EUROPEAN COMMISSION Brussels, 21.12.2016 SWD(2016) 450 final COMMISSION STAFF WORKING DOCUMENT Accompanying the document REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND

THE COUNCIL

on the evaluation of the second generation Schengen Information System (SIS II) in accordance with articles 24 (5), 43 (3) and 50 (5) of Regulation (EC) No 1987/2006 and articles 59 (3) and 66 (5) of Decision 2007/533/JHA

{COM(2016) 880 final}



Table of contents 1.Introduction 1.1 Overall evaluation (Art 50 (5) SIS II Regulation and Art 66 (5) SIS II Decision) 1.2 Alerts on refusal of entry or stay (Art 24 (5) SIS II Regulation) 1.3 Remedies (Art 43 SIS II Regulation and Art 59 SIS II Decision) 1.4 Scope 1.5 Structure of the Staff Working Document 2.Background to sis ii and Baseline 2.1 Background to SIS II and Baseline 2.2 The second generation of SIS (SIS II) 2.3 Intervention Logic 3.The evaluation questions 3.1 The evaluation process 3.2 Evaluation questions 3.2.1 Evaluation of Central SIS II and the application of the Decision/Regulation in respect of Central SIS II 3.2.2 Security of Central SIS II 3.2.3 Alerts 3.2.4 Other provisions of the SIS II legal instruments 3.2.5 Use of Art 24 of the SIS II Regulation on refusal of entry or stay

3.2.6 Bilateral and multilateral exchange of supplementary information between Member States 3.2.7 Examination of results achieved against objectives and any implications for future operations 3.2.8 Assessment of the continuing validity of the underlying rationale 3.2.9 Remedies 4.Method 4.1 Timescale 4.2 Methodology and data collection 4.2.1 SIS II technical architecture 4.2.2 Responsibilities of the ‘Management Authority’ (eu-LISA) for Central SIS II 4.2.3 SIS II security and data protection 4.2.4 SIS II alerts and procedures 4.2.5 Alerts for refusal of entry or stay under Article 24 of the SIS II Regulation 4.2.6 Remedies 5.Findings of the evaluation concerning the central components of SIS II and the application of the legal instruments in respect of Central SIS II 5.1 Central SIS II 5.2 SIS II Technical Assessment 5.2.1 Identified issues 5.2.2 Future needs 5.2.3 Conclusions 5.3 The security of Central SIS II

5.3.1 Coherence — network security 5.3.2 Conclusions 6.The results achieved by sis ii against the original objectives and the continuing validity of the underlying rationale of sis ii 6.1 Number of valid (non-expired) records 2013-2015 6.2 The number of times SIS II has been accessed by end-users 6.3 Overall hits 6.4 Main identities, aliases and misused identities 6.5 Authorities having a right to access alerts 6.6 Institutional users: eurojust and europol 7.Review of the application of alerts for the refusal of entry or stay under Article 24 and 26 SIS II Regulation 7.1 A brief overview 7.2 Key themes emerging 7.3 Inconsistency with the Return Directive – coherence/consistency 7.4 Lack of harmonisation when entering entry bans in SIS II - effectiveness and coherence/consistency 7.5 Entering travel bans constituting a restrictive measure in SIS II - effectiveness and coherence/consistency 7.6 Creation of a European Border and Coast Guard Agency 7.7 Conclusions 8.Alerts for arrest for extradition or surrender under Article 26 of the SIS II Decision 8.1 Key themes emerging 9.Alerts on missing persons under Article 32 of the SIS II Decision

9.1 Key themes emerging38 10.Alerts on persons sought to assist with a judicial procedure under Article 34 of the SIS II Decision39 10.1 Key themes emerging39 11.Alerts for discreet and specific checks under Article 36 of the SIS II Decision40 11.1 A brief overview40 11.2 Use of SIS II for counter-terrorism purposes40 11.3 Key themes emerging42 12.Alerts on objects for seizure or use as evidence in criminal proceedings under Article 38 of the SIS II Decision43 12.1 A brief overview43 12.2 Key themes emerging44 12.2.1 Alerts on vehicles, industrial equipment and licence plates44 12.2.2 Checks carried out by the authorities responsible for issuing vehicle registration certificates47 12.2.3Alerts on containers and boats48 12.2.4 Alerts on issued and blank documents48 12.2.5 Alerts on banknotes, securities and means of payment51 12.2.6 Broadening the scope and use of object alerts51 13.New functionalities in SIS II — challenges in implementation52 13.1 Implementing functionalities52 13.2 Conclusions52 14.Use of fingerprints in SIS II53

15.Operational procedures54 15.1 Key themes emerging54 16.SIRENE Bureaux and the exchange of supplementary information between Member States56 16.1 Introduction56 16.2 SIRENE communication56 16.3 SIRENE communication within a Member State56 16.4 Bilateral or multilateral SIRENE communication — the SIRENE Forms57 16.5 ‘Data Exchange Between SIRENEs (DEBS)’58 16.6 SIRENE functional tests58 16.7 SIRENE workflows and workload — maintaining effectiveness, efficiency and coherence with requirements58 16.8 Structure of the SIRENE Bureaux59 17.SIS II- SIRENE training at European level60 17.1 SIRENE CEPOL courses60 17.1.1 The SIRENE online module and SIRENE platform60 17.1.2 Statistics on the SIRENE CEPOL trainings60 17.2 eu-LISA training61 17.3 Conclusions61 18.SIS II governance — issues already addressed and harmonisation of procedures62 18.1 Governance62 18.2 Issues already addressed and the harmonisation of procedures63

18.2.1 Issues addressed in the SISVIS Committee — EU added-value and effectiveness63 18.2.2 Interim reviews of the SIRENE Manual64 18.2.3 The Catalogue of Recommendations and Best Practice — EU added-value64 18.2.4 Factsheets — Effectiveness64 19.Remedies65 19.1 The right of access65 19.2 Right to correction and deletion of data66 19.3 Remedies: the right to complain to the data protection authority or to initiate a judicial proceeding66 19.4 Evaluation66 19.4.1 Questionnaire forwarded to the members of the SIS II Supervision Coordination Group66 19.5 The evaluations of certain Member States on the application of the Schengen acquis in the field of data protection67 20.Overall cost efficiency of SIS II70 20.1 Building the ICT cost model70 20.1.1.Operational costs70 20.1.2 The costs of non-Schengen - efficiency72 21. Conclusions72 Annex I - Findings and recommendations74 Annex II - Sources85 Annex III - Meetings89 Annex IV - Detailed statistics on complaints and remedies91





1.Introduction The SIS II legal instruments describe the system, how it is managed and how it must be used. The legal instruments also specify which aspects of SIS II must be evaluated and the timescales for that evaluation. Due to the wide-ranging nature of this evaluation, covering legal, operational, procedural and technical issues, a large part of this document is dedicated to the overall evaluation as described in section 2.1. The objectives of the two more tightly focused areas on alerts for refusal of entry or stay and remedies are also described below and subsequently addressed in dedicated sections in the report. The summaries below set out the evaluation objectives of each subject area. 1.1 Overall evaluation (Art 50 (5) SIS II Regulation and Art 66 (5) SIS II Decision) Three years after SIS II is brought into operation and every four years thereafter, the Commission shall produce an overall evaluation of Central SIS II and the bilateral and multilateral exchange of supplementary information between Member States. This overall evaluation shall include an examination of results achieved against objectives, and an assessment of the continuing validity of the underlying rationale, the application of this Decision in respect of Central SIS II, the security of Central SIS II and any implications for future operations. The Commission shall transmit the evaluation to the European Parliament and the Council. The evaluation objectives can be summarised as: evaluation of Central SIS II; the bilateral and multilateral exchange of supplementary information between Member States; an examination of results achieved against objectives; an assessment of the continuing validity of the underlying rationale; evaluation of the application of this Decision/Regulation in respect of Central SIS II; the security of Central SIS II; implications for future operations. 1.2 Alerts on refusal of entry or stay (Art 24 (5) SIS II Regulation) The Commission shall review the application of this Article three years after the date referred to in Article 55(2). On the basis of that review, the Commission shall, using its right of initiative in accordance with the Treaty, make the necessary proposals to modify the provisions of this Article to achieve a greater level of harmonisation of the criteria for entering alerts. The evaluation objectives can be summarised as: review the application of this Article; make the necessary proposals to modify the provisions of this Article to achieve a greater level of harmonisation of the criteria for entering alerts. 1.3 Remedies (Art 43 SIS II Regulation and Art 59 SIS II Decision) The evaluation objectives can be summarised as to collate and review the provisions in each Member State on: (a) a person’s ability to bring an action before the courts or the authority competent under the law of any Member State to access, correct, delete or obtain information or to obtain compensation in connection with an alert relating to him, and (b) the mutual enforcement of decisions in other Member States.

1.4 Scope This evaluation covers all Member States as they all use SIS II (25 MS), will join imminently (Croatia) or intend to use it in the future (Cyprus and Ireland). The UK started using SIS II during the evaluation process (13 April 2015). The evaluation also covers four associated countries which use SIS II (Norway, Iceland, Switzerland and Liechtenstein) as well as the two agencies which are permitted access, namely EUROPOL and EUROJUST. 1.5 Structure of the Staff Working Document In line with the principles of Better Regulation, this Staff Working Document follows the structure set out in Tool #47 of the European Commission's Better Regulation Toolbox. Section 1 contains an Executive Summary. Section 2 introduces the purpose and scope of the overall evaluation of SIS II and describes the structure of this paper. Section 3 sets out the background of the initiative, its components and how they fit together. Section 4 explains the evaluation concept and lists the evaluation questions. Section 5 provides information with regards to the method used in the overall evaluation. Sections 6 to 21 describe the answers to the evaluation questions. Within this, Sections 14 and 15 set out particular implementation challenges highlighted by respondents, related to the new functionalities in SIS II and the Automated Fingerprint Identification System. This maintains the internal logic of the document. Finally, section 22 summarises the findings and conclusions of the SIS II overall evaluation and these are listed in full in Annex 1. 2.Background to sis ii and Baseline 2.1 Background to SIS II and Baseline The Schengen area was established by the 1985 Schengen Agreement that set out the gradual abolition of checks at common borders. The Agreement was supplemented by the 1990 Schengen Implementing Convention that set out the final abolition of internal border controls, as well as a series of necessary accompanying measures. The Schengen Agreement made passport-free travel possible for over 400 million Europeans. From the initial five Member States, the Schengen area without internal border controls now includes 26 countries. The participating countries apply common rules for checks at the external borders of the Schengen area, as well as rules on issuing visas and cooperation between law enforcement and judicial services in criminal matters. In the absence of internal border controls, Member States had to address the issues of cross-border crime and irregular migration. This included assessing the most effective way for Europe-wide information sharing and legal assistance for the carrying out of national law enforcement, immigration and judicial decisions. It was clear that these could no longer be achieved with traditional bilateral agreements and mutual legal assistance requests, due to the rapid movement of criminals and the need to act promptly. In order to effectively maintain a high level of security, Member States had to create a tailor-made instrument to: share security-related information in a centralised, structured way and move away from fragmented bilateral cooperation; make such information immediately available to all competent national authorities; and empower competent authorities in other Member States to act on behalf of requesting Member States. However, the first generation of the Schengen Information System, which entered into operation in the mid-1990s, was not able to serve the needs of increasing number of Member States of the EU after its enlargement. Due to this, and in order to benefit from the latest IT developments and to provide end-users with new functionalities, it was decided that it was necessary to establish a new, second generation Schengen Information System (SIS II). As acknowledged in Decision SCH/Com-ex (97) 24 of the Executive Committee of 7 October 1997, "only SIS II will be able to meet a certain number of essential operational demands". 2.2 The second generation of SIS (SIS II) SIS II entered operations on 9 April 2013. New functionalities for operational end-users are: Enhanced alerts on persons and objects: vehicles, firearms, issued documents, blank documents, bank notes. New categories of alert: stolen aircraft, boats, boat engines, containers, industrial equipment, securities and means of payment. The ability to conduct direct queries in the central system, as opposed to the previous practice of all queries being carried out in a national copy of the data. Linking of alerts on persons, objects and vehicles (e.g. alerts on a wanted person and the stolen vehicle he/she is using). Biometric data (fingerprints and photographs). A copy of the European Arrest Warrant (EAW) attached directly to alerts for persons wanted for arrest for surrender or extradition.

Information on misused identity preventing the misidentification of the innocent party in identity fraud. Data on persons stored in SIS II are: the data necessary to locate a person and confirm his/her identity (now including a photo and fingerprints, where available); relevant information about the alert (including the action to be taken). Fingerprints are currently used to confirm an identity but in the future they may also be used to establish the identity of a person. 2.3 Intervention Logic As set out in the SIS II legal instruments, the purpose of the system is to contribute to the maintenance of a high level of security within the area of freedom, security and justice of the European Union. It enables law enforcement and migration authorities to enter and consult alerts on persons and objects and provides end-users with new functionalities in order to facilitate their operational needs. Essentially, a significant increase in information exchange at the EU level has been witnessed since the establishment of SIS II. The system has also demonstrated its flexibility in responding to the dynamic security and migration environments, exacerbated by the foreign terrorist fighter phenomenon and the migration crisis. The simplified intervention logic diagram below explains how the different components of SIS II fit together.



Simplified Intervention Logic 3.The evaluation questions 3.1 The evaluation process The evaluation was carried out by Commission staff supported by external supporting studies in four areas: remedies, use of alerts for refusal of entry or stay and consultation procedures where a residence permit and an alert for refusal of entry or stay may co-exist as well as about the role of the SIRENE Bureaux in the European police information exchange. The list of studies are set out in Annex II. The evaluation followed an iterative process: issues were raised in the questionnaire phase and clarified through interviews so that all issues could be raised in a comprehensive and transparent way. These issues were shared in dedicated meetings/workshops aiming to arrive at a shared understanding and assessment. Moreover, the Commission has set up an Inter-service Steering Group with the participation of the General Secretariat, DG HOME, DG JUST, DG HR and DG DIGIT which monitored the evaluation process and provided the necessary guidance. The dates of the relevant meetings are attached in Annex III. The analysis was based on both qualitative and quantitative evidence. A qualitative assessment was carried out, outlining a number of initiatives designed to solve issues or improve guidance on the use of SIS II. Quantitative data were collected in order to provide the statistics needed for the reports, benefiting from the fact that SIS II was designed legally and technically from the outset to provide statistics on its use and effectiveness, which is an unusual feature amongst law enforcement cooperation systems.

The intention of many of the questionnaire elements was to establish effectiveness, relevance and coherence, with a view to identifying potential improvements in these three areas and thereby increase EU added-value. Where inefficient procedures were identified or had already been eliminated, this was also highlighted. The evaluation made use of the extensive figures on the use of SIS II and the performance of the system itself, gathered and published (to a restricted audience) by eu-LISA. It also used Member State statistics on the exchange of supplementary information and hits on alerts. 3.2 Evaluation questions 3.2.1 Evaluation of Central SIS II and the application of the Decision/Regulation in respect of Central SIS II The evaluation of the technical and operational management aspects of SIS II incorporates the findings of the report prepared by eu-LISA under Article 66(4) of the SIS II Decision. This report describes the technical functioning of the Central SIS II and the network, including the security thereof, between its entry into operation on 9 April 2013 and 31 December 2014. It sets out how SIS II performed against expectations, addressing issues related to SIS II effectiveness, efficiency, relevance, coherence and EU added-value. 3.2.2 Security of Central SIS II The evaluation of the security of Central SIS II was based on the eu-LISA report mentioned above and on relevant sections from a European Data Protection Supervisor audit carried out on Central SIS II in 2014. 3.2.3 Alerts The questions on the technical and operational aspects of the SIS II covered the following operational and legal issues: A.What problems are experienced in operational work that are caused by the wording of the relevant Article? (What does not work as well as it might?) B.What are the obvious gaps in operational capability that are not covered by the legal instruments? (What do you need to do but cannot?) C.Which concrete proposals, if any, could improve the text to overcome these issues? (What do you propose to overcome these problems or gaps?) 3.2.4 Other provisions of the SIS II legal instruments A. What problems are experienced in your work that are caused by the wording of the relevant Article? (What does not work as well as it might?) B. What are the obvious gaps that are not covered by the legal instruments? (What do you need to do but cannot?) C. Which concrete proposals could improve the text to overcome these issues? (What do you propose to overcome these problems or gaps?)

3.2.5 Use of Art 24 of the SIS II Regulation on refusal of entry or stay The following questions were addressed to the Member States via the Commission-chaired European Migration Network. 1.Do Member States have statistics on how many entry bans are entered into SIS II due to the non-compliance with national migration laws and as a sanction of a criminal offence (national grounds for the imposition of entry bans)? 2.What duration of overstaying on the territory of a Member State is sanctioned with an entry ban entered into SIS II? 3.What is the major ground for the consultation procedure pursuant to Section 4.5 of the SIRENE Manual (namely (i) the procedure provided under Art. 25 (1) of the Schengen Convention, (ii) the procedure provided under Art. 25 (2) of the Schengen Convention, (iii) procedure in cases falling under Art. 6(5) (a) of the Schengen Borders Code, or (iv) procedure in cases falling under Art. 6(5) (c) of the Schengen Borders Code)? 4.Do Member States use the consultation procedure? 5.How many successful consultation procedures were conducted in 2013 and 2014? 6.What are the national deadlines for a consultation procedure? 7.What sorts of difficulties have Member States encountered with the consultation procedure? 8.Are there special procedures for such consultation with regard to persons enjoying the right of free movement? 3.2.6 Bilateral and multilateral exchange of supplementary information between Member States This section was completed through: a statistical assessment of the exchange of supplementary information between the Member States; a questionnaire survey to all Heads of SIRENE Bureau on their ability to comply with the requirements of the SIRENE Manual; identification of any gaps in operational needs which should be addressed; and discussion papers addressed at workshops in Brussels with delegates to the SISVIS Committee. 3.2.7 Examination of results achieved against objectives and any implications for future operations This section was completed through:

a statistical assessment of the use by Member States of the categories of alerts and the hits achieved (this included the use of SIS II by the Member States’ authorities responsible for the registration of motor vehicles); a questionnaire survey to all Heads of SIRENE Bureau on: the capacity of existing alert categories to meet operational needs the identification of under-used alert categories the reasons for under-use the identification of operational needs which are not met by current alert categories discussion papers addressed at workshops in Brussels with delegates to the SISVIS Committee; a statistical assessment on the implementation of alerts for refusal of entry or stay; a questionnaire survey to the relevant authorities in each Member State seeking a description of national procedures leading to the creation of alerts for refusal of entry or stay and the ongoing management, updating and deletion of alerts. 3.2.8 Assessment of the continuing validity of the underlying rationale This element was completed through: a questionnaire survey to Heads of SIRENE Bureau, Heads of N.SIS II and other relevant authorities on aspects of the SIS II legal instruments which are viewed as not fully fit for purpose on whatever grounds; discussion at workshops in Brussels with delegates to the SISVIS Committee; a conclusion to the evaluation report which answers the question on the continuing validity of the underlying rationale and sets out concrete proposals from the Commission. 3.2.9 Remedies This section contains the key points of the report provided by the SIS II Supervision Coordination Group and the information gleaned from the targeted questionnaire. Detailed questions on specific areas were forwarded to the national contact points. 1.Please describe the procedures in your Member State for any person to bring an action before the courts or the authority competent under the law of any Member State to access, correct, delete or obtain information or to obtain compensation in connection with an alert relating to him. Include procedures: (a) within your country; (b) where the applicant is in another Schengen State; (c) where the applicant is in a third country. 2.In the cases described above (a-c), are there any fees or costs involved or implied for the applicant? 3.If the applicant is in a third country how do you verify their identity and right to make the application? 4.Please provide any available annual statistics covering 2013 and 2014 on the use of such remedies by any person (if possible the total number of cases per year; the number of cases per year where the court or authority ruled in favour of the applicant; the number of cases per year where compensation was paid; the financial value, in total per year of the compensation paid).

5.Please describe your provisions for mutual recognition and enforcement of final decisions handed down by the courts or authorities of other Schengen States on alerts created by your country. The evaluation report outlines findings for areas where improvement is required on the basis of the exhaustive report and questionnaire. 4.Method 4.1 Timescale Due to the need to evaluate key elements of the functioning of SIS II after three years of operation, the evaluation started in February 2015 and covers the period from April 2013 to the end of 2015. 4.2 Methodology and data collection The methodology for the evaluation followed a three phase approach: 1.a design phase where the evaluation team structured questions and activities, described in the evaluation mandate and presented to the inter-service steering group; 2.a data gathering phase to collect the evidence required; 3.the analysis, judgment and reporting phase, where the evidence was analysed in order to identify observations and recommendations. 4.2.1 SIS II technical architecture In order to evaluate the effectiveness and efficiency of the complex technical architecture of SIS II, a study was launched with the following objectives: Assess the implications for efficiency and cost-effectiveness of the national ICT architectures in relation to Central SIS II, with a view to making observations and recommendations on developments at central level which could make the national technical implementation of SIS II more efficient and cost-effective. The impact of the architecture of the central system on the Member States’ choice of technology was assessed, without entering into an assessment of Member States’ chosen solutions as this was out of the scope of the evaluation. Assess the existing central SIS II infrastructure and, in particular, its interactions with national systems, with a view to making recommendations to improve efficiency and cost effectiveness at both central and national level. Further work was carried out with an ICT impact assessment on possible improvements to the SIS II architecture. The assessment studied the cost and complexity of possible change scenarios by looking at the impact at central level and also in several Member States. 4.2.2 Responsibilities of the ‘Management Authority’ (eu-LISA) for Central SIS II The SIS II legal instruments require eu-LISA to submit a report on the technical functioning of Central SIS II and the network, including security, and on the bilateral and multilateral exchange of supplementary information between Member States. The first report was published in June 2015. To complement this information, the Commission requested an amended set of information from eu-LISA specifically for the evaluation. However, it should be noted that as eu-LISA is the subject of separate evaluation mechanisms, its evaluation was out of scope for this document. 4.2.3 SIS II security and data protection The security provisions relating to the processing of personal data for the Central SIS II are set out in Article 16 of both the SIS II Regulation and Decision. The legal instruments set out the responsibilities of the European Data Protection Supervisor (EDPS) with regard to checking that the personal data processing activities carried out by eu-LISA are in accordance with the legal instruments. The EDPS ensures that personal data processing activities are audited at least every four years in accordance with international auditing standards. The EDPS audit was taken into consideration in addition to the report from eu-LISA. 4.2.4 SIS II alerts and procedures

The most important source of information for evaluating the use of SIS II by Member States is the Schengen Evaluation Mechanism. Since the entry into operations of SIS II, the use of SIS II and the functioning of the SIRENE Bureaux has been evaluated in 18 Member States under this mechanism. Member States were consulted through the SISVIS Committee, which includes the Member States’ representatives on both operational SIRENE and technical matters on SIS II and the related SIRENE application. 21 Member States responded (of the 28 Member States and Associated Countries using SIS II at the time of distributing the questionnaire; the UK commenced use on 13 April 2015). 4.2.5 Alerts for refusal of entry or stay under Article 24 of the SIS II Regulation Different sources of data were used: Questionnaire to the delegates of the SISVIS Committee. Two queries launched by the European Migration Network (EMN): No 2014.628 on registering entry bans in the SIS II (20 responses received) and No 2015.662 on entry bans entered into the SIS II and consultation procedures in the Member States (25 responses received). Data collected within the context of the external study on the use of SIS II for return purposes. The study set out to analyse the feasibility and the legal, operational and practical implications of the incorporation of return decisions and all entry bans in SIS II. Although the study is a forward-looking exercise it revealed information on the current application of Article 24 of the SIS II Regulation. Statistics collected by eu-LISA and Eurostat. Synthesis Report for the EMN Focused Study 2014. Good practices in the return and reintegration of irregular migrants: Member States’ entry bans policy and use of readmission agreements between Member States and third countries. Evaluation on the application of the Return Directive (2008/115/EC). Final Report. European Commission — DG Home Affairs. 22 October 2013. 4.2.6 Remedies In December 2014, the Chair of the SIS II Supervision Coordination Group presented a report to the Council (doc 16807/14) on the exercise of the rights of the data subject in SIS II and a guide to the right of access. The report provided a comprehensive overview on rights of access, correction and deletion of data and the right to have data checked in SIS II. To update the report with more recent information, the members of the SIS II Supervision Coordination Group were consulted in June 2015. 5.Findings of the evaluation concerning the central components of SIS II and the application of the legal instruments in respect of Central SIS II 5.1 Central SIS II Effectiveness The key mechanism for checking data consistency between Central SIS II and national copies of SIS II data works effectively but is a relatively heavy mechanism, largely due to the differences in implementation at national level causing inconsistencies. Approximately 15 % of data consistency campaigns with the Member States ran without any discrepancy on both alerts and links between related alerts. Some Member States have no issue; this confirms that it is possible to reach zero discrepancies and the design of the system, i.e. having a central database and national copies, is not the root cause per se. An update to the analysis and reporting mechanism resulted in more accurate identification of discrepancies and a lower overall total. This made the data consistency monitoring more effective and efficient to both eu-LISA and Member States, as Central SIS II had the means to detect and repair discrepancies found during data consistency campaigns. This allows a good level of confidence in the accuracy of alerts in the national copies of a large majority of Member States. Central SIS II is reaching the limits to its capacity to carry out data consistency campaigns, as the architecture only permits one campaign with one Member State at a time. eu-LISA has outlined eleven technical options and three procedural options to improve data consistency. Some of these have only minimal financial, technical and procedural impact, while some are quite radical. Given that the impacts will always be balanced and shared between all the SIS stakeholders, a study would be the best vehicle to assess which option or combination of options would improve the data consistency process. Due to Central SIS II’s ability to report on data discrepancies, there has been no need to restore a national copy. The provision of a back-up site for Central SIS II has demonstrated effectiveness due to the ability to switch operations during either maintenance or incidents. Since the entry into operations five switchovers have taken place: four were planned due to upgrades to the central system and one was unplanned, after a database upgrade. These switchovers covered, in total, 97 hours of operational time. Effectiveness could be improved; the current technical set-up requires the passive back-up site to be started and shut down. As a result, any month that requires a switch to the back-up site risks taking the system below its availability requirement of 99.99 % availability to the Member States. An active-active technical set-up with the back-up site running constantly in the background would be more effective. Efficiency

A few Member States still need to improve their national technical implementation in order to reach zero discrepancies. Much of this could be achieved by the Member States in question implementing the technical specifications (the Interface Control Document — ICD) as envisaged. This would allow data consistency campaigns to run more smoothly against a frozen snapshot of the data in order to avoid detecting ‘false discrepancies’ caused by alert updates taking place in the middle of a consistency campaign. This situation still leads to an inefficient and unexpected burden for monitoring the campaigns and the repair activity to ensure synchronisation between national and central systems. The persistence of this issue in some Member States requires eu-LISA to plan additional resources to support them. The variation in interpreting the ICD at Member State level is a major cause of this inefficiency. For example, some Member States send a deletion notification to Central SIS II but then only carry out the deletion later that day in a batch. This can represent nearly 60 % of the discrepancies in a data consistency check, causing unproductive work at both eu-LISA and national level. Central SIS II has a functionality which corrects the inconsistencies. However, this does not prevent investigation after the repair to seek an avoidance of repetition. Due to the diversity of national systems, a standardised solution to resolve all national data consistency issues cannot be put in place. This is a logical outcome of the choice to pursue different technical solutions at Member State level. eu-LISA has increased efficiency at both central and national levels, by raising issues with Member States when automatic reports for restoring consistency have not been acted upon. Through consistently pursuing each issue, Member States repaired the elements of their national systems which had prevented repair. This type of incident has now been eradicated. Relevance Given the detailed description of the work carried out in order to support the three key roles of Central SIS II, the relevance of the legal instruments remains high. Coherence/Consistency Variations in interpreting the technical specifications at national level cause some internal inconsistency which could be reduced or removed. EU added-value The architecture of SIS II, i.e. having a central database and national copies, has a substantial EU added value as due to the centralised solution Member States can perform one query via Central SIS II and it does not need to send queries to all other Member States which would be necessary in case of a decentralised system. Moreover national copies ensure business continuity in case of the unavailability of Central SIS II or the network. 5.2 SIS II Technical Assessment Although it has been a significant operational success, SIS II is perceived by some Member States as being a complex system that is difficult to use efficiently and requires high development and operational costs. One of the primary reasons for this complexity is the flexibility offered to Member States in implementing their national solutions. This has resulted in diverse systems that require an increased support overhead and pose concerns with regards to business continuity. In addition, expected future needs, especially with regards to increased use of the system, might benefit from the current architecture being adapted to address issues in a forward-looking manner. This technical assessment identifies the key current issues and future needs that should be addressed, identifying concerns with regards to maximising business continuity and ensuring that the overall architecture can adapt to meet increasing capacity requirements. 5.2.1 Identified issues Business continuity — effectiveness, efficiency and coherence/consistency with the legal base In the past years of operation of SIS, loss of business continuity has been experienced rarely, and has been related primarily to failover issues at the national level. Cases where Central SIS II has been unavailable are primarily due to network issues, whereas planned upgrades of Central SIS II are largely transparent to the Member States with the effect limited to increased alert processing time for the duration of the Central Unit (CU) and Backup Central Unit (BCU) switchover. Certain types of planned upgrades however are foreseen to cause full unavailability of Central SIS II resulting in both the CU and BCU being unavailable for limited periods. In such cases the main impact is on the N.SIS II without a national data copy, resulting in complete loss of business continuity, with a more limited, but still considerable effect on the N.SIS II with partial data copies or partial query functionality. National implementations with full data copies are affected to the extent of data desynchronisation that is later addressed through the message queue handling, albeit with delayed processing. Albeit infrequent, potential business continuity loss is recognised as a key area where all possible solutions are considered taking into account the critical nature of SIS. Data consistency— effectiveness, efficiency and coherence/consistency with the legal base There are no significant problems with regards to data consistency between central data and national copies. Cases where Data Consistency Check (DCC) campaigns have resulted in extensive synchronisation requirements are typically isolated to specific national implementations, indicating a localised problem. The causes of failed consistency checks are investigated by eu-LISA, in discussion with the national authorities. National DCC campaigns are an area with potential for improvement. This depends entirely on national implementations and is outside central control. One area that should be considered in particular is the overall complexity of the DCC campaigns. Even though the campaigns do not currently suffer from technical problems, they are perceived as being complex to set up and follow up, and are a potential bottleneck if SIS II data increase significantly. Data consistency problems do occasionally appear between the alert data recorded in the Central SIS II and their representation in national source systems (e.g. law enforcement systems). This may be due to incomplete implementation in the N.SIS II where updates to a national source system may not trigger alert updates in SIS, and inversely, where updates received from the Central SIS II related to data recorded in the national source system (i.e. not limited to a national SIS copy) are not correctly reflected in the national source system. Inefficient handling of biometric data — efficiency Fingerprints and photographs are currently stored in the Central SIS II to allow them to be included in relevant query responses. Apart from being used in responding to queries however, biometric image data recorded in this way cannot be otherwise analysed for matching purposes. A specialised biometric data handling system such as an AFIS would be more appropriate. An additional consideration regarding biometric data is the large storage capacity that would be required in the Central SIS II database if biometric data use increases, especially for any future use of photographs for facial recognition, if legally permitted. An increase in use of biometric data is expected, making the necessity of processing and storing in a more effective manner, increasingly important.

Data quality — effectiveness and coherence/consistency with the legal base Data quality problems have been cited by numerous Member States as a frequent and recurring issue. Example cases that have been raised include: basic information missing from alerts such as a person’s gender or date of birth; inconsistent encoding of information, such as placing a date of birth in the name field or using the text ‘Unknown’ for missing values; problems regarding the consistent transliteration of textual information, notably person names, with respect to ICAO standards to allow effective searching of non-Latin characters by Member States where they are not supported; the image quality of fingerprints and photographs that impairs biometric data matching. Incomplete national ICD implementation — effectiveness and coherence/consistency with the legal base The SIS Interface Control Document (ICD) details the data exchange between the N.SIS II and Central SIS II, driving the implementation of national solutions. The interpretation of this technical document offers a degree of flexibility to Member States with regards to the implementation of their N.SIS II. This can result in inconsistent national implementations that do not cover fully some features in Central SIS II, such as complex search options. This results in potentially missed opportunities when carrying out queries. National systems with local copies that are configured to use the Central SIS II for certain searches effectively rely on Central SIS II for the full set of SIS features, with no back-up scenario in case of Central SIS II unavailability. A case where this is considered currently unavoidable is the fuzzy searching of alerts where query results depend on the specific tool or algorithm used. The possibility of national implementations using central services should ideally be a source of flexibility to Member States in balancing their query needs between Central SIS II and N.SIS II. An incomplete national ICD implementation, however, would mean that this flexibility could manifest itself as a loss of business continuity if the Central SIS II becomes unavailable. Excessive query logging at national level — efficiency and coherence/consistency Article 12(3) of the SIS II Decision stipulates that all searches performed on alerts need to be logged, including the data that was used for the search. This has implications for both Central SIS II and the N.SIS II, in terms of additional processing to record the log entry but also in terms of storage capacity to maintain the log information. Several Member States have raised the concern that with solutions that perform large numbers of automated queries such as Automatic Number Plate Recognition (ANPR), the number of queries can reach the level of millions per day. It is clear that maintaining a log of all such automated queries will increase storage requirements for the N.SIS II and, even if performed asynchronously, will affect their overall processing capacity. Alert history logging at national level — efficiency and coherence/consistency As with the logging of queries, Article 12(3) of the SIS II legal instruments requires N.SIS II to log the history of alerts. As all alert modifications are channelled through Central SIS II, the alert history log is also maintained centrally. Article 9(2) nonetheless stipulates that an N.SIS II holding a national data copy needs to ensure it is identical to the central data. Maintaining national copies of the alert history log increases storage capacity requirements and processing for the N.SIS II, leading to suggestions from Member States that the alert history should be recorded and queried at central level only. However, a national alert history copy currently represents a key information source for national data protection authorities. Removing the alert history at national level would require an alternative means of obtaining the required information when carrying out data protection checks at national level. Consistent network management — efficiency The SIS II legal instruments split network management between the Commission and eu-LISA along the lines of financing and contracting versus supervision, security and provider-relations. It is advisable to confer the sole responsibility to eu-LISA for managing the network as the entity in charge of the operational management of Central SIS II and the communication infrastructure.. Furthermore, it is advisable that network decisions are made commonly, covering the possibility of a common network access point for additional systems including VIS and EURODAC. Consolidating network responsibilities is expected to streamline network management, provide a single point of contact to Member States, and allow for more effective reactions to networking problems. Inefficient change management procedure — efficiency The change management procedure for SIS II has been raised on several occasions in the SISVIS Committee meetings. One of the main issues relates to when and how the SISVIS Committee is involved in the change management process, notably regarding initiating and endorsing changes before changes are implemented and ensuring that interest of the end-users is duly taken into account throughout the process. The analysis of the change requests from technical point of view is carried out by eu-LISA assisted by Member States in the SIS II Advisory Group and in particular in its sub-group, the Change Management Group. The recommendations of the Change Management Group must be adopted with consensus by the Advisory Group. The SISVIS Committee must deliver an opinion on the changes which require national implementation. Strong coordination is required from eu-LISA and the Commission to ensure the full consistency of the process. Moreover, the change management process must remain flexible concerning SIS by allowing changes to be made rapidly if operational needs require so. During the operation of SIS II changes related to foreign fighters have been implemented very quickly by eu-LISA and Member States, other changes (e.g. adding laissez-passer issued by the European Union to the code tables, shortening the expiry date for credit card alerts, etc.) however, very subject of a very long procedure. An additional challenge of the process relate to the complexity of making changes in SIS II at national level which requires national systems and relevant end-user applications to be updated in addition to the central system. Therefore, it is rather difficult to set a target date when all Member State can implement the change at the same time. It necessitates strong coordination and discipline from eu-LISA as well as from Member States. 5.2.2 Future needs The key future technical challenge is the expected increase in use of SIS II. This increased use could be the result of expansion of its user base, e.g. including national immigration and naturalisation service authorities that are responsible for decisions regarding requests of admission and naturalisation of third-country nationals, or wider access for Europol as well as a new access to the European Border and Cost Guard Agency. The addition of an AFIS would increase the number of transactions; for example, visa applicants would be checked in SIS II using fingerprints as well as name and date of birth to ensure that they have not tried to use an alias.

The highest source of use for SIS II is expected to come from automated checks such as automatic ANPR, and facial recognition (if legally permitted) at border control points such as airports. Automated checks such as these generate millions of queries per day and huge increases in query requests can be experienced when Member States introduce such systems. The underlying concern, however, for the future capacity of SIS II is the need to increase storage capacity. Increased alert information — effectiveness and efficiency Future changes are expected to increase the amount of information held in alerts. As well as including additional information, alerts will also include coding that allows the national and central systems to treat information differently. This will: provide as much information as possible in the alert, minimising supplementary information exchange through SIRENE forms; allow alerts to be better categorised (e.g. on missing person cases); and improve alert flagging so that alerts can be temporarily suspended or deleted. Extended use of biometric data — effectiveness and efficiency One of the new functionalities in SIS II is the use of biometric data, including the impending automatic matching of fingerprints and, later, facial recognition (if legally permitted). Extension of automated tasks on alerts — efficiency As part of the feedback provided to the evaluation, Member States commented on additional automation in handling alerts. This includes the automatic update of alerts (for missing person cases when a child becomes an adult) and automatic deletion (when the executing Member State forwards a valid address to the issuing Member State in relation to alerts on persons sought to assist with a judicial procedure). Automated processes and scheduling are already implemented in SIS II; the extension of these is not considered likely to have an effect on the overall system architecture. 5.2.3 Conclusions This assessment began by establishing a baseline of issues to consider in developing technical solutions, drawing on currently highlighted issues and expected future needs with technical implications. The key needs identified in this process are: (i) ensuring maximum business continuity, taking all possible steps to address current limitations and (ii) ensuring that SIS II is capable of handling the increased usage, especially in terms of querying, expected in the near future. Central SIS II and overall architecture The ‘read capacity’ and performance of Central SIS II should be increased. There should be a back-up site update and upgrade process to ensure minimal business continuity loss. There should be increased central system test capabilities. There should be the possibility to develop N.SIS II implementations, shared between Member States. National optimisation and harmonisation (a distinct N.SIS II developed by each Member State) The logs on alert history, retained at national level should be optional. Query logging should be selective, especially in cases such as ANPR, and subject to standardised rules.

XML messages should be replaced with JSON objects (technical change on data exchange format). ICD national implementation should be complete implementation of the ICD. National copies (partial) for N.SIS II should be mandatory. Each N.SIS II should have a mandatory back-up system. There should be a common blueprint for consistent N.SIS II configuration. 5.3 The security of Central SIS II The European Data Protection Supervisor (EDPS) carried out a security audit in relation to SIS II (the subject was also covered in the evaluation of eu-LISA). This made recommendations that, when addressed by eu-LISA, will improve overall SIS II security and compliance with ISO/IEC 27 001 and CD(2006)3602. While all of the EDPS recommendations are important, recommendations on ‘security policy’ and ‘risk assessment’ should be implemented as a priority. No recommendations were made in relation to the architecture of SIS II and the services offered by the central unit of the system, although several procedural issues were highlighted. eu-LISA should make sure that when implementing the EDPS recommendations, it covers all provisions relating to the security of Central SIS II, which are mentioned in Regulation (EC) No 1987/2006 5.3.1 Coherence — network security Security is provided effectively and is consistent with the legal instruments. The Commission asked eu-LISA to provide a detailed breakdown of the most critical network incidents affecting the availability of the SIS II between its entry into operations and the date the information was provided. Overall breakdown of the incidents by their severity 5.3.2 Conclusions No recommendations were made in relation to the architecture of SIS II or the services offered by Central SIS II. Taken together with the results of the analyses of incidents in Central SIS II and the network, which showed that there had been no incidents where the integrity of SIS II data was compromised, the overall conclusion is that Central SIS II security is highly effective. 6.The results achieved by sis ii against the original objectives and the continuing validity of the underlying rationale of sis ii 6.1 Number of valid (non-expired) records 2013-2015 Distribution and trends

In 2014 and 2015, the competent authorities of the Member States created more than 13 million alerts, a clear demonstration of the system’s importance for border control and facilitating law enforcement cooperation within the Schengen area and, thus, its EU added-value. It would have been impossible to achieve these results at regional or national level. Alert 2013 2014 2015 Person 861 900 797 764 793 878 Vehicle 3 241 809 3 298 541 3 401 517 Aircraft 7 10 19 Banknote 265 968 267 123 271 893 Blank document 768 620 981 211 1 107 569 Boat 1 046 3 288 6 608 Boat engine 1 691 9 735 19 815 Container 18 96 302 Firearm 431 121 457 059 486 154 Industrial equipment 4 252 42 783 84 426 Issued document 39 836 478 43 552 428 48 357 109 Licence plate 2 157 328 2 470 227 2 786 092 Security 394 918 1 432 409 3 123 969 Vehicle registration document 2 314 233 2 657 355 3 035 305 Total alerts 50 279 389 55 970 029 63 474 656 6.2 The number of times SIS II has been accessed by end-users The legal instruments require statistics to be kept on the number of times SIS II data were accessed by end-users in the Member States. Queries in SIS II cover all checks of persons and objects. Most people will think of a law enforcement officer or border guard carrying out a check on a person, a document or a vehicle; a manual check. However, there are situations where checks are carried out in an automated fashion. This can be carried out on the licence plates of vehicles by ANPR systems, on cruise ship manifests or on lists containing Passenger Name Records. Member States can report on these automated checks, if their computer systems allow such separation. In 2013 an overall figure per Member State was recorded but it became clear that this picture did not provide sufficient detail to assess how SIS II was being used. As a result, the SISVIS Committee agreed to a more detailed break-down of the annual statistics. The statistics for 2014 and 2015 show queries carried out in SIS II, 'create, update and delete' transactions for alerts and transactions which change the expiry date of an alert, thereby prolonging its life in SIS II. The usefulness of SIS is diminished, however, that in certain Member States the national police or immigration databases are not searched in parallel with SIS therefore the SIS search must be carried out with a separate search transaction depending on the consideration of the end-users. It has been noticed in the course of Schengen evaluations that the number of SIS searches was significantly lower if the SIS was not incorporated in a parallel search mechanism. In such cases the cross-border dimension of a crime may be missed.

6.3 Overall hits A hit on an alert is defined in the SIRENE Manual as follows: A hit occurs in SIS II when: (a) a search is conducted by a user, (b) the search reveals a foreign alert in SIS II, (c) data concerning the alert in SIS II matches the search data, and (d) further actions are requested as a result of the hit The figures used reflect the hits achieved by Member States on their own territory on alerts issued by other Member States. HITS 2013 2014 2015 TOTAL Art 26 of the SIS II Decision 5 777 8 774 11 156 25 707 Art 24 of the SIS II Regulation 22 702 25 888 30 501 79 091 Art 32 of the SIS II Decision 2 667 3 961 5 713 12 341 Art 34 of the SIS II Decision 18 068 31 255 34 511 83 834 Art 36 of the SIS II Decision 14 169 23 942 34 313 72 424 Art 38 of the SIS II Decision 23 439 34 115 40 253 97 807 Total 86 822 127 935 156 447 371 204 Note: In this report when counting hits, the figures used are those reported by Member States on hits achieved on their individual territories on alerts issued by another Member State. This provides the most reliable data. Due to the entry into operations of SIS II on 9 April 2013, the figures for 2013 are part-year figures. Accordingly, percentage increases will only be calculated on the difference between 2014 and 2015 in order to avoid distortion. The raw figures for the 267 days of 2013 when SIS II was running have been provided. 6.4 Main identities, aliases and misused identities There was an increase in the total number of all identities. Given the overall fall in the total number of alerts on persons and a 3 % drop in main identities, this figure indicates an increase in the use of additional identities. These are either an alias (a false identity) or a misused identity (a potentially innocent person’s real identity being misused by another person; although it has been known for co-conspirators to re-use one identity, based on the availability of documents for unlawful use). The number of aliases increased by almost 19 %. 2014 2015 Main identities 756 391 737 515 Alias 244 272 290 443 Misused identities 115 142 TOTAL 1 000 778 1 028 090

6.5 Authorities having a right to access alerts Access to data entered in SIS II and the right to search such data directly or in a copy of SIS II data is reserved to the authorities responsible for border control, other law enforcement and customs checks carried out within the Member State concerned, and the coordination of such checks by designated authorities. National judicial authorities, including those responsible for launching public prosecutions in criminal proceedings and for judicial inquiries prior to charge, may also access these data in carrying out their tasks, as provided for in national legislation, as can their coordinating authorities. The right to access and directly search data entered in SIS II and data on documents relating to persons entered in accordance with Article 38(2)(d) and (e) of the SIS II Decision may be exercised by: the authorities responsible for issuing visas; the central authorities responsible for examining visa applications and the authorities responsible for issuing residence permits and administering legislation relating to third-country nationals when applying the EU acquis relating to the movement of persons. The use of SIS II by customs authorities varies. A questionnaire sent out on 11 January 2016 to the experts on the SISVIS Committee showed that, in most Member States, customs officers have read-only access to SIS II. In many Member States, SIS II is mainly used within the course of a customs-related criminal investigation. SIS II is not systematically consulted by customs officers performing surveillance and customs control tasks. Checks against the SIS II are only carried out manually. No Member State applies automated processes for cross-checking customs information systems with SIS II, even though it is clear that some categories of object alerts (such as containers, vehicles, firearms, boat engines and industrial equipment) fall largely within the competence of customs control at the external border. There is significant EU added value to the transparency requirement for Member States to forward to eu-LISA for publication the list of national authorities empowered to search and insert alerts to SIS II, as it facilitates the rights of individuals to access their data and allows the monitoring of the purpose limitation of those authorities. 6.6 Institutional users: eurojust and europol Eurojust and Europol are granted access to SIS II data under Article 41 of the SIS II Decision (Europol) and Article 42 (Eurojust). Europol has access to alerts under the following Articles: 26 — alerts for arrest; 36 — alerts for discreet and specific checks; 38 — objects sought for the purposes of seizure or use as evidence in criminal proceedings.

Eurojust has access to alerts under the following Articles: 26 — alerts for arrest; 32 — alerts on missing persons; 34 — persons sought to assist with a judicial procedure; 38 — objects for seizure or use as evidence in criminal proceedings. Both agencies can carry out queries in the central SIS II, but neither has a copy of SIS II data. Equally, neither agency can create alerts in SIS II. The two agencies are not covered by the evaluation framework on the use of SIS II. Therefore, in order to assess use of the system the Commission carried out a fact-finding visit. The findings are set out in a specific section of Annex 1. 7.Review of the application of alerts for the refusal of entry or stay under Article 24 and 26 sis ii Regulation 7.1 A brief overview This category of alert is only applicable to third-country nationals. Where a competent court or authority has decided that a third-country national should not be allowed to enter or stay in the Schengen territory (generally for criminal, state security or migration/visa irregularity reasons), the authority either must or may enter an alert in SIS II with EU/Schengen-wide effect. Upon a hit, the person will be refused entry at the external border or will be removed from the Schengen area if found on the national territory of any Member State. Due to the duration of the refusal of entry or stay, this category of alert is retained in SIS II after a hit as the ban is still active up to its date of expiry. Article 24(2) and (3) describe the two grounds for issuing an alert: Article 24(2) relates to third-country nationals who pose a threat to public or national security, whereas Article 24(3) relates to third-country nationals who have not complied with immigration legislation. Article 26 of the SIS II Regulation establishes that SIS II must also contain alerts relating to third-country nationals who are the subject of a restrictive measure. Alerts under Article 24 are only used by the 26 EU Member States which are part of the Schengen area without internal border controls. Romania and Bulgaria are allowed to see but not to enter refusal of entry alerts and they are not obliged to give effect to alerts issued by other MS. The UK receives a notification of refusal of entry alerts issued by other Member States if it wants to create an alert on the same person which would be incompatible with an existing refusal of entry alert. The number of alerts has decreased since SIS II began operating, falling from 623 203 (31 December 2013) to 492 727 alerts (31 December 2015) – a decrease of 21 %. The reasons for this decrease are that certain Member States have regularised many of the third-country nationals who were subject of a refusal of entry alert and they granted them residence permits. Other Member States have started with a systematic quality control targeting this specific alert category as it happened that several authorities in the same Member State created a refusal of entry alert on the same person as they did not consult the system or were negligent. Alerts in SIS II 2013 2014 2015 Third-country nationals to be refused entry or stay into the Schengen Area 623 203 547 492 492 727 Hits 2013 2014 2015 22 702 25 888 30 501 In accordance with Appendix 5 of the SIRENE Manual the following are considered a hit for refusal of entry alerts: (a)refusals of entry at the external border as a result of a foreign alert;

(b)following a hit on a foreign alert for refusal of entry under Article 24, refusals to issue a short-stay visa (including at embassies and consulates) or a residence permit, withdrawals of a residence permit or a long-stay visa. 7.2 Key themes emerging Legal aspects An alert for refusal of entry issued by one Member State applies throughout the Schengen area. The legal consequences of the presence of the alert in SIS II within the context of border checks on persons are laid down in two other EU instruments that are part of the Schengen acquis: Schengen Borders Code (SBC): the existence of an alert in SIS II for the purposes of refusing entry is a ground for refusing entry to the Schengen area, in accordance with Article 6(1)(d) and 14(1) of the SBC. Consultation of SIS II is therefore a mandatory part of the entry border checks on third-country nationals, as set out in Article 8(3)(a)(vi) of the SBC. Visa Code: Article 32(a)(v) of the Visa Code states that a short stay visa shall be refused to a person for whom an alert has been issued in SIS II for the purpose of refusing entry. The EU-wide effect of the alerts is not unconditional as, in particular circumstances, a person subject to a refusal of entry alert may still be allowed to enter. These circumstances include: Article 32 (1) of the Visa Code establishes that a visa with limited territorial scope may be issued despite the existence of a refusal of entry alert, on humanitarian grounds, for reasons of national interest or because of international obligations. Article 6(5)(a) of the SBC allows Member States to authorise transit for a person subject to an alert who holds a residence permit or long stay visa issued by another Member State. In this situation, a consultation procedure should be initiated under Article 25(2) of the Schengen Implementing Convention. The Member States that issue the alert nevertheless retain the right to include the third-country national on their national list of alerts and to refuse him/her entry at their external borders. Article 6(5)(c) of the SBC provides that a Member State may, despite the alert, authorise a person to enter its territory on humanitarian grounds, on grounds of national interest or because of international obligations. In these cases, consultation with the Member State(s) that issued the alert is not required but the latter must be informed by the Member State authorising the entry. There is no EU legislation laying down the EU-wide effect of a refusal of entry or stay alert for third-country nationals who are staying on a Member State's territory. This might result from several situations: A third-country national is staying illegally on a Member States territory and is the subject of an alert in SIS II. In accordance with Article 6(1) of the Return Directive, a return decision needs to be issued. However, the executing Member State may grant the person the right to stay in accordance with Article 6(4) of the Return Directive for compassionate, humanitarian or other reasons. In this case, Article 25(1) of the Schengen Implementing Convention (SIC) applies. It states that that where a country considers issuing a residence permit to a third-country national for whom an alert has been issued for the purposes of refusing entry, it must first consult the country that has issued the alert and take account of its interests. The residence permit can only be issued for serious reasons, in particular cases of a humanitarian nature or arising from international obligations. Where the Member State decides to grant a residence permit, the other Member State must withdraw its SIS II alert but may nevertheless put the person in question on its national list of alerts. A third-country national is staying illegally on a Member State territory but holds a residence permit issued by another Member State. In accordance with Article 6(2) of the Return Directive, the executing Member State shall require the person to go back to the Member State that issued the residence permit or authorisation to stay, unless the person’s immediate departure is required for reasons of public policy or national security. In case of non-compliance, the executing Member State shall issue a return decision in accordance with Article 6(1) of the Return Directive. Article 25(2) of the SIC applies when the person is subject to a return decision, while holding a residence permit or other authorisation to stay from another Member State, and an alert for refusal of entry or stay is issued. This Article states that the country issuing the alert must consult the country which issued the residence permit to determine whether there are sufficient reasons for withdrawing the residence permit. If the residence permit is not withdrawn, the country issuing the alert must withdraw the alert but may nevertheless put the person in question on its national list of alerts. A third-country national is the subject of an alert in SIS II but holds a residence permit issued by the Member State where he is staying. In this case the Return Directive does not apply, as the person is not staying illegally on the Member State territory. Article 25(2) of the SIC applies in this situation and the consultation procedure described in the previous bullet point needs to be carried out. The decision to grant a residence permit always takes priority over the decision to issue an alert for refusal of entry or stay as, in all situations under Article 25 of the SIC, the alert needs to be withdrawn if it is decided to allow the residence permit to continue. This obviously has an impact on the alert's effectiveness. Lack of comprehensive statistics - effectiveness A lack of comprehensive EU-wide statistics makes it difficult to assess the effectiveness of Article 24. Hit numbers cover situations in which the alert has taken effect, but not the situations in which entry was allowed or a right to stay was granted despite the existence of an alert. Furthermore, there is no distinction in the statistics between hits achieved during an application process for a visa, at an external border or on the Member State territory. Member State statistics collected by Eurostat in 2014 show that 12 205 third-country nationals were refused entry on the basis of an alert in SIS II in 2014. The overall hit number for 2014 was 25 888. This might indicate that fewer than half the hits occur at an external border.

Cases in which the required action was not taken The measure's effectiveness can be partly demonstrated using SIRENE G and H forms. A ‘G form’ is sent when the required action is taken in the event of a hit. An ‘H form’ is sent when the action was not taken (either at the external border or within the territory). However, the figures relating to the forms unfortunately do not disclose a complete picture as Member States may choose not to be informed about hits on their Article 24 alerts. Therefore, the number of G forms sent does not correspond to the number of hits reported and the number of H forms does not reflect the total number of cases where the action was not taken at entry or on the territory. 2014 2015 Number of outgoing G forms 11 623 12 007 Number of outgoing H forms 7 056 7 264 Total 18 679 19 271 In both years, G forms accounts for approximately 60 % of cases and H forms account for approximately 40 %. This can be used as an indication of the ratio of cases where the alert has taken effect in comparison to the cases where the alert has not taken effect. The table below demonstrates that, in comparison with other alert categories on persons, the number of H forms compared to the number of G forms is very high – i.e. that the number of cases where action is not taken is comparatively high with this kind of alert. 2015 Alert for refusal of entry Alert for arrest Alert on missing person Alert for discreet or specific check Alert for judicial procedure G forms sent 12 007 62 % 9 804 96 % 4 923 94 % 24 027 99 % 26 200 99 % H forms sent 7 264 38 % 450 4 % 337 6 % 233 1 % 270 1 % Total 19 271 10 254 5 260 24 260 26 470 The simultaneous increase in the number of G forms and H forms in 2015 may indicate that the increase in the number of hits in 2015 is not due to improved effectiveness but rather to an increase in the number of checks and improved data quality for Article 24 alerts leading to more positive matches. Use of the consultation procedure - effectiveness, efficiency and coherence/consistency - Article 25 of the SIC sets out a mechanism for ensuring that Member States consult each other and take into account each other’s assessment when deciding whether to grant a residence permit and for avoiding situations in which an alert co-exists with a valid residence permit. Article 25(1) sets out the process to follow if an alert exists in SIS II but another Member State is considering granting a residence permit. Article 25(2) sets out the process if an alert has been issued for a person who already holds a valid residence permit. The table below shows the number of outgoing and incoming consultations reported by Member States within the context of an SIS II alert: 2014 2015 Number of outgoing consultations 5 945 6 043 Number of incoming consultations 6 884 6 608 Total 12 829 12 651 Note: the numbers do not completely tally as it may occur that one consultation is sent to several Member States. In an ad hoc query launched by the EMN at the request of the Commission, all Member States confirmed their use of the consultation procedure in cases falling under Article 25(1) of the SIC. Member States reported some examples of when they had used the consultation procedures through SIS II. Nine Member States out of 26 provided statistics on successful consultation procedures. The statistics include consultations made to other Member States and the replies sent to Member States who had made their own requests. These nine Member States reported a total of 5 352 successful consultation procedures. Statistics on the use of the consultation procedure should be considered in conjunction with statistics on the exchange of SIRENE N and O forms. In the SIRENE Manual the consultation procedure is implemented as follows: Procedure under Article 25(1): If a Member State that is considering granting a residence permit or visa discovers that the applicant concerned is the subject of an alert for refusal of entry or stay issued by another Member State, it shall consult the issuing Member State via the SIRENE Bureaux. The Member State considering granting a residence permit or visa shall use an N form to inform the issuing Member State about the decision to grant the residence permit or visa. If the Member State decides to grant the residence permit or visa, the alert shall be deleted. The person may, nevertheless, be put on the issuing Member State’s national list of alerts for refusal of entry. Procedure under Article 25(2): If a Member State that entered an alert for refusal of entry or stay finds out that the person who is the subject of the alert has been granted a residence permit or visa, it shall instigate a consultation procedure with the Member State that granted the residence permit or visa, via the SIRENE Bureaux. The Member State which granted the residence permit or visa shall use an O form to inform the issuing Member State about the decision whether or not to withdraw the residence permit or visa. If this Member State decides to maintain the residence permit or visa, the alert shall be deleted. The person can, nevertheless, be put on a Member State’s national list of alerts for refusal of entry. 2014 2015 Number of N forms sent = number of outgoing consultations under Article 25(1) SIC 5 277 4 666 Number of O forms sent = number of replies to consultations under Article 25(2) SIC 2 232 2 145 Total 7 509 6 811 These figures may indicate that: a)most consultations take place within the context of Article 25(1) of the SIC. This is confirmed by the replies to the ad hoc query by the EMN: 11 Member States reported mostly using the consultation procedure under Article 25(1) of the SIC, while 8 Member States reported applying mainly Article 25(2) of the SIC; b)in at least 5 000 cases per year, a Member State considered granting a residence permit despite the existence of an alert;

c) in at least 2 000 cases per year, there was a situation where a residence permit co-existed with a refusal of entry alert. This number may be much higher as an M form or H form may also be used in such cases. It should be noted that these figures do not cover the situation under Article 6(5)(c) of the SBC, where an H form will be sent if entry was granted despite the existence of an alert. Need for additional data in the alert to allow field officers to take the requested action - effectiveness In their replies to the questionnaire, several Member States mentioned as a weakness of the system that the information contained in the alert does not reflect the specific reasons it has been issued. The SIS II Regulation provides for four possible reasons: 1.Article 24(2)(a): ‘conviction’; 2.Article 24(2)(b): ‘security threat’; 3.Article 24(3): ‘illegal stay’; 4.Article 26: ‘restrictive measure’. It may also be useful to indicate whether an alert relates to a third-country national who has the right of free movement within the EU (Article 25 of the SIS II Regulation). Member States expressed the opinion that additional information in the alert would increase efficiency and allow quick and correct decision-making. The following responses to the questionnaire were received: Sub-division of the categories of alerts for refusal of entry, suggesting a clear distinction between refusals of entry based on: i) national security; ii) criminal reasons; iii) immigration law. Such a move would facilitate the gathering of statistics on reasons for refusals of entry and provide an indication to the officer on the ground of the background to a case when a hit is achieved. The inclusion of a remark on the underlying reason for a refusal of entry alert. The alert itself should hold the information of the basis of the decision underlying the alert, that is, a field indicating whether the alert was created due to criminal conviction, non-respect of visa/migration procedures, against a person benefiting from the right of free movement or due to restrictive measures. The importance of knowing whether the alert subject had been informed of the refusal of entry alert or not (when the person is in a third country it is not always feasible). A copy of the refusal of entry notice to be attached to the alert. More information in the alert to reduce exchange of supplementary information. The consultation procedure and delays in the exchange of information - efficiency - In their replies to the questionnaire and the EMN ad hoc query, Member States reported many flaws in the exchange of supplementary information and the consultation procedure. A key issue is the delay in receiving information from other Member States, including after a hit on the reason for the alert. Responses routinely do not arrive within the 12-hour deadline required by the SIRENE Manual. In order to be able to answer within the timeframe, SIRENE Bureaux should have direct access to the relevant national databases. Quality of information - effectiveness It is difficult to gather evidence to identify an individual (fingerprints, photos, copies of ID documents or residence permits) from other Member States. Documents provided in the system are sometimes not of good quality. This causes difficulty in identifying the third-country national, especially when names are written in other alphabets.

Difficulties with the consultation procedure - effectiveness and efficiency Member States reported specific operational difficulties with the SIC consultation procedure: Responses to consultation procedures do not provide enough detail, such as the reasons, validity and duration of the alert or of the residence permit/visa to be granted. Introducing common guidelines on the compilation of a response to consultation procedures may be useful. Requests to delete an SIS II alert after issuing a residence permit to the concerned individual are often not processed or are delayed by the competent Member State. There are cases where one Member State imposed an entry ban on a third-country national while another Member State had issued him/her a residence permit. Complexity of the N and O Schengen forms used in the consultation procedure. Revision of the forms used for consultation between the Member States would assist, as different procedures adopted by Member States in completing the forms cause delays and problems in consultation. Standardised procedures are already set out in the SIRENE Manual. Revising the N and O forms in line with harmonised procedures would also simplify the considerable workload of the SIRENE Bureaux in their role as a conduit for consultation. Similar issues were reported to the EMN for the purpose of the 2014 study. In one Member State, authorities have experienced problems when wanting to impose an entry ban on an individual who poses a risk to public security, but who holds a residence permit in another (Member) State. In these cases, information provided does not always lead to withdrawal of the residence permit. Lack of harmonisation in the deadlines for the consultation procedure - effectiveness, efficiency and coherence/consistency - Long waiting periods for responses are experienced by most Member States, even after several reminders. This may delay administrative procedures for issuing residence permits. A binding response time for consultation procedures would assist. An example of two weeks was given. Member States have different provisions with regard to deadlines for consultation procedures through SIS II. Most of them do not provide for a deadline. However, some Member States reported that the reply to a consultation procedure is normally expected within a short timeframe. One Member State sets a limit of 24 hours. Only a few Member States set deadlines for SIS II consultation procedures, either by law or by administrative practice. Some of them set a deadline for replies to launched consultations corresponding to the deadline in the procedure to issue a residence permit. One Member State replied that responses to consultation requests are sent within 24 hours. Finding new models for the exchange of supplementary information - effectiveness and efficiency In many Member States the immigration authorities are the competent authorities for issuing, updating and deleting refusal of entry or stay alerts. They also take decisions on the return and removal of third-country nationals apprehended on the Member State territory. The exchange of supplementary information (notification of a hit, request for supplementary information to confirm the identity of a person etc.) between Member States takes place via the SIRENE Bureaux, which are usually situated within the structure of the police authorities. As a consequence, when information is being exchanged on Article 24 alerts, the SIRENE Bureaux function mainly as letter boxes between the relevant immigration authorities. This brings two major risks: (1) unnecessary delays in information exchange (as the information source is outside SIRENE control) and, as a result, the decision-making process; (2) a loss of efficiency of SIRENE communication could cause other channels of communication to be used. The Commission launched a study on the use of SIS II for return purposes. One of the tasks carried out in the study was to analyse two models for organising the exchange of information on migration-related SIS II alerts more efficiently and allowing immigration authorities to be directly involved. In the study, two models were examined: seconding migration officers to the SIRENE Bureau (model A); or setting up a separate single point of contact (SPOC) (model B). The main findings of the study were: (a)Costs would be higher for model B. The model would require the implementation of new infrastructure(s), including IT, while model A would require only minor changes to the current infrastructure and IT system; (b)As model B would require new infrastructure, it would probably take more time to implement than model A; (c)If model B were chosen, field officers would need to determine which of the two coordinating authorities (SIRENE Bureau or new migration SPOC) should be contacted.

Member States did not express a clear preference for either of the proposed models, as any preference will depend on the division of responsibilities at national level. 7.3 Inconsistency with the Return Directive – coherence/consistency The Return Directive provides the EU with common standards and procedures for returning persons staying illegally on Member States territories. It determines that Member States may not tolerate third-country nationals staying illegally on their territory but must either issue a return decision or grant them a right to stay. A return decision is sometimes accompanied by an entry ban, prohibiting entry into or stay on EU territory for a specified period. An entry ban is always issued if: (1) no period of voluntary return has been granted, or (2) the person has not complied with the return decision within the granted period of voluntary departure. In other situations, an entry ban is optional. Entry bans issued under the Return Directive have EU-wide effect and are binding on all Member States bound by the Return Directive. The length of entry bans issued under the Return Directive is determined on a case-by-case basis but must not exceed five years, unless the person represents a serious threat to public policy, public security or national security. If that is the case, entry bans issued under the Return Directive may exceed five years. An entry ban forms the basis for issuing a refusal of entry or a stay alert in SIS II. There are links but also inconsistencies between the SIS II Regulation and the Return Directive: Article 24 of the SIS II Regulation has a broader scope than the entry bans under the Return Directive According to the Return Directive, an entry ban relates to third-country nationals who have stayed illegally on a Member State's territory, and is always linked to a return decision. A refusal of entry alert under Article 24 (2) of the SIS II Regulation, on the other hand, may also cover third-country nationals who are not present on the Schengen territory. The Return Directive also offers, in Article 2(2), the option of not extending its provisions to: (a)third-country nationals who are the subject of a refusal of entry in accordance with Article 13 of the SBC, or who are apprehended in connection with irregular border crossing and (b)third-country nationals who are subject to a removal procedure as a criminal law sanction under domestic law. There are no clear links between both instruments, in either the Return Directive or the SIS II Regulation Recital 18 of the Return Directive states that Member States should have rapid access to information on entry bans issued by other Member States and that this information-sharing should take place in accordance with the SIS II Regulation. Recital 14 of the Return Directive makes clear that entry bans have a European dimension, as they should prohibit the entry into and stay on the territory of all Member States. There is no obligation laid down in the Return Directive to enter all entry bans in SIS II, thereby causing incoherence with the goal of the measure. Legally and practically, an entry ban can only be effective in other Member States if accompanied by a SIS II alert The entry ban can only achieve its EU-wide effect if it is inserted as a refusal of entry or stay alert in SIS II, as only the alert – not the decision itself – forms the basis for refusing entry in accordance with the SBC or for refusing a short stay visa in accordance with the Visa Code (see above). A complication occurs when considering the geographical scope of the Return Directive and the SIS II Regulation. All Member States and Associated Countries participating in the provisions of the Schengen acquis are bound by the Return Directive, and the SIS II Regulation. There is, however, a particular situation in Romania, Bulgaria, Cyprus and Croatia. These EU Member States already apply the provisions of the Return Directive but they are not yet part of the border-free Schengen area. This means that they cannot issue any alerts in SIS II for refusal of entry or stay. These Member States cannot create EU-wide entry bans through SIS II. There is no obligation in the Return Directive to enter all entry bans as an alert in SIS II The SIS II Regulation only requires an alert to be issued in some circumstances: when the underlying decision is based on a threat to public policy, public security or national security (Article 24(2)) an alert is required (subject to the general proportionality principle of SIS II); if the decision is based on non-compliance with immigration legislation (Article 24(3)) there is no such requirement. In their 2014 study, the EMN came to the conclusion that ‘not all (Member) States systematically enter an alert into the SIS following the imposition of an entry ban. If not informed about the entry ban imposed on a specific individual, (Member) States will not be able to ban entry of that individual into EU territory. The entry ban thereby essentially loses its effect and will in practice only apply to the territory of the (Member) State that imposed it.’. The evaluation of the application of the Return Directive (October 2013) concluded that ‘almost all Member States register every entry ban decision in SIS. However, there are a few exceptions. According to a government body, there is some variation among different police districts. In some police districts the entry bans are not systematically registered in SIS. Moreover, in another Member State not all entry ban decisions are registered in SIS. In another Member State, entry bans are issued on a national level and also on a Schengen level. Only those entry bans that are applicable to the whole Schengen area are registered in SIS.’ The maximum retention period of a refusal of entry or stay alert in SIS II does not correspond to the maximum length of an entry ban issued in accordance with the Return Directive Alerts can be retained for three years, whereas an entry ban lasts for up to five years (and potentially longer in cases of threats to public policy, public security or national security). A SIS II alert may be prolonged after a re-assessment. The maximum retention period set out in the SIS II Regulation should be harmonised with the length of an entry ban in the Return Directive. There is an inconsistency in terminology between the Return Directive and Article 24 of the SIS II Regulation

An entry ban is defined in Article 3(6) of the Return Directive as an administrative or judicial decision or act prohibiting entry into and stay on the territory of the Member States for a specific period, accompanying a return decision. Article 24 on the other hand covers alerts for the purpose of refusing entry or stay. The Return Directive does not include provisions on direct enforceability of alerts for refusal of entry or stay The same conclusion was reached in the feasibility study on creating a new alert category in SIS II for return decisions. The study concluded, among other issues, that the EU-wide follow-up and enforcement of return decisions and entry bans could more successfully be achieved with a system of mutual recognition of return decisions and entry bans. 7.4 Lack of harmonisation when entering entry bans in SIS II - effectiveness and coherence/consistency When considering the grounds for issuing alerts laid down in Article 24, a distinction should be made between alerts relating to third-country nationals who pose a threat to public or national security (Article 24(2)) and alerts relating to third-country nationals who have not complied with immigration legislation (Article 24(3)). There is limited quantitative data available on the volume of alerts split along these lines, due to the fact that the alert itself does not contain this information. In the EMN query, only five Member States reported making a distinction between these categories in their national statistics. Member States reported the following issues with registering entry bans in SIS II: Not all Member States systematically register all entry bans in SIS II An entry ban is intended to have an EU-wide effect and the only way of achieving this effect is to enter the ban in SIS II. One Member State pointed out that the wording of Article 24 (3) is unhelpful in that it proposes that an alert ‘may’ be entered. Different national interpretations of this text have resulted in some Member States entering alerts whilst others do not, even though this negates the EU-wide effect. The text should be modified to ‘an alert shall be entered’. There are different practices with regard to the timing of registration of entry bans in SIS II In eleven Member States, entry bans can only be registered in SIS II once the decision is final or immediately enforceable. Three Member States also require that the person leaves the territory before recording the entry ban. In another Member State, the decision imposing the entry ban may be registered in SIS II and enforced before it is final and non-appealable, if the third country national does not have the right to stay during the appeals process, e.g. because s/he did not have a residence permit prior to the decision or because s/he represents a danger. In contrast, in six Member States, entry ban alerts are inserted in SIS II as soon as the decision is taken, without it needing to be final or enforceable. If the decision is repealed by the competent national authority or reviewed by a court, the alert will be also deleted from the SIS II. As explained above, an entry ban only can have EU-wide effect from the moment it is entered as an alert in SIS II. Therefore, the moment of registration in SIS II should coincide with the moment the entry ban is enforceable. 7.5 Entering travel bans constituting a restrictive measure in SIS II - effectiveness and coherence/consistency Travel bans constituting a restrictive measure adopted as Council Decisions, including those issued by the United Nations, are given effect via the creation of a refusal of entry alert in SIS II. In accordance with Article 26(3) of the SIS II Regulation and section 4.1 of the SIRENE Manual, alerts are created in SIS II by the Member State holding the Presidency of the Council of the EU. This Member State is also responsible for updating and deleting the alert as required. There are several practical problems with this, including: Data quality. Travel bans are entered in SIS II using the personal data set out in in the Annex to the relevant Council Decision. Usually it contains last name, first name, date of birth and place of birth, but sometimes the data available are not sufficient to enter an alert in SIS II (for example, if only the name of the person, or even an alias, is known). If this happens, the travel ban cannot be entered in SIS II, as the technical rules do not allow an alert to be created for a person without at least a last name and a year of birth. However, the SIS II Regulation waives the minimum data quality requirements for these alerts and so there is an inconsistency between the legal basis and the technical possibilities, even though such minimal data will not lead to hits. Alerts created on the basis of only a name are not effective, as they do not provide sufficient information to identify a person. In these cases, Member States should include as much as data as possible (such as photographs) in the alert in order to ensure that the travel ban can have effect. Lack of coordination. Each Member State is responsible for creating, updating and deleting alerts relating to restrictive measures adopted during the period of its presidency. Due to the six monthly rotation of presidencies, there is no centralised responsibility. Some Member States proposed a centralised solution for creating and following-up these alerts. 7.6 Creation of a European Border and Coast Guard Agency On 14 September 2016, the European Parliament and the Council adopted the Regulation on a European Border and Coast Guard Agency establishing a European integrated border management and significantly strengthening the mandate of Frontex, renaming it a European Border and Coast Guard Agency. The enhanced Agency will have expanded tasks and responsibilities, including the possibility to deploy European Border and Coast Guard Teams on a Member State’s territory in case of an urgent situation and will have a stronger role in the return of irregular migrants. Within the scope of these competences, the Agency will need access to refusal of entry and (future) return decision alerts in SIS II. 7.7 Conclusions There are many situations in which a Member State may decide to grant a person the right to enter into or stay on the territory despite the existence of an Article 24 alert issued by another Member States. As a consequence, the EU-wide effect of alerts is not systematically achieved. Furthermore, despite the obligation to enter refusal of entry alerts in the SIS, the EU-wide effect of these alerts is not systematically achieved. .This limits the EU added value of the measure, as the Return Directive does not include provisions to directly enforce alerts for refusal of entry or stay.

Incomplete statistics mean there is a lack of transparency on the effectiveness of the measure. An analysis of the G and H SIRENE forms demonstrates that refusal of entry or stay is the least effective alert category among alerts on persons. The alert achieved its effect in just 60 % of cases, whereas for other alert categories on persons, this is true in more than 90 % of cases. There is a lack of comprehensive statistics on the use of the consultation procedure. However, it may be deduced that most consultation take place within the context of Article 25(1) of the SBC and that there are, on an annual basis, at least 2 000 cases in which a residence permit coexists with a refusal of entry or stay alert. It is very difficult to avoid these situations as, in many cases, the Member State issuing the alert may even not be aware of the existence of a residence permit due to the lack of an EU-wide system. Member States reported shortcomings in the processes for and quality of information exchange on alerts for refusal of entry or stay, especially in the context of the consultation procedure. These flaws highlight a significant procedural weakness as the deadline for all other forms of SIRENE response is twelve hours. It is clear that the lack of harmonisation in consultation processes and tardy responses cause operational staff and the individual concerned considerable problems. In some cases, the need to exchange supplementary information through the SIRENE Bureaux may be removed by adding additional data to the alert itself, leading to more efficient and reliable identification and decision-making processes. There are links but also inconsistencies between the pro