(4)

In Point VII, point 1 shall be replaced by the following text: ‘1.A Organisation of the reception and processing of visa applications Each Member State shall be responsible for organising the reception and processing of visa applications. For each location, Member States shall either equip their consular office with the required equipment for capturing/collecting biometric identifiers or, without prejudice to the abovementioned representation options, decide to cooperate with one or more other Member States. Any cooperation shall take the form of co-location or the establishment of a Common Application Centre or , where these are inappropriate, cooperation with external service providers. (a) Where “co-location” is chosen, the staff of the diplomatic posts and consular missions of one or more Member States shall process the applications (including biometric identifiers) addressed to them at the diplomatic post and consular mission of another Member State and share the equipment of that Member State. The Member States concerned shall agree on the duration and conditions for the termination of the co-location as well as the proportion of the administrative fee to be received by the Member State whose diplomatic post or consular mission is being used. Applicants shall be directed to the Member State responsible for the processing of the visa application. (b) Where “Common Application Centres” are established, the staff of the diplomatic posts and consular missions of two or more Member States shall be pooled in the building of a Member State enjoying diplomatic or consular protection under international law or in a European Commission building recognised by the host State as inviolable in order to receive the visa applications (including biometric identifiers) addressed to them. Applicants shall be directed to the Member State responsible for the processing of the visa application. Member States shall agree on the duration and conditions for the termination of such cooperation as well as the cost sharing among the participating Member States. One Member State shall be responsible for contracts in relation to logistics and diplomatic relations with the host country. (c) Cooperation with external service providers in accordance with 1.B. 1.B Cooperation with external service providers If, owing to particular circumstances or reasons relating to the local situation of the consular post , it is not appropriate to equip the consular office for capturing/collecting biometric identifiers or to organise co-location or a Common Application Centre, one or several Member States jointly may cooperate with an external service provider for the reception of visa applications (including biometric identifiers). In such a case, the Member State(s) concerned shall remain responsible for the processing of the data and therefore liable for any breaches of contract, and in particular for compliance with data protection rules for the processing of visa applications. Those Member State(s) shall ensure that an external service provider under Point VII, point 1.B.1 point b, undertakes its activities on the premises of a Member State which enjoy diplomatic or consular protection under international law or on European Commission premises recognised by the host State as inviolable, and that qualified and duly authorised staff of the diplomatic mission or consular post of the Member State(s) are present to closely supervise the activities of the external service provider. 1.B.1 — Types of cooperation with external service providers Cooperation with external service providers shall take [one of] the following form[s]: (a) the external service provider shall act as a call centre providing general information on the requirements for applying for a visa and be in charge of the appointment system; (b) the external service provider shall provide general information on the requirements for applying for a visa, collect applications, supporting documents and biometric data from visa applicants and collect the handling fee (as provided for by Part VII, point 4, and Annex 12), transmit the completed files and data to the diplomatic mission or consular post of the Member State competent for the processing of the application and return the passport to the applicant or to the applicant's legal representative at the end of the procedure . 1.B.2 — Obligations of Member States In compliance with Directive 95/46/EC, the Member State(s) concerned shall select an external service provider which is able to ensure a high quality of service and all the technical and organisational security measures necessary to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network as well as the reception and transmission of files and data to the consular post, and against all other unlawful forms of processing. When selecting external service providers, Member States’ diplomatic missions or consular posts shall scrutinise the solvency and reliability of the company (including necessary licences, commercial registration, company statutes, bank contracts and shall ensure there is no conflict of interests. The diplomatic missions or consular posts of the Member States shall ensure that the company selected offers relevant professional expertise in information assurance and data security. Member States should follow best procurement practices in contracting external visa support services. External service providers shall not have access to the VIS for any purpose. Access to the VIS shall be reserved exclusively to duly authorised staff of diplomatic missions or consular posts solely for the purposes laid down in the VIS Regulation . The Member State(s) concerned shall conclude a written contract with the external service provider in accordance with Article 17 of Directive 95/46/EC. Before concluding such a contract, the diplomatic mission or consular post of the Member State concerned shall justify, with reasons in accordance with Point VII, point 1.B, the need for the contract with the diplomatic missions and consular posts of other Member States and the Commission delegation within local consular cooperation . In addition to the obligations set out in Article 17 of Directive 95/46/EC, the contract shall also contain provisions which: (a) define the exact responsibilities of the service provider; (b) require the service provider to act under the instructions of the responsible Member States and to process the data only for the purposes of processing of personal data of visa applications on behalf of the responsible Member States in compliance with Directive 95/46/EC; (c) require the service provider to provide applicants with the information required under Article 37 of the VIS Regulation; (d) require the service provider to ensure that its staff are appropriately trained and respect the rules laid down in Point III, point -1; (e) require the service provider to adopt appropriate anti-corruption measures; (f) require the service provider to report to the responsible Member State without delay any security breaches or any other problems; (g) require the service provider to record any complaints or notifications from applicants on data misuse or unauthorised access. The external service provider shall inform the responsible Member State's diplomatic mission or consular post without delay and coordinate with them in order to find a solution. Complaints shall be handled in such a way as to ensure that explanatory responses are given to visa applicants promptly; (h) provide for access by consular staff to the premises of the service provider at all times; (i) require the service provider and its staff to observe rules of confidentiality which shall also apply once the staff have left the employ of the external service provider or after the suspension or termination of the contract; (j) ensure data protection compliance, including reporting obligations, external audits, regular spot checks by, inter alia, national data protection authorities, and that mechanisms are in place for the apportionment of the liability of a contractor in the event of a breach of the regulations on privacy, including the obligation to compensate individuals where they have suffered damage resulting from an act or omission of the service provider; (k) require the service provider to transmit without delay the completed file to the diplomatic mission or consular post of the Member State responsible for the processing of the application and not to copy, store, or otherwise retain any data collected after the transmission; (l) require the service provider to prevent any unauthorised reading, copying, modification or deletion of visa data during the transmission from the service provider to the diplomatic mission or consular post of the Member State responsible for the processing of the application, in particular by means of appropriate encryption techniques; (m) contain a suspension and termination clause; (n) contain a revision clause with a view to ensuring that contracts reflect best current practices; (o) lay down rules on the conduct of the staff responsible for handling visa applications and for collecting biometric data with maximum respect for human dignity. Any measure taken when carrying out those duties shall be proportionate to the aims of that measure. In processing the application, staff shall avoid any discrimination among persons on grounds of sex, racial or ethnic origin, religion or belief, disability, age or sexual orientation. A model contract shall be established within local consular cooperation. Member States shall ensure that there is the least possible service disruption for visa applicants in the event of the external service provider suddenly ceasing to provide the services required under the contract. The Member State(s) concerned shall cooperate closely with the external service provider and shall closely monitor the implementation of the contract, including: (a) the general information provided by the service provider to visa applicants; (b) the technical and organisational security measures and appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing, as well as the reception and transmission of files and data to the diplomatic mission or consular post; (c) the capturing and transmission of biometric identifiers; (d) the measures taken to ensure compliance with data protection and data security provisions as well as measures against corruption. The fee paid by the applicant shall not exceed the fee set out in Annex 12, irrespective of whether Member States cooperate with external service providers. Member States shall ensure that a procedure is in place allowing for the identification of the external service provider handling any visa application. The consular staff of the Member State(s) concerned shall give training to the service provider, corresponding to the knowledge needed to offer appropriate service and sufficient information to visa applicants. 1.B.3 — Information Member States and their diplomatic missions or consular posts shall provide the general public with all relevant information in relation to a visa application, including: (a) the criteria, conditions and procedures for applying for a visa; (b) the means of obtaining an appointment, if applicable; (c) where the application should be submitted (competent diplomatic mission or consular post, common application centre or external service provider). This information to the general public shall also be available through a common Schengen visa internet site. That site shall be established in order to further support the application of the common visa policy and the handling of the visa procedure. 1.B.4 — Information Campaign Shortly before the VIS is brought into operation in a third country, the diplomatic missions or consular posts of Member States together with the delegation of the Commission shall launch a campaign informing the general public about the objectives pursued, the data stored in, and the authorities having access to, the VIS, and the rights of visa applicants. Such campaigns shall be conducted regularly. 1.C Maintenance of direct access for applicants to Member States diplomatic missions and consular posts Irrespective of the type of cooperation chosen, Member States may decide to maintain the possibility of allowing applicants direct access to lodge an application for a visa directly at the premises of their diplomatic missions or consular posts. Member States shall ensure the continuity of reception and processing of visa applications, in the event of the sudden termination of cooperation with other Member States or any type of external service provider. 1.D Decision and publication Member States shall inform the Commission of how they intend to organise the reception and processing of visa applications in each consular location. The Commission shall ensure appropriate publication on the common Schengen visa internet site . Member States shall provide the Commission with the contracts they conclude. 1.E General responsibilities 1.E.1 Documents Any document, data or biometric identifier received by, or on behalf of, a Member State in the course of a visa application shall be considered a “consular document” under the Vienna Convention on Consular Relations and shall be treated in an appropriate manner. 1.E.2 Training Before being authorised to take biometric identifiers, the staff of the diplomatic mission or consular post shall receive appropriate training so as to ensure smooth and professional enrolment. 1.E.3 Liability Any person who, or Member State which, has suffered damage as a result of an unlawful processing operation or any act in breach of this Regulation shall be entitled to receive compensation from the Member State which is responsible for the damage suffered. That Member State shall be exempted from its liability, in whole or in part, if it proves that it is not responsible for the event giving rise to the damage. Claims for compensation against a Member State for the damage referred to in the previous subparagraph shall be governed by the provisions of national law of the defendant Member State. 1.E.4 Penalties Member States shall take the necessary measures to ensure that any breach of this Regulation, in particular any misuse of data submitted for a visa application is punishable by penalties, including administrative and/or criminal penalties in accordance with national law, that are effective, proportionate and dissuasive .’