is responsible for examining the visa application. If one Member State refused to issue a Schengen visa, the same applicant could apply to another Member State for a visa, even from within the same country of application. This is because there was no formal information system for authorities to check whether the applicant had applied and been refused, or had previously failed to pursue a Schengen visa application, or indeed whether a visa had been granted to the individual in the past. In 2001, around 360,000 people illegally present in the EU were apprehended. In the same year around 390,000 people illegally present in the EU were removed and around 1.2 million non-EU citizens were refused entry. Statistics indicated that overstayers were the biggest category of illegal immigrants. In addition, there were problems with the subsequent implementation of the Dublin II Regulation, which determines which Member State is responsible for examining an asylum claim. One of the criteria for establishing responsibility is that the Member State issuing the visa is also responsible for examining the asylum claim. At that time, Member States did not have an efficient means of checking whether an asylum seeker had been issued a visa by another Member State.

On 8 June 2004, the Council adopted Council Decision 2004/512/EC establishing the Visa Information System (VIS). This constituted the legal basis defining the architecture of the VIS and giving the Commission the mandate to develop the VIS at technical level. The national infrastructures had to be adapted and/or developed by the Member States. A comprehensive legal framework was needed to further develop and establish the VIS. Given the potentially significant impact of action in this field, the Commission carried out an extended impact assessment to ensure that economic and social impacts could be taken into account as early as possible in the process. This impact assessment was presented in 2004, accompanying the proposal for a Regulation to the European Parliament and to the Council concerning the Visa Information System (VIS) and the exchange of data between Member States on short-stay visas. It assessed various policy options: no VIS; an entry-exit system’ similar to the US-VISIT; VIS without biometrics; VIS with biometrics. The option of VIS with biometrics was chosen because it had the potential to bring the most substantial improvements in most domains. The VIS Regulation was adopted in 2008. It sets out the purpose, functionalities and responsibilities of the VIS, as well as rules for setting up and maintaining the system. The Regulation also stipulates the procedures and conditions for exchanging data on short-stay visa applications between Member States to strengthen the examination of such applications and the related decisions. The VIS central system was developed by the Commission and handed over to eu-LISA as of December 2012, according to the legal basis setting up this Agency. Law enforcement access to the VIS In March 2005, the Council adopted conclusions stating that ‘in order to achieve fully the aim of improving internal security and the fight against terrorism’, Member State authorities responsible for internal security should be guaranteed access to the VIS, ‘in the course of their duties in relation to the prevention, detection and investigation of criminal offences, including terrorist acts and threats’, ‘subject to strict compliance with the rules governing the protection of personal data’. Consequently, the VIS LEA Decision was adopted in June 2008. The VIS and the visa application procedure In 2009, the Regulation establishing a common Visa Code was adopted as a ‘recast’ and consolidated all legal acts governing the conditions and procedures for issuing short-stay visas (i.e. visas for intended stays of no more than 90 days in any 180 days). The Visa Code provided, among other things, for measures to improve consular organisation and cooperation (partly in view of the roll-out of the VIS). Consequently, VIS-related rules on collecting biometric identifiers and on facilitating the visa application procedure, including through forms of cooperation among Member States, were included in the Visa Code. 2.1.Objectives of the VIS

The VIS was set up to: improve the implementation of the common visa policy; ensure smooth consular cooperation and the consultations between central consular authorities to prevent threats to internal security and ‘visa shopping’; facilitate the visa application procedure, the fight against fraud and checks both at external border checkpoints and within the Member States, help identify and return illegal immigrants; and facilitate application of the Dublin Regulation. By improving the assessment of visa applications, including the consultation between central authorities and the verification and identification of applicants at consulates and at border checkpoints, the VIS helps strengthen the internal security of the Member States. It also helps combat terrorism which, along with the fight against illegal immigration, constitutes a cross-cutting objective and basic criterion for the common visa policy. The VIS should also benefit bona fide travellers by improving the procedures for issuing visas and for checks including in terms of simplification and administrative burden reduction of procedures for identity checks and identity verification procedures. 2.2.Description of the VIS and its functions The VIS founding Decision This Decision sets up the VIS as a system for exchanging data between the Member States, enabling national authorities to enter and update visa data and to consult those data electronically. According to the Decision, the system was to consist of a central information system, an interface in each Member State and a communication infrastructure. The measures necessary to develop the central system, the national interfaces and the communication infrastructure were to be adopted by the Commission in accordance with the comitology procedure, assisted by the SIS (Schengen Information System) II committee. The VIS Regulation The first chapter of the VIS Regulation lays down the object of the act, definitions, the purpose of the VIS, the categories of data and general rules on access and on procedures and protocols for the exchange of visa data. The second chapter details the obligations on visa authorities and the procedures they must use for entering data. It also specifies which data must be entered when registering an application and the data to be added when a visa is issued, refused, annulled, revoked or extended. The third chapter details the conditions and procedures for the use of data for the specific purposes of the VIS, namely data for: examining applications, including the consultation between central authorities; checks on visas;

identification and return purposes; determining responsibility for visa applications; determining responsibility for asylum applications; examining asylum applications; and reporting and statistics. The authorities which should have access to the VIS vary according to the specific purposes. The fourth chapter lays down rules on retaining and amending the data recorded in the VIS. The fifth chapter specifies who is responsible for the VIS, including for the operational management of the VIS, for the use of data and data security, and rules on liability, records and penalties. The sixth chapter deals with the rights of the data subject and the role of the national supervisory authorities and the Independent Supervisory Authority. The final chapter covers the implementation approach, the start of transmission, comitology, the evaluation, the entry into force and applicability of the VIS Regulation. The VIS LEA Decision The LEA Decision provides the legal basis under which Member State authorities responsible for internal security and the European Police Office (Europol) may access and consult the VIS for the purposes of preventing, detecting and investigating terrorist offences. The Decision also lays down the conditions under which they may do so and the types of crime and the offences in respect of which Europol is competent to act pursuant to Article 2 of the Europol Convention (i.e. ‘serious criminal offences’). The provisions of the Visa Code on the functioning of the VIS The rules governing the collection and use of biometric identifiers and the forms of cooperation for the collection of visa applications are provided in the Visa Code. 2.3.Scope The VIS Regulation covers the exchange of data on short-stay visas between Member States ‘which have abolished checks at their internal borders’. As such, it constitutes a development of Schengen legislation on the common visa policy and is subject to specific legal rules as regards the Member States’ participation in the VIS. Not all EU Member States are part of the VIS, but the VIS does include the four Schengen associated countries: Iceland, Liechtenstein, Norway and Switzerland. Denmark: Pursuant to Protocol No 22 on the position of Denmark annexed to the Treaty on European Union and the Treaty establishing a European Community, Denmark does not participate in the adoption of the Regulation and is therefore not bound by it or subject to its application. However, Article 4 of Protocol No 22 does apply. This is because the Regulation is an act which aims to build upon Schengen legislation in accordance with the provisions of Title V of Part Three of the Treaty on the Functioning of the European Union. In line with this Article, Denmark notified the Council and the Commission within six months after the adoption of the VIS Regulation of its intention to implement it in national law. Consequently, at present, Denmark applies the VIS Regulation and participates fully in the exchange of data on the basis of this Regulation.

United Kingdom and Ireland: According to Articles 4 and 5 of Protocol No 21 integrating Schengen legislation into the framework of European Union and Council Decision 2000/365/EC of 29 May 2000 concerning the request of the United Kingdom of Great Britain and Northern Ireland, and Council Decision 2002/192/EC of 28 February 2002 concerning Ireland’s request to take part in some of the provisions of the Schengen acquis, the United Kingdom and Ireland are not taking part in the adoption of the Regulation and are not bound by it or subject to its application. Bulgaria, Croatia, Cyprus and Romania (Member States not yet fully applying Schengen legislation): The VIS builds on the Schengen acquis or otherwise is related to it within the meaning of the relevant provisions of each country’s Act of Accession. However, the VIS Regulation will only apply in these Member States once the relevant Council decisions on the full application of the Schengen acquis to these countries have been passed. Iceland, Liechtenstein, Norway and Switzerland (Schengen associated countries): This Regulation builds on the Schengen acquis within the meaning of the respective Association Agreements concluded with the Schengen associated countries, and the procedures laid down in these Agreements are applicable. 3.Evaluation criteria and questions The evaluation of the Regulation was undertaken on the basis of the following evaluation criteria and questions: Effectiveness: oHas the Regulation been effective in meeting the defined objectives? oDid it facilitate the visa application procedure? oHas it prevented the bypassing of the criteria for determining which Member State is responsible for examining the application? oDid it facilitate the fight against fraud? oDid it facilitate checks at external border crossing points and within the territory of the Member States by simplification and administrative burden reduction? oDid it help with the identification of any person who may not, or may no longer, fulfil the conditions for entry to, stay or residence on the territory of the Member States? oDid it facilitate the application of the ‘Dublin III Regulation’? oDid it contribute to the prevention of threats to the internal security of the Member States? oWhat effects did the Regulation have on third-country nationals under Schengen visa obligation? Efficiency: oHas the Regulation delivered its results efficiently in terms of the resources used?

oDoes it create or reduce administrative burdens? oWhat are the main costs and benefits of the Regulation for (i) the Schengen states and (ii) third-country nationals under a visa obligation? oOverall, did the benefits of setting up the VIS outweigh its costs? Utility: To what extent did the effects of VIS correspond with the needs, problems and issues to be addressed? Relevance: Are the objectives of the Regulation still relevant today? EU added value and sustainability: oWhat is the ongoing added value of EU legislation in this field? oIs the Regulation still fit for purpose and will it meet its objectives in the future? oWhat would happen if the Regulation were to be withdrawn and Member States were free to adjust their national regulatory frameworks? Acceptability: To what extent do Schengen states’ administrations and third-country nationals accept the VIS? Coherence: To what extent are positive/negative spill-overs into other policy areas (migration, trade/tourism, external relations, security) being maximised/minimised? 4.Method and Consultation The evaluation assessed the performance of the VIS Regulation, i.e. whether it has achieved its objectives, whether it is efficient, coherent, relevant and has an added value at EU level. The implementation of the system was assessed based on a broad consultation process based on targeted consultations, which included the 22 EU Member States that are Schengen members, the four Schengen associated countries, as well as the principal agencies involved — eu-LISA and Europol. Although not directly consulted for the purpose of this evaluation, Frontex data contained in various annual reports were also used. The objectives of the consultation process were to collect concrete evidence on the functioning of the VIS and to enable an assessment of the VIS’s possible future. The evaluation criteria and questions focused on both quantitative and qualitative aspects. The process was carried out internally by the Commission. An inter-service steering group was set up to oversee the process. The data collection phase consisted of gathering primary and secondary data relevant to the consultation process. It covered data related to the functioning of the VIS from its entry into operation in September 2011 until December 2015. A number of different data collection tools were used to collect data from a wide variety of stakeholder groups. These included:

an extensive documentary review; an e-survey for the Member States and eu-LISA; direct observation of the VIS Management Board and VIS Advisory Group meetings; and observations of the competent working groups in the Council (the Visa working party, Friends of VIS, VISION). Third-country nationals and governments of countries under visa obligation were consulted indirectly via national authorities. Considering that several ministries and national authorities are involved in implementing and applying VIS-related policy in the Member States, and since this varies according to national legislation, information regarding the evaluation was channelled through the Permanent Representations of the Member States. In addition, information was disseminated through the Visa working party, the Friends of VIS group in the Council, as well as through the eu-LISA’s VIS Advisory Group. The evaluation questions were also incorporated into an e-survey (see Annex 5). The consultation process started in May 2015. Initially planned to last until December 2015, it was extended to mid-February 2016 to allow more Member States to contribute. However, consultations with Member States were not the only source used in this evaluation; it is also based on the Commission’s regular monitoring of the correct implementation of EU legislation. This includes: the evaluations under the SCHEVAL system; information from petitions addressed to the European Parliament; the questions raised by Members of the European Parliament; complaints and questions from private people. Answers to the queries of the European Migration Network on this matter were also taken into account. The viewss of third countries’ authorities and nationals were taken into account in several ways: from opinions expressed in bilateral official contacts with the European Union/the Commission and the Member States and from the practice experienced by national authorities when implementing the VIS. Views on the implementation of the VIS Regulation have also been exchanged in the Joint Committees set up under the various Visa Facilitation Agreements between the EU and a number of third countries, as well as in the ACP-EU Visa Sub-group set up under the ACP/EU Dialogue on Migration and Development. Information gathered within the local Schengen cooperation — in place in all locations where Schengen visa-issuing consulates of the Member States are present — also provided feedback on the functioning of the VIS. On data protection issues, the Commission used input from the ‘Coordinated Supervision of VIS Activity Report 2012-2014’ of the VIS Supervision Coordination Group. The report is to be produced every two years by the European Data Protection Supervisor in cooperation with the national supervisory authorities/data protection authorities of each Member State. The Commission also drew on the European Data Protection Supervisor’s audits of the Management Authority’s (eu-LISA) personal data processing activities, which it must carry out every four years. 16 EU Member States (Austria, Belgium, the Czech Republic, Estonia, France, Germany, Greece, Latvia, Lithuania, Luxembourg, Malta, the Netherlands, Poland, Portugal, Sweden and Slovakia) and three Schengen associated countries (Iceland, Norway and Switzerland) contributed to the evaluation (as there are 26 Schengen Member States, this gave a 76 % response rate). eu-LISA contributed substantially to this evaluation and provided quantitative data on all requested items. It should be borne in mind that the statistics provided by eu-LISA cover all the Schengen Member States using the VIS system (unless specifically mentioned otherwise), and thus make up for the lack of quantitative data by the Member States who did not reply or did not reply in full to the questionnaires. Europol did not reply to the consultation, given that it has not yet established a connection with the VIS and thus has not been using the system.

Limitations — robustness of findings The Commission was called on to deliver an evaluation three years after the VIS began operating. This deadline took into account the political objective of achieving the full VIS roll-out within two years of it starting to operate. However, by 11 October 2014 (i.e. three years after it started operating) the VIS had been rolled out in only 16 of the 25 world regions, while regions with the highest number of Schengen visa applications (covering countries such as Belarus, China, India, Russia and Ukraine) were not yet covered by the VIS. As a result, less than half of the visas issued (and thus visa holders’ fingerprints) were stored in the VIS at the end of 2014. Due to the delay in the roll-out, information was insufficient for an in-depth evaluation at that time. The VIS worldwide roll-out was finalised in November 2015. In February 2016, the system became operational at the Schengen border crossing points. The data gathered and the ensuing analysis had to take into account this gradual deployment. Therefore, while this evaluation took into account data relating to four years of functioning of the VIS, the relevance of the data is sometimes limited by the recent experience with the system in most regions of the world (regions covering 70 % of the VIS volume only started using VIS in the last year before the evaluation, while over 50 % of VIS volume is in regions where VIS was only deployed 3-4 months before the end of the evaluation). Member States indicated in their contributions that the recent and sometimes limited experience with the VIS narrowed their assessment given that the worldwide roll-out had barely finished by the time the evaluation was carried out. While this aspect has no impact on the findings or conclusions of this evaluation, which remain valid, it must be taken into account that a longer lifespan of a system of this complexity would naturally trigger a higher likelihood of problems arising from its functioning (e.g. when the volume of the database reaches its upper limits, this could have consequences on its efficiency, which cannot be measured at this point in time). On law enforcement access, a full evaluation on the basis of the VIS Decision was initially planned as part of the overall assessment of the VIS. However, during the data collection period Europol informed the Commission that no access had yet been established to the VIS and hence no experience could be reported. Member States’ feedback also pointed overwhelmingly to little or no use, by December 2015, of the VIS for law enforcement purposes (16 Member States had used the VIS for law enforcement purposes, and most of them started doing so in the last months of 2015). Consequently, the information on the limited use of the system for law enforcement fed into this overall evaluation report, but did not provide enough basis for a stand-alone dedicated report. The input on data protection provided by the European Data Protection Supervisor and the national data protection authorities which could be used for this evaluation did not go beyond 2014 (the year the national data protection authorities last evaluated the lawfulness of the Member States’ processing of personal data in the VIS; this information was communicated to the Commission for this evaluation) and the 2012 audit of the Central VIS carried out by the European Data Protection Supervisor. By the time of publishing this evaluation, the report on the 2016 audit of the VIS had not yet been published. Moreover, a report by the VIS Supervision Coordination Group on access to the VIS and the exercise of data subjects’ rights was not yet public and could not be quoted in this report. 5.Implementation state of play (results) The VIS founding Decision was adopted in June 2004 and became applicable 20 days following its publication in the Official Journal. The VIS Regulation, setting out the detailed functionalities and responsibilities for the operation of the VIS was adopted in July 2008 and became applicable 20 days following its publication in the Official Journal. In conformity with the VIS founding Decision, the Commission, assisted by the SIS II committee, was responsible for developing the Central VIS, the national interface in each Member State and the communication infrastructure between the Central VIS and the national interfaces. Thus, the Commission was mandated to develop and carry out the entire implementation process from the first stages of planning in 2004 until the operational responsibility was transferred to eu-LISA. At national level, Member States developed or adapted their national infrastructure on visas in order to accommodate the VIS. The VIS project was divided into three phases: 1.Phase 1 (detailed design) delivered all the documents necessary to fully describe the VIS from a technical perspective and was closed in 2006. 2.Phase 2 (development, testing and deployment) took place in 2007. 3.During phase 3 (migration and integration) Member States connected their national systems to the VIS central database. The VIS did not start operating on the same date in all Schengen states’ consulates worldwide. The VIS has been progressively deployed, region by region, in the order determined by the Commission on the basis of three criteria in the VIS Regulation: the risk of irregular immigration; the threats to the internal security of the Schengen states;

the feasibility of collecting biometrics from all locations in the region. The Commission consequently adopted in November 2009 an Implementing Decision determining the first three regions for the VIS consular roll-out. Furthermore, for each geographical region, the Commission adopted a Decision setting the date for the ‘go-live’ of the VIS in that particular region (although the date could sometimes coincide for several regions). Such decisions were adopted in each case after all Member States had notified their legal and technical readiness to collect and transmit data to the VIS from that particular region. The VIS first started operating in all Schengen states’ visa-issuing consulates in North Africa in October 2011, in the Near East in May 2012, and then in the Gulf region in October 2012. On 24 April 2012, the Commission adopted an Implementing Decision determining the second set of regions for the start of operations: West and Central Africa (start of operations in March 2013); East and Southern Africa (June 2013); South America (September 2013); Central Asia, Southeast Asia and the occupied Palestinian territory (November 2013). On 30 September 2013, the Commission adopted an Implementing Decision setting the sequence of the VIS roll-out in the remaining regions of the world: Central America, North America, the Caribbean, Australasia (May 2014), the Western Balkans and Turkey (September 2014), the eastern neighbouring countries (June 2015), Russia (September 2015), China/Japan and neighbouring countries (October 2015), India/Pakistan and neighbouring countries (November 2015), the European ‘microstates’, the UK and Ireland, the other EU Member States (November 2015). The Schengen border crossing points are included in the first roll-out Decision as a separate region for the VIS roll-out, to cover the use of the VIS to issue visas at the border. The decision to deploy the VIS at Schengen border crossing points for this purpose was made in order to avoid the roll-out in the geographical regions being circumvented by third-country nationals of these regions lodging their applications at the external borders. In practice, due to the low figures of visa applications at borders (around 0.7 % in 2015, i.e. 102 110 out of 14 410 502 worldwide), the Schengen border crossing points were the last ‘region’ where the VIS was rolled out, in February 2016. Schengen states have had the possibility to start using the VIS, with or without collecting visa applicants’ fingerprints, in any location ahead of the general roll-out, provided that they first notified the Commission. 19 Member States notified the Commission that they would roll out the VIS in various locations, without fingerprints, as follows: Belgium, Estonia and Switzerland notified that they would use the VIS ahead of the general roll-out in all their consulates; Switzerland, Germany, Finland, Iceland, the Netherlands, Poland, Portugal, Slovenia and Slovakia notified that they would start VIS operations at external border crossing points without fingerprints; Austria, Denmark, Hungary, Italy, Liechtenstein, Lithuania, Malta and Sweden notified that they would roll out the VIS at various specific locations. On 1 December 2012, eu-LISA started operations and took over the operational management of the VIS from the Commission, in line with the VIS Regulation. Monitoring the development of the system Several structures were put in place to monitor the development and implementation of the VIS. A ‘Friends of VIS’ informal group was established by the French Presidency of the Council of the European Union in 2008 to follow up on how the Member States were developing national VIS projects, to provide a link between ministerial and expert levels and ensure that Member States made the necessary arrangements to guarantee that their visa authorities (or another Member State on their behalf) collect and transmit the visa application data to the VIS, according to the regional roll-out. The group had its final meeting on 7 April 2016 following the end of the worldwide roll-out of the VIS and thus completing its mandate. The Change Management Board was established in March 2008 as an informal sub-group of the Schengen Information System and Visa Information System committee (‘the SISVIS Committee’) to maintain stable specifications and to give advice about any change requests brought forward that affect the technical specifications of the VIS. The Test Advisory Group was also established as an informal sub-group of the SISVIS Committee for the purpose of discussing and agreeing all testing-related issues (preparation, execution and evaluation) with Member States. The VIS Advisory Group, an integral part of eu-LISA’s management’s structure, assists the Management Board on topics of a rather technical nature, including security, and contributes to the preparation of various documents such as the multi-annual work programme and the annual work programme. The VIS Advisory Group is also consulted on the annual activity report of eu-LISA in particular. In accordance with Article 6 of the VIS founding Decision, between 2004 and 2011 the Commission submitted eight progress reports to the Council and the European Parliament on the development of the VIS. 6.Evaluation of VIS according to the evaluation criteria

6.1.Effectiveness 6.1.1.Facilitation of the visa application procedure The sizeable majority of contributing Member States concurred in that the introduction of the VIS facilitated the visa application procedure: 61 % of them consider that VIS had a slightly positive impact on the procedure, while 11 % consider this impact strongly positive. 16 % of the responding Member States considered that the VIS had no impact on the visa application procedure, and 11 % consider this impact to be negative (5.5 % consider it strongly negative and 5.5 % slightly negative). All responding Member States concur that the procedure was made slower and lengthier by the introduction of the VIS because it obliges them to carry out biometric capture and maintain biometric equipment. Consequently, it is more cumbersome for applicants as well. At the same time, Member States consider the procedures for entering and using the VIS data sufficient and effective for the purpose of further processing the application. However, all responding Member States agree that the VIS has also made the procedure more secure in terms of due diligence and that applicants are better protected against identity theft. Moreover, those who consider the impact of the VIS positive emphasise how it has facilitated the decision-making process, which was simplified by setting-up a common system to store and exchange data between Member States on applications and related decisions. The visa history of the applicants is now easily available to visa authorities throughout the Schengen area, and centralised in a single database which can be easily accessed and answers a search in a matter of seconds. Eu-LISA statistics from the system show that from 1 August to 15 October 2015 the average time taken to complete an examination procedure (from the moment a visa application is admitted and until a visa is issued) was four days. Most Member States take on average five days to complete the procedure, though experiences vary, ranging from within the same day for one Member State to 13 days for another Member State. With the Visa Code requirement that applications be decided on within 15 calendar days, the average time of five days currently taken by the Member States to complete this procedure indicates that the VIS has helped reduce the overall length of the visa application procedure. Some Member States consider that the impact of the VIS cannot be fully evaluated at this point because the VIS does not currently contain enough data about applicants and their visa history to simplify the visa procedure. When the VIS contains more information, more elements will be available for analysis and this will further simplify the visa procedure. 6.1.2.Preventing applicants from bypassing the criteria for determining which Member State is responsible for examining the application The prevailing view among the contributing Member States (63.2 %) was that the introduction of the VIS had no impact on preventing applicants from bypassing the criteria for determining the Member State responsible for examining their visa application. Only 31.5 % of the responding Member States considered that the VIS had a positive impact, either slightly positive (21 %) or strongly positive (10.5 %). However, none of the responding Member States considered that the introduction of the VIS had worsened the situation. The advantage given by the possibility to check previous applications (especially recently rejected ones) in the VIS is considered rather marginal. The history of applications helps determine the main destination, which is very useful in cases where the applicant uses a new (blank) passport for a new application. However, the criteria for determining the Member State responsible follow from the information citing the main destination for the visit as provided in the application form, rather than from the history of applications. Moreover, a previous rejection does not necessarily call for a rejection of the current application, nor does it imply that the current application should not be handled by a given consulate. Responding Member States underlined that in order for the system to work satisfactorily it is extremely important that all Member States perform the searches and the linking of individual files in the VIS central system correctly and that the biometrics taken are of sufficient quality. 6.1.3.Facilitating the fight against fraud A substantial majority of the responding Member States — 89 % — agreed that the introduction of the VIS facilitated the fight against visa fraud (50 % found this impact slightly positive, while 39 % found it strongly positive). 11 % considered that the VIS has had no impact on visa fraud. Notably, no Member State seems to consider that the VIS would in any way have facilitated fraud. Due to their nature and function, visas are checked mainly on entry to the Schengen zone at border crossing points. Thus, detections at border crossing points are the main indicators of visa fraud. Frontex’s ‘Annual Risk Analysis 2016’ reports a constant decline in the number of fraudulent visas detected at external borders between 2012 and 2015, from over 1 800 false visas detected in 2012, to around 1 500 in 2013, 1 100 in 2014 and 776 in 2015 (a 32 % decline on the previous year). The main VIS feature contributing to the fight against fraud is the storage of fingerprints in the VIS. When a new visa application is lodged, the system provides a secure link to the identity of the applicant through biometrics and no look-alike fraud is possible. Thus, a major turning point in the identification of fraudulent visas at borders was the obligation, as of October 2014, for border authorities to check visa holders by using fingerprints (checking the visa sticker number was sufficient before). This made it virtually impossible for a person to cross the border using a forged or falsified visa sticker, as the system would immediately identify that the person was not registered with such a visa sticker number. The Frontex Annual Risk Analysis 2016 also showed that there was an increase in detections of false visas at borders in the period immediately following the introduction of the VIS checks at borders (2012). The VIS checks also constituted a deterrent, in the longer run, to the use of false visas to enter the EU territory.

However, the effectiveness of the check relies on the requirement that the correct searches are made, that files are systematically linked, and that the biometrics taken are of sufficient quality. In addition, VIS cannot prevent fraud with documents/false passports presented during application. The obligation to check the visas using fingerprints reduces the possibility for fraudsters to cross the border using fraudulent visa stickers. A possible knock-on effect could have been a shift from the use of fraudulent visa stickers towards the use of visas obtained under false pretence in consulates (at the time of applying for a visa), and thus an increase in the likelihood of fraud with other types of documents (such as travel documents). To prevent this, consulates have to be sure about the identity of the applicant before taking the fingerprints. 6.1.4.Facilitating checks at external border crossing points and within the territory of the Member States A vast majority of the responding Member States (73.5 %) considered that the introduction of the VIS facilitates the checks both at external border crossing points and within the territory of the Member States. 52 % considered the VIS to have a slight positive effect in this sense and 21 % considered that the VIS had a strongly positive effect. 16 % of the responding Member States considered that the VIS had no impact on these checks at external border crossing points and within the territory, and 5 % consider that the impact was slightly negative. The three main positive impacts of the VIS are: the fact that it has improved the quality of the visa checks (thanks to the use of centralised data making it possible to verify within seconds the identity of the visa holder and the authenticity of the visa, including when issued by another Member State); the increase in the information accessible to relevant authorities (by allowing access to the visa history and information input by 26 states); its contribution to detecting and fighting the use of fraudulent documents (made useless by a system carrying identity checks based on fingerprints). A turning point in performing checks at borders using the VIS was, as in the case of fraud detections, the obligation as of October 2014 to carry out these checks using fingerprints. While slightly adding to the length of the border check procedure, the comparison using fingerprints greatly facilitates the procedure by providing an irrefutable element to the decision regarding whether someone fulfils the conditions necessary to cross the external border. As regards the rapidity of the system, data logs indicate that, even with fingerprints, the VIS enables border checks to be performed within seconds, as evidenced in the table below (source eu-LISA). The few responding Member States who did not notice any impact or considered that the system has had a slightly negative impact were mainly concerned about the increased time required for border checks. The low quality of the fingerprints and the missing information in the VIS files were also mentioned as issues faced at external border crossing points. According to one Member State, the evaluation was also negatively impacted by the difficulty in evaluating the system before the roll-out was fully completed, meaning the VIS may be viewed more positively in the future. The evaluation of technical progress on the use of fingerprints at external borders found that, overall, Member States have made progress on the use of fingerprints at external borders. Outside the first months of running the new system, Member States have experienced very few technical problems with the technology used and only infrequent administrative impediments in checking fingerprints at external borders. Cases where multiple scans were needed to collect fingerprints of sufficient quality and attempts at spoofing have been reported as sporadic. Situations where capturing devices and the VIS are unavailable are managed using appropriate alternative procedures. 6.1.5.Assisting in the identification of any person who may not, or may no longer, fulfil the conditions for entry to, stay or residence on the territory of the Member States A vast majority of responding Member States — 78 % — were of the opinion that the introduction of the VIS helped them identify people who do not, or no longer, fulfil the conditions for entry to or stay or residence in the territory of the Member States. 50 % consider this impact slightly positive, while 28 % consider that the VIS had a strongly positive impact. 17 % of the responding Member States consider that the VIS had no impact on the identification of these persons and 5.5 % consider the impact of the VIS to have been slightly negative. Most Member States consider that the VIS gives them the possibility to assess in an unambiguous and timely manner whether a person fulfils the conditions for entry to or stay in the territory of the Member States. One Member State insisted on the positive impact of fingerprints on the ability to identify someone who has no identity or travel document. The main concerns of the few Member States who consider that the system has no, or a slightly negative, impact on the identification of these people referred to the length of the identification procedure, although some Member States have already noticed an improvement in that respect. The fact that the police lack equipment for identification during checks within the territory was also raised. 6.1.6.Facilitating the application of Regulation (EC) No 343/2003 (as replaced by Regulation 604/2013, the ‘Dublin III Regulation’) The majority of the responding Member States — 63 % — consider that the introduction of the VIS supported the application of the Dublin Regulation by determining the Member State responsible for examining an asylum application where a visa has been issued by a Member State to the asylum applicant. Almost 31.5 % consider the impact of the VIS to have been slightly positive, and 31.5 % consider it strongly positive. Almost 26.5 % of the responding Member States consider that the introduction of the VIS had no impact on the Dublin procedure and 11 % did not provide any answer. None of the respondents found this impact to be negative.

The VIS was used for asylum purposes by 12 Schengen Member States in nearly 400 000 cases between November 2011 and end December 2015 to help determine the Member State responsible under the Dublin Regulation. Since October 2011 it has been used by 15 Member States in 1 384 988 cases to support the examination of asylum applications. The vast majority of those VIS searches were carried out by four Member States. Feedback from Member States shows that VIS data provide evidence for determining the Member State responsible and facilitate take charge requests. The data are also used to assess the identity and credibility of applicants when examining an asylum application. In a questionnaire carried out by the Commission in April 2015 on the use of the VIS for asylum purposes, the 11 Member States who had used the VIS for Dublin purposes at that time stated that they experienced little or no difficulties in obtaining acceptances to transfer requests based on VIS-hits. This shows that the VIS is overall well accepted by Member States as an instrument of proof in the Dublin procedure. 6.1.7.Contributing to the prevention of threats to the internal security of any of the Member States Almost half of the responding Member States — 47 % — considered that the introduction of the VIS had a positive impact on preventing threats to the internal security of the Member States. For 42 % this impact was slightly positive and for 5 % it was strongly positive. For 10.5 % of the respondents the introduction of the VIS had a limited impact and for 16 % no impact. 26 % of the respondents did not rate the contribution of the VIS to the prevention of security threats. The mitigated response can be due to the fact that access to the VIS data by law enforcement authorities is recent (the VIS LEA Decision became applicable in September 2013) and very fragmented among the countries using the VIS. Of 26 Member States, eight never accessed the VIS for this purpose. However, the use of VIS for law enforcement purposes has recently been increasing. 6.1.8.Ensuring appropriate protection of data subjects in the visa application process The rights of data subjects are an important part of data protection law. Ensuring that data subjects can access, rectify and erase data held about them increases the transparency of data processing for them, helps to uncover unlawful processing and increases data quality for lawful processing. The evaluation found that only a very limited (a few dozens) requests were ever made by visa applicants to access their VIS data, and hardly any one to correct or erase such data. All Member States have in place procedures to request access to data, most of them allowing direct requests to the VIS data controller. During the period under evaluation, there has been no there has been no reported situation in which a request to correct or delete data was refused and which led to actions or complaints before the national competent authorities, and therefore, no case either when Member States should have exercised their duties to assist and advise the person concerned in proceedings before a court or competent authority The lawfulness of the processing of personal data by Member States is monitored by the national data protection authorities (DPAs), while the European Data Protection Supervisor (EDPS) is responsible for supervising the management authority (eu-LISA), mainly through inspections and audits. DPAs monitoring showed that the relevant staff members of the competent authorities dealing with the VIS have a satisfactory level of awareness regarding their obligation to safeguard data subjects’ rights. Training covering data subjects’ rights is provided to the relevant staff in some Member States. The VIS SCG noted the absence or very low number of requests made by data subjects to exercise their rights of access, correction or deletion of their personal data stored in the VIS. This could be due to data subjects not being aware of their data protection rights, but also to the lack of information about the way to exercise them (e.g. to whom data subjects should address their requests). In this sense, the EDPS invited national DPAs to carry out quality controls regarding the information provided to data subjects by diplomatic missions, consular posts and ESPs. In its almost three years of operation, eu-LISA has not received any complaint related to data protection. The EDPS has performed inspections on the spot to monitor the lawfulness of the processing of personal data and performed two security audits of the VIS central system to date (in 2011 and 2015). 6.2.Efficiency The roll-out of the VIS was initially planned to take three years, but in fact it took over four years to be fully rolled out worldwide. However, given the magnitude of the project and its unique nature, the delay was not considerable or of a length that would create any negative consequences for the visa examination processes. On the contrary, the set up and launch of the VIS brought a gradual benefit compared with the baseline situation where there was no centralised system enabling Member States to compare national data and trace back applicants’ visa history. As regards the main financial costs for developing the system, the 2004 VIS impact assessment estimated that the one-off investment costs for the EU would be around EUR 93 million and EUR 186 million for all the Member States. As regards operational costs, the annual costs for the EU were estimated at between EUR 14-16 million, while the costs for the Member States’ national systems were estimated at around EUR 49 million. In reality, the cost of setting up the VIS totalled nearly EUR 151 million spread over a period of six years from 2005 to 2011. The cost breaks down as follows: Development contract (without fingerprints) — EUR 39.9 million (25 %)

Development contract (with fingerprints) — EUR 37.4 million (23 %) Technical assistance — EUR 9.4 million (6 %) Network infrastructure (including Member States’ connection) — EUR 46.2 million (29 %) Site preparation — EUR 4.7 million (9 %) Other, including security — EUR 13.1 million (8 %) Quantifying the costs incurred by the Member States to set up national systems is more complicated due mainly to the way in which systems are organised at national level. Most often the national systems were not built from zero, rather existing systems were upgraded and adapted to enable them to connect with the VIS. Since the verification and identification of third-country nationals were shifted to the Central VIS system, in certain cases the VIS helped enforce synergies at European level, hence limiting costs at national level. Depending on their consular network and the level of equipment used, the costs incurred by Member States in setting up the system vary between EUR 1-2 million and EUR 30 million. A total high-level rough estimate of Member States’ expenditure is approximately EUR 600 million, including maintenance costs for the first years. It is not easy to calculate the financial benefits of setting up the VIS given that it is a non-profit instrument. Moreover, its benefits (listed below) are unquantifiable: the contribution to enforcing a common Schengen visa policy and consular cooperation and providing an easily available and secure means of consultation between central visa authorities; the possibility to identify any person who may not, or may no longer, fulfil the conditions for entry to, stay or residence in the territory of the Member States; the facilitation of the application of criteria and mechanisms for determining the Member State responsible for examining an asylum application; the contribution to preventing, detecting and investigating serious criminal offences. These benefits are of societal value in terms of enhancing internal security, fighting irregular migration and preventing, detecting and investigating terrorist offences and other serious crime. The areas where Member States have acknowledged greatest impact are: prevention of ‘visa shopping’: the facilitation of checks at external border crossing points and within the territory of the Member States;

the fight against fraud. The reliability of fingerprint-based identifications means visa shopping is no longer reported as a significant phenomenon during the visa application procedure. Similarly, the reliability of fingerprint-based verifications at borders deters travellers from crossing the borders with forged visa stickers. In the context of growing international migration pressure, this favourable trend is particularly noteworthy, although not financially quantifiable. The impact assessment for the 2014 recast of the Visa Code showed that it is rather difficult, if not impossible, to have specific statistics on visa revenues, although some Member States have estimates of the revenues generated from visa fees. However, modelling and approximation could be developed, taking into account that the visa fee charged by the Schengen states under the Visa Code is set at EUR 60 per application and that by end February 2016 nearly 23 million applications are stored in the VIS. This means that more than EUR 1 380 million was collected by Member States for processing these applications. At the same time, it must be taken into account that the revenues thus obtained do not only cover the costs of connecting to the VIS. Several other elements contribute to the overall cost of processing a Schengen visa, including the use of staff, usually (expatriate) civil servants, who need to be extensively trained, and other various inventories (such as visa stickers, stamps and paperwork). Some Member States even argued that there is not always a direct link between consulates’ work and visa revenues because revenues go straight to either the Ministry of Foreign Affairs budget or the Treasury. On the other hand, the calculation above leaves out the service fee applied by the external service providers. The fee, which can reach EUR 30 per application, covers the administrative cost of collecting visa data (including biometrics) and all other front office relations with the applicants. Using external service providers (which is common practice in most locations throughout the world) relieved Member States of a heavy administrative burden in terms of handling the visa application procedure. It can therefore reasonably be deduced that a large share of the visa revenues could be used to develop the national VIS. Comparing these figures shows that the financial costs of setting the system would be largely exceeded by the fees charged for the visa applications stored in the system. In this respect, we could assume that the costs of setting up the system have, by and large, already been amortised by the Member States. The operational costs, i.e. the contractual expenses necessary for the Managing Authority to monitor and adapt the VIS, ranged from EUR 5 million to slightly more than EUR 24 million between 2011 and 2015. These operation costs must be compared with the annual costs for the EU, which were estimated at between EUR 14 and 16 million in the 2004 impact assessment. After the first two years, the expense increases mirrored the capacity upgrade of the VIS needed to enable it to match the growing visa issuing activity resulting from the worldwide roll-out. Overall, visa issuing activity increased significantly between 2004 and 2014. For example, the number of applications for uniform short-stay Schengen visas increased by 48 % between 2009 and 2012. The operational costs include the development of new technical features to adapt to changes such as the replacement of the Schengen Consultation Network by a specific consultation mechanism streamlining exchanges between Member States. To conclude, the main benefits of setting up the VIS are in operational and policy terms. Although unquantifiable, the policy benefits clearly justify the costs, especially given that developing the system was a one-off event which will continue to produce benefits for a long time, far beyond that needed for the system to be amortised. 6.3.Utility The Member States’ contributions to the evaluation showed that the VIS fully addresses the needs, problems and issues which it was set up to tackle. Member States need a system that facilitates the visa application procedure, the fight against fraud and checks at external borders or within the territory. They need a system that enables them to quickly and reliably identify people who may otherwise not have appropriate identification documents or may have false ones, in order to ascertain their right to be or to remain on the territory. The VIS provides all these services in a quick and reliable manner and is therefore a useful tool in improving the management of the external borders of the Schengen Area. The Member States which used the VIS for asylum purposes confirmed that it could be used not only to support application of the Dublin Regulation (between October 2011 and November 2015, nearly 400 000 searches in the VIS were carried out for this purpose), but also to examine individual asylum applications to identify and check the credibility of applicants. Between October 2011 when the VIS began operating, and November 2015, nearly 1.5 million searches had been carried out for this purpose. 6.4.Relevance 6.4.1.Assessment of the continuing validity of the VIS as an instrument for supporting the implementation of the common EU visa policy All responding Member States consider the VIS as essential for the good functioning of the common visa policy and that it supports the common area of free movement. The system has further streamlined and harmonised the visa application procedure, albeit rendering it lengthier and more cumbersome. It has minimised fraud and visa shopping and enhanced the global security features of visa procedures. It facilitates and encourages communication between Member States. By introducing increased transparency in the visa process, especially by linking applications, the VIS is an incentive for Member States to seek common practice when assessing applications, thus leading to more harmonised procedures. The VIS has also made cooperation between the Member States both easier and quicker. The biometric identifiers are reliable and immediately available. This gives consulates and central visa authorities the information they need to check whether the applicant in question has previously been issued with a visa. The VIS is useful both in consulates and centrally to analyse how the common rules are applied and to receive early indications of the level of abuse of visas issued in specific locations (e.g. visas used for other purposes than those declared, for example to access the EU territory for asylum or work purposes). Although exact figures on the level of abuse of Schengen visas in the form of overstaying cannot be currently collected, the future entry/exit system (Entry/Exit System EES) will address this issue, as it will be able to systematically and reliably identify ‘overstayers’ and periodically produce a list of people who have overstayed. At the same time, some Member States indicated that regional disparities exist in the way the VIS obligations are implemented, for example when applying the exemptions from the rule to enrol biometrics, depending on the economic and diplomatic opportunities that exist in each region. While Member States need to take measures to correct such uneven application of the common rules on visas, the scope of these cases remains limited and does not call into question the validity of the VIS as an instrument supporting the implementation of the common EU visa policy. The VIS also has the potential to make the visa process and its end result more predictable for visa applicants, regardless of which Member State assessed the application. The possibility for the Member States to conduct searches against the VIS offers bona fide travellers a simplified procedure when applying for a visa.

If the VIS search on asylum applicants is done properly, it should lead to a more effective and uniform practice of providing evidence for determining the Member State responsible for examining an asylum application. It should also help check the identity and credibility of asylum seekers. However, Member States also underlined the need to make better use of the information held in the VIS: firstly, by making more use of its under-exploited functionalities, for example for asylum, return or law enforcement purposes, and secondly by developing it and integrating it with the EES and improving data quality (including alphanumeric data), which is essential to obtain full and reliable information for the queries in the VIS. More detailed information on the reasons for refusing or withdrawing an application and on revoking or annulling visas would be welcomed. Another suggestion from the Member States contributing to this evaluation is that eu-LISA’s mandate needs to be extended to allow it to access the VIS for data analysis (trends) and biometrics quality reporting. The current legal basis confining the right to access the VIS data for the purpose of statistics exclusively to the Member States (with the exception of statistics on logs related to processing operations) is sub-optimal, in that it does not ensure a centralised way of reporting. This limitation is further aggravated by the fact that the eu-LISA founding Regulation does not explicitly provide a basis for eu-LISA to deliver statistics on data quality, despite these being key to ensuring the VIS functions properly. Sharing statistics on the basis of the VIS data would also provide evidence of any need to change the common visa policy. 6.4.2.Assessment of the continuing validity of the VIS for performing biometric matching, primarily of fingerprints, for identification and verification purposes Member States consider the VIS an essential tool in detecting identity theft and visa shopping and that biometric checks are key to an efficient VIS. Biometric matching is considered the cornerstone of the common identification and verification procedure. A biometric Schengen visa means identity theft is no longer an option for those attempting to cross the EU border fraudulently, as the fingerprint check would immediately expose the fraudster. The VIS works by dissuasion and its applications in the visa, asylum, migration and return policies are very much appreciated by practitioners. The biometric match provides a strong means of identification and prevents the misuse of applications and fraudulent behaviour. The VIS helps identify third-country nationals who are staying irregularly and is a very useful tool for return purposes. As regards asylum, the VIS is a fast and reliable source of information to establish whether an asylum applicant has been granted a visa and check the identity of an asylum applicant and the identification document the person in question has submitted for his/her visa application. At the same time, many Member States emphasised the need to do more about the quality of the biometric data. Though rare, cases of 100 % biometric match of two different people have been observed in practice by national authorities, resulting from low quality of fingerprints. Bad quality fingerprints discourage Member States from carrying out border checks against the VIS. For example, the asylum authorities reported some cases where there was no match in the VIS despite the fact that the asylum applicant had applied for a visa. In some cases the authorities found the applicant in VIS via an alphanumeric search, but the fingerprints search did not find the person in the VIS. On the other hand, the system is performing very well in terms of keeping files. Thus, between October and December 2015, 97.2 % of the NIST files in the VIS were complete (i.e. they contained all 10 fingerprints). Only 0.23 % of facial images and 2.64 % of fingerprints requiredwere missing out of the 20.5 million applications. In order to address these issues at the most appropriate level, Member States recommended that eu-LISA’s legal basis should be supplemented to give it the mandate to assist them in improving the quality of biometrics. Some Member States suggested adding in the VIS the possibility to automatically check against other databases, in particular the SIS, and the upcoming EES, in order to increase the efficiency of searches. 6.5.Acceptability The VIS was set up at the request of the Member States. It did not raise acceptability issues from the national authorities dealing with it. However, the evaluation has showed that some of its functions are not used by the Member States to the level required. For example, despite frequent calls at political level for better use of the VIS, monitoring of usage in the past few years showed that the VIS is not fully used for asylum purposes, or not as frequently as it should be by all Member States. By December 2015 the VIS had been used only by 12 Member States to determine the Member State responsible under the Dublin Regulation, and by 15 Member States to support the examination of asylum applications. By March 2015 only one in two visas were checked against the VIS at the external border crossing points. Some resistance to the deployment of the VIS was met in certain third countries (Russia, Ukraine, the Gulf countries). This was expressed either at the highest political level or at individual level, usually by applicants resisting fingerprinting. The reason for the negative perception is mainly related to the taking of fingerprints, which is sometimes perceived in certain societies as linked to a criminal record, while other concerns were also highlighted (e.g. the requirement of personal appearance resulting in travels of long distances to nearest consular services to lodge visa applications or in complaints by travel agencies that have been in many places important intermediaries in visa application processes). Concerns expressed at the highest political level (as with Ukraine) led to delays in the roll-out of the VIS. However, none of these concerns lead to long-term rejection. To alleviate the possible negative impact of the procedure at individual level and make the system more acceptable, the level of discretion of the procedure was increased, mainly by setting up individual booths in the consulates and visa application centres of certain countries. Additionally, the Member States checked on their consular presence in third countries to facilitate opportunities for fingerprint-taking, and information sessions were organised with the relevant stakeholders to ensure that accurate factual information was being shared in the public domain with the visa applicants. 6.6.Coherence with other EU policies Current trends show that the VIS is becoming more consistent with other EU policies in the field of home affairs. Member States have made very little use so far of the provisions in Article 31 of the VIS Regulation (relating to communication of data to third countries or international organisations to prove the identity of third-country nationals for the purpose of return). However, the recent enhanced political focus on return policy, collaboration with countries of origin and renewed focus on the transit of irregular migrants will only increase the use of the VIS, allowing it to properly identify people in a return procedure. The evaluation also showed that while access to the VIS for law enforcement purposes currently remains quite fragmented and limited among the Member States, the high level of satisfaction and real or expected benefits from VIS access indicate that the number of users and requests should only increase in the future. The reports received from the local Schengen cooperation in third countries, as well as statistics gathered following the roll-out of the VIS in any given location, indicated that the VIS has had no negative impact on the amount of visa applications. Introduction of the VIS did not cause a drop in tourism or business travel to the Member States.

6.7.EU added value A return to a state of affairs in which national systems are used to ensure the security of the external borders, fight irregular migration or assist in the fight against terrorism and other serious crimes does not seem to be an option this point in time. The added value of the EU legislation in this field is only increasing. The recent calls by the Council of Ministers of the EU in the field of justice and home affairs to step up checks at external borders including by ‘carrying out a systematic registration, including fingerprinting, of third-country nationals illegally entering the Schengen area, whether migrants or applicants for international protection, and performing systematic security checks by using relevant databases, in particular SIS II, Interpol databases, VIS and national police databases, with the support of Frontex and Europol (…)’ are a strong appeal to more systematic and wider use of the VIS and to making it more interoperable with existing and possibly new EU databases. Member States also confirmed that the VIS is an important tool that supports asylum authorities in determining the Member State responsible and in examining asylum applications. 7.Conclusions The findings of this evaluation allow for a clear assessment of the key evaluation criteria and questions, especially given the abundance of quantitative and qualitative data. This clear assessment is possible despite certain limitations in the degree of response of the stakeholders. The VIS seems to have been effective in achieving its main objective, namely to facilitate the visa application procedure. The costs of setting up the VIS were reasonable and in certain cases the VIS contributed to enforcing synergies at European level, hence limiting costs at national level. The Regulation created only a limited administrative burden, which was outweighed by the gains brought by the system in terms of simplifying the visa procedure. At the same time, the VIS creates benefits in operational terms by facilitating checks at external borders, combating visa fraud and enabling the rapid identification of people who may not or no longer fulfil the conditions for entry or stay in the territory of the Member States. It also supports asylum authorities by providing relevant information for determining the Member State responsible and for examining asylum applications. Thus, overall, the VIS is efficient in general terms of costs and benefits. However, the Member States need to do more to implement the VIS in order to reap the full benefits of the VIS. In this respect, the use of the VIS for the purpose of checks at external borders or within the territory, and for asylum, return or law enforcement purposes, needs to be enhanced and/or intensified. The objectives of the VIS Regulation remain relevant and the Regulation continues to be important for the area of free movement. Recent developments mean the relevance of the VIS can only increase in the future. Member States need to improve their practical implementation of the LEA Decision. The results of the evaluation demonstrate that urgent action is needed in some Member States to bring the national measures into line with the provisions of the Decision. Specific attention should be focused on the recording of access operations and on training authorised staff. The VIS is coherent with other policies in the field of migration and borders and with international relations. Its added value is consolidation. Given the general political objective of increased cooperation between Member States in the field of migration and borders and in stepping up controls at external borders, including through increased interoperability between the systems, it now appears hard to imagine that a system such as the VIS be withdrawn. On this basis, it can be concluded that the VIS is fit for purpose. It is recommended that the VIS regulatory framework be further developed in the ways described in these conclusions to respond to new challenges in visa, border and security policies. Annex 1: Procedural information concerning the process to prepare the evaluation In August 2014, the Commission launched an evaluation of the VIS Regulation. The evaluation is part of the Commission’s Agenda Planning (2016/HOME/004) and Work Programme (COM(2014) 910 final — Annex 3). The process developed in four phases: phase I — Inception: August 2014-March 2015; phase II — Data collection: May 2015-February 2016; phase III — Exploitation: February-March 2016; phase IV — Completion of Commission internal procedures and final adoption: April-September 2016.

An inter-service group steering group was set up at the launch of the evaluation to oversee the process. The Secretariat-General, the Legal Service, DG JUST and the European External Action Service participated in the group. The group met twice during the evaluation process (16 April 2015 and 15 April 2016). The evaluation was performed internally. Hard data to support the assessment have been relatively easy to find. The main contributors were Member State authorities in charge of visa policy and those managing the VIS. The evaluation criteria and questions were assessed both quantitatively and qualitatively. Annex 2: Summary of findings on the implementation of the Visa Information System (VIS) Regulation based on Member States and eu-LISA reporting I.Results achieved against objectives 1.1Facilitation of the visa application procedure The overwhelming majority of Member States that responded to [a questionnaire on implementation of the Visa Information System (VIS) agree that the introduction of the Visa Information System facilitated the visa application procedure: 60 % consider the VIS to have had a slightly positive impact on the procedure, while 11 % consider this impact strongly positive. 16 % of the responding Member States consider that the VIS had no impact on the visa application procedure, and 10 % consider the impact to be negative (5 % consider it strongly negative and 5 % slightly negative). All responding Member States agree that the procedure was made slower and lengthier by the introduction of the VIS, because it requires biometric capture and the maintenance of the biometric equipment, and consequently more cumbersome for applicants as well. All Member States agree that the VIS has also made the procedure more secure in terms of due diligence and that applicants are better protected against identity theft. However, those who consider the impact of the VIS positive emphasise that it has simplified decision making, by streamlining the exchange of data between Member States on applications and related decisions. Applicants’ visa history is now easily available. Statistics from the eu-LISA system show that from 1 August to 15 October 2015 the average time taken to complete an examination procedure (from the moment of accepting the visa application until a visa was issued) was around 4 days. Most Member States take an average of 5 days to complete the procedure, but the range is wide: from less than a day (0 days) for one Member State to 13 days for another. Some Member States consider that the impact of the VIS cannot, at this point, be fully evaluated, because it does not currently contain enough data about applicants and their visa history to simplify the visa procedure. When the VIS contains more information, more analysis will be possible and this will simplify the procedure. 1.2Preventing bypassing of the criteria for determining the Member State responsible for examining the application The prevailing view among the contributing Member States (63 %) was that the introduction of the VIS had no impact on preventing the bypassing of the criteria for determining the Member State responsible for examining visa applications. Only 31.5 % of the responding Member States considered that the VIS had a positive impact, either slightly positive (21 %) or strongly positive (10.5 %). However, none of the responding Member States thought the situation had worsened with the introduction of the VIS. There is considered to be little advantage in checking the VIS for previous applications (especially recently rejected applications). The history of applications helps determine the main destination, which is very useful in cases where the applicant uses a new (blank) passport for a new application. The criteria for determining the Member State responsible follow from the information provided in the application form, where the main destination for the visit is given. Previous rejection does not necessarily mean the current application will be rejected, nor is it grounds for the current application not to be handled by a given consulate. A well-coordinated LSC remains an essential tool to fight visa shopping. Member States that replied stressed that for the system to work satisfactorily it is extremely important that all Member States perform searches and linking of individual files in the VIS correctly and that the biometrics taken are of sufficient quality. 1.3Facilitating the fight against fraud The overwhelming majority of responding Member States — 84.2 % — agreed that the introduction of the VIS facilitated the fight against visa fraud, 42 % found this impact slightly positive, while 42.2 % found it strongly positive. 10.5 % consider that the VIS has had no impact on visa fraud. No Member State seems to consider that the VIS might, in any way, have facilitated fraud. The main feature contributing to the fight against fraud are the fingerprints stored in VIS. The system thus provides a secure link to the identity of the applicant through biometrics and no ‘look-alike fraud’ is possible. However, this requires searches made on the basis of fingerprints, systematic linking of files, and biometrics of sufficient quality.

VIS is not intended to prevent fraud with documents/false passports presented as part of an application; to tackle this problem, when examining a visa application, visa authorities should use SIS II and Interpol’s Stolen and Lost Travel Documents database. Consulates must be sure of the applicant’s identity before taking fingerprints. 1.4Facilitating checks at external border crossing points and within the territory of the Member States The vast majority of the responding Member States (73.5 %) consider the introduction of the VIS to have facilitated checks at external border crossing points and within the territory of the Member States, 52.3 % considering the VIS to have a slight positive effect in this sense and 21.2 % considering the VIS to have a strong positive effect. 15.9 % of the responding Member States consider that the VIS had no impact on these checks at external border crossing points and within the territory, and 5.3 % consider that the impact was slightly negative. The main positive impacts relate to the enhancement of the quality of the visa checks, the increase in the amount of information accessible to relevant authorities and the VIS’ contribution to the detection of and fight against fraudulent documents. The few responding Member States who did not notice any impact or consider the system to have had a slightly negative impact are mainly concerned about the increased time required for border checks. Poor-quality fingerprints and missing information in the VIS files were also mentioned as issues faced at external border crossing points. According to one Member State, the evaluation was also negatively impacted by the difficulty of evaluating the system before the roll-out was completed and an increase in positive appreciation may therefore be expected in the future. 1.5Assisting in the identification of any person who may not, or may no longer, fulfil the conditions for entry to, stay or residence on the territory of the Member States An overwhelming number of responding Member States — 78.9 % — were of the opinion that the introduction of the VIS helped with the identification of persons who do not, or no longer, fulfil the conditions for entry to, stay or residence on the territory of the Member States. 63 % consider this impact slightly positive, while 15.9 % consider that the VIS had a strong positive impact. 5.3 % of the responding Member States consider that the VIS had no impact on the identification of these persons and 5.3 % consider the impact of the VIS to have been slightly negative. Most Member States consider that the VIS gives them the possibility to assess in an unambiguous way and in a timely manner if a person fulfils the conditions for entry to or stay in the territory of the Member States. One Member State stressed its positive impact on identifying a person who has no identity or travel document, thanks to access to fingerprints. The main concerns of the few Member States who consider that the system has had no impact or a slightly negative one on identifying people referred to the lengthy procedures mentioned above, though some Member States have already noticed improvement in that aspect. The lack of police equipment for identification during checks within the territory was also raised. 1.6Facilitating the application of Regulation (EC) No 343/2003 (as replaced by Regulation 604/2013, the ‘Dublin III Regulation’) The vast majority of the responding Member States — 63 % — consider that the introduction of the VIS supported the application of the Dublin Regulation to determine the Member State responsible for examining an asylum application. Almost 31.5 % consider the impact of the VIS to have been slightly positive, and 31.5 % consider it strongly positive. Almost 26.5 % consider that the introduction of the VIS had no impact on the Dublin procedure and 11 % did not answer. None of the respondents found this impact to be negative. For asylum purposes, the VIS has been used by 12 Schengen Member States in 399 991 cases since October 2011 to help determine the Member State responsible under the Dublin Regulation and by 15 Member States in 1 384 988 cases since October 2011 to support the examination of asylum applications. The vast majority of these VIS searches were carried out by four Member States. Feedback from Member States shows that VIS data yield evidence for determining the Member State responsible and facilitate ‘take charge’ requests. They also help with assessing the identity and credibility of applicants when an asylum application is being examined. 1.7Contributing to the prevention of threats to the internal security of any of the Member States (on the basis of Council Decision 2008/633/JHA of 23 June 2008 concerning access for consultation of the Visa Information System (VIS) by designated authorities of Member States and by Europol for the purposes of the prevention, detection and investigation of terrorist offences and of other serious criminal offences) For almost half of the responding Member States — 47.3 % — the introduction of the VIS had a positive impact on prevention of threats to the internal security of the Member States. For 42 % this impact was slightly positive and for 5.3 % it was strongly positive. For 10.5 % of respondents the introduction of the VIS had a limited impact and for 15.9 % no impact. 26.3 % of respondents did not rate its contribution to the prevention of security threats. II.Assessment of the continuing validity of the underlying rationale for the system 2.1Assessment of the continuing validity of the VIS as an instrument for supporting the implementation of the common EU visa policy All responding Member States consider the VIS essential for the good functioning of the common visa policy and for supporting the common area of free movement. It has led to more streamlining and harmonisation of the visa application procedure, albeit rendering it lengthier and more cumbersome. It has minimised fraud and visa shopping, and enhanced the global security features of visa procedures. It facilitates and encourages communication between Member States. By introducing increased transparency in the visa process, especially by linking appl