EUROPEAN COMMISSION Brussels,16.5.2018 SWD(2018) 195 final COMMISSION STAFF WORKING DOCUMENT



IMPACT ASSESSMENT

Accompanying the document Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EC) No 767/2008, Regulation (EC) No 810/2009, Regulation (EU) 2017/2226, Regulation (EU) 2016/399, Regulation XX/2018 [Interoperability Regulation], and Decision 2004/512/EC and repealing Council Decision 2008/633/JHA {COM(2018) 302 final}



{SWD(2018) 196 final}



Table of contents 1.Introduction: Political and legal context 1.1.Visa Information System and the security of the Schengen area 1.2.Closing the information gap on long-stay visas and residence documents 1.3.The VIS setup 1.4.VIS REFIT Evaluation 1.5.Consequences for the VIS 2.Problem definition 2.1.What are the problems? 2.2.What are the problem drivers? 2.3.How will the problem evolve? 3.Why should the EU act? 3.1.Legal basis 3.2.Subsidiarity: Necessity of EU action 3.3.Subsidiarity: Added value of EU action 4.Objectives: What is to be achieved? 4.1.General objectives of the revised VIS proposal 4.2.Specific objectives 5.What are the available policy options?

5.1.What is the baseline from which options are assessed? 5.2.Description of the policy options 5.3.Options discarded at an early stage 6.What are the impacts of the policy options? 6.1.Assessment of policy options 7.How do the options compare? 7.1.Copy of the travel document 7.2.Fingerprinting of minors 7.3.Long-stay visas and residence documents 7.4.Migration and security checks 8.Preferred options 8.1.Copy of the travel document 8.2.Fingerprinting of minors 8.3.Long-stay visas and residence documents 8.4.Migration and security 8.5.REFIT (simplification and improved efficiency) 9.How will actual impacts be monitored and evaluated? ANNEX 1: Procedural information ANNEX 2: Stakeholder consultation ANNEX 3: Who is affected and how?

Annex 4: REFIT Annex 5: Methodology Annex 6: Monitoring and Evaluation Annex 7: Executive Summary of the Study on Storing a Scanned Copy of the Visa Applicants' Travel Document in the Visa Information System (VIS) Annex 8: Executive Summary of the Study on Feasibility and Implications of Lowering the Fingerprinting age for Children 1.Analysis of the problems102 2.Objectives102 3.Policy options102 4.Assessment of impacts103 Annex 9: Executive Summary of the Legal Analysis on the Necessity and Proportionality of Extending the Scope of the Visa Information System (VIS) to Include Data on Long Stay Visas and Residence Documents107 1.Context of the study107 2.What is the problem?109 3.What are the objectives of the initiative?112 4.Why an EU action?112 5.What are the options to address the problem?113 5.Findings and conclusions of the study114 6.The way forward/what are the next steps118 Annex 10: Considerations on the Use of Biometric Data (topic 3)119 Annex 11: Available policy options overview (preferred option in bold)121





Glossary Term or acronym Meaning or definition CFR EU Charter of Fundamental Rights CVCA Country Verifying Certificate Authority ECRIS-TCN European criminal records information system regarding third country nationals and stateless persons EU European Union EDPS European Data Protection Supervisor EES Entry/Exit System EIS Europol data ESP European Search Portal ESPs External Service Provider eu-LISA European Agency for the operational management of Large-Scale IT Systems in the area of freedom, security and justice ETIAS European Travel Information and Authorisation System EURA EU readmission agreement FADO Database of False and Authentic Documents Online FRA EU Agency for Fundamental Rights GDPR General Data Protection Regulation HLEG High-level Expert Group IA Impact Assessment ICAO International Civil Aviation Organization JHA Justice and home affairs JRC Joint Research Centre LEA Law enforcement access LSV Long-stay visa MRTD Machine-readable travel document MS Member State OJ Official Journal PA Passive Authentication REFIT Regulatory Fitness and Performance Programme RC Residence card RP Residence permit SIRENE Supplementary Information Request at the National Entries – national single point of contact for SIS. SIS Schengen Information System SLTD Stolen and Lost Travel Documents database TCN Third-country national TD Travel document TDAWN Interpol's database of Travel Documents Associated with Notices VH Visa holder VIS Visa Information System



1.Introduction: Political and legal context 1.1.Visa Information System and the security of the Schengen area The abolition of checks at internal borders of the states forming part of the Schengen area is one of the most valued achievements of EU integration. To uphold this achievement and as a response to the increase of irregular migration to the EU and the threat to internal security, in recent years EU information systems for border management and security have been considerably strengthened, new ones are being developed, and the interoperability between them has been established with the aim of creating a framework for fast, seamless and systematic communication to face these challenges. The common visa policy for short-stay visas is one of the Schengen area's "flanking measures" (together with the harmonisation of the external border controls, enhanced cross-border police cooperation, and the creation of the Schengen Information System (SIS)) accompanying the establishment of a common area without checks at internal borders. The common visa policy encompasses a set of harmonised rules , allowing the Member States to mutually recognise short-stay visas issued. As stated in the Commission Communication on the Delivery of the European Agenda on Migration , the EU's common visa policy is not only an essential element to facilitate tourism and business, but also a key tool to prevent security risks and risks of irregular migration to the EU. Around 18 million applications for short stays are lodged with the Member States every year by nationals of the over 100 countries around the world under visa obligation, and more than 90% of them are issued a visa. In an area without internal border controls, the risk of irregular migration and the risk to security and public order of one Member State have an impact on the other Member States. This is why the decision to issue a visa is a decision taken by national authorities, who should take into account not only their own interests but that of all Member States. The VIS was established in 2004, following several calls by the Council to have a common system to store visa data and it is operational since 2011. By January 2018, data on more than 52 million visa applications, with 52.27 million facial-images and nearly 50 million fingerprint sets had been entered in the VIS. In line with the April 2016 Communication on Stronger and Smarter Information Systems for Borders and Security, the Commission proposed additional information systems in the area of border management. The Entry/Exit System (EES) Regulation will register entry, exit and refusal of entry information of third country nationals crossing the external borders of the Schengen area, thus identifying overstayers. The EES Regulation also amends the VIS Regulation and stipulates rules on interoperability between EES and VIS, establishing a direct communication channel between the two systems for the use of border and visa authorities. This will allow border authorities to verify the validity of the visa and the identity of a visa holder directly against the VIS at the external borders. Consular authorities will be able to consult the EES file of an applicant to verify the use made of previous visas. The Commission also presented a proposal for a European Travel Information and Authorisation System (ETIAS) aiming at a more efficient management of the EU’s external borders, and improved internal security by introducing advance checks on all visa-free travellers before their arrival at the external borders. In December 2017, the Commission presented a proposal to ensure interoperability between EU information systems for security, border and migration management. The proposal also seek to facilitate and streamline access by law enforcement authorities to non-law enforcement information systems at EU level including the VIS, where necessary for the prevention, investigation, detection or prosecution of serious crime and terrorism. However, ensuring various information systems are interoperable is only the first step. In order to make use of interoperability, concrete measures need to be taken to make interoperable IT systems work together. In addition to these legislative developments, in September 2017, the Commission Communication on the Delivery of the European Agenda on Migration acknowledged the need to further adapt the common visa policy to current challenges, taking into account new IT solutions and balancing the benefits of facilitated visa and visa-free travel with improved migration, security and border management, and making full use of interoperability. In this context, the Commission presented a Communication on adapting the common visa policy to new challenges on 14 March 2018, in parallel with a proposal to amend the Visa Code. The proposal to amend the Visa Code aims to simplify and strengthen the visa application procedure, to make it easier for tourists and business travellers to come to Europe with a visa while strengthening the prevention of security and irregular migration risks, most notably by linking visa policy with the return policy. The VIS fits into this context as the electronic processing tool supporting the visa procedure. The March Communication also announced the work towards enhancing security by revising the VIS and making full use of interoperability. It furthermore announced the three main modalities in which enhanced security would be achieved: 1. by enhancing checks in visa processing using interoperability; 2. by closing remaining information gaps for borders and security through the inclusion of long-stay visas and residence documents in the VIS and 3. by addressing remaining information gaps in short-stay visa processing, in respect of fingerprinting age of applicants and keeping copies of travel documents. 1.2.Closing the information gap on long-stay visas and residence documents The Commission's April 2016 Communication on Stronger and Smarter Information Systems for Borders and Security identified a need to address information gaps in the EU's architecture of data management, including on third country nationals holding a long-term visa. This Communication also signalled a shift from the principle of disconnected databases towards their inter-operability in full compliance with fundamental rights. On the other hand, the EU has also strengthened its data protection rules by adopting the General Data Protection Regulation and the Data Protection Directive for the police and criminal justice sector in 2016. The new rules are based on principles of data protection by default and by design (privacy and data protection as key considerations from the earliest stages of development of any system). On 10 June 2016, the Justice and Home Affairs (JHA) Council endorsed a roadmap to enhance information exchange and information management . One of the objectives was to address the existing information gap in the documents issued to third-country nationals. The Roadmap concluded that the fragmentation of information through different Member States and systems is inefficient and could lead to errors when assessing a third-country national’s situation and makes the border-crossing procedure more difficult. The Final Report of the High-Level Expert Group on Information Systems and Interoperability (HLEG) of May 2017 further described the existence of the information gap at EU level and recommended the Commission to undertake, as a matter of priority, a feasibility study on the establishment of a central EU repository containing information on the documents which allow a TCN to stay for a longer period than the 90 days within any 180 days allowed by the short-stay visa in a given Member State and whose issuance falls under national competence. In its Conclusions of 9 June 2017 on the way forward to improve information exchange and ensure the interoperability of EU information systems, the Council acknowledged that new measures might be needed in order to fill the current information gaps for border management and law enforcement, such as in relation to border crossings by holders of long-stay visas, residence cards and residence permits. The Council invited the Commission to undertake a feasibility study as a matter of priority for the establishment of a central EU repository containing information on long-stay visas, residence cards and residence permits, as recommended in the Final Report of the HLEG.

The Report on the VIS Evaluation adopted in 2016 already included a recommendation for further development of the VIS to include these documents. In response, the Commission undertook a study to assess the need for a centralised EU repository containing information on long-stay visas, residence permits and residence cards, including its necessity, technical feasibility and proportionality. It analysed whether including long-stay visas and residence documents in a central database was technically feasible and desirable, compared to the creation of a new database to store data on these documents. The study concluded that re-using the VIS structure to include these documents would be the most feasible option in terms of IT security, ease of implementation and cost-effectiveness. The study also concluded on the need to further analyse the necessity and proportionality of such a measure, which is done in this impact assessment. 1.3.The VIS setup A comprehensive legal framework was adopted to establish the Visa Information System (VIS) as a large-scale IT-system for exchanging short-stay visa data between Member States . The VIS was created for the purpose of processing data on short-stay visa applications. The purpose, functionalities and responsibilities accompanying the VIS are specified in the VIS Regulation and in a number of implementing acts . The overall objectives of the VIS are to improve the implementation of the common visa policy, consular cooperation and consultation between central visa authorities by facilitating the exchange of data between Member States on applications and on the decisions relating thereto, in order to: ·Facilitate the visa application procedure; ·Prevent ‘visa shopping’; ·Facilitate the fight against identity fraud; ·Facilitate checks at external border crossing points and within the Member States’ territory; ·Assist in the identification of any person who may not, or may no longer, fulfil the conditions for entry to, stay or residence on the territory of the Member States; ·Facilitate the application of the Dublin Regulation ; ·Contribute to the prevention of threats to the internal security of any of the Member States. The variety of the purposes requires that the VIS is used by different authorities (migration, law enforcement, and border control authorities) in full respect of access safeguards. The VIS allows to verify that the person presenting a visa is indeed its rightful holder, and that the visa is valid. Furthermore, by using VIS checks and issuance of visas are made easier and abuses can be better detected. In addition, asylum authorities can consult the VIS to determine the Member State responsible for the asylum procedures and migration authorities can use it to identify unambiguously third country nationals subject to a return procedure. Finally, law enforcement authorities (national and Europol) may consult the VIS when there are suspicions of terrorism or serious criminal offences (see Figure 1 below for VIS process and access). The VIS central system was developed by the Commission and handed over to eu-LISA in December 2012. It was gradually rolled out in all Member States' consulates around the world between October 2011 and February 2016. As one of the centralised EU information systems for security, border and migration management, the VIS is an integral part of the Commission's new approach to the management of data for borders and security that seeks to ensure that border guards, law enforcement officers, immigration officials and judicial authorities have the necessary information at their disposal to better protect the external borders and enhance internal security for the benefit of all citizens. To achieve that, there is a need to maximise the benefits of existing information systems including the VIS, to develop the system to address information gaps including on long-stay visas, residence permits and residence cards, and improve the interoperability of EU information systems, in line with the April 2016 Communication on stronger and smarter information systems for borders and security and the call by the European Council of 23 June 2017 to improve the interoperability between databases. 1.4.VIS REFIT Evaluation As required by the VIS legal basis and as part of the Commission’s REFIT programme, in 2015, the Commission launched an evaluation of the system. The results of the evaluation and the ensuing recommendations to improve the functioning of the system were transmitted to the European Parliament and the Council on 14 October 2016. Overall, the VIS evaluation showed that the system is effective in meeting its objectives, in particular as regards simplifying and facilitating the visa application process, reducing the administrative burden of national administrations, helping to fight fraud, facilitating at external border crossing and within the territory of the Member States and identifying third country nationals for migration or return purposes or examining asylum applications. The evaluation also demonstrated a need to further develop the VIS in order to better respond to new challenges in visa, border and security policies, including by seeking to establish interconnectivity with existing and upcoming IT systems and exploring ways to have information on national long-stay visas, including biometrics, registered in the VIS. It also showed the need for improvements in particular in relation to the monitoring of data quality and the production of statistics.

As regards the protection of personal data processed in the VIS, the evaluation found that the VIS has a very good track record: inspections on the spot by the European data Protection Supervisor to monitor the lawfulness of the processing of personal data and security audits of the VIS central system have not led to identify any data protection concern. After five years of being in charge of the operation of VIS, eu-LISA has not received any complaint related to data protection in VIS. VIS has been subject to two auditing inspections by the EDPS – in 2012 and 2015. Furthermore, regular meetings (twice a year) of VIS Supervisory Coordination Group are held, where national data protection authorities and the Commission are gathered to discuss data protection issues arising from the activity of the VIS, providing a forum to raise any data protection concerns. 1.5.Consequences for the VIS The migratory and security challenges faced by the EU in the recent years together with the update of EU information systems for border management and security and the development of new ones require the update of the VIS. A number of changes to be introduced in the VIS stem directly from the 2016 evaluation. Most of them are of a technical nature and serve to further align the system with the new legislative proposals in this area, while not presenting a significant economic, social or fundamental rights impact. Therefore a detailed assessment of the impact of these technical improvements is not needed. These changes mainly concern: 1) improvement of data quality; 2) integrating the VISMail functionality into the VIS; 3) centralising the consultation and representation functions; 4) support for facial image recognition or with latent fingerprints and 5) set up of a reporting and statistics engine based on VIS data. The study on all envisaged technical impacts resulting from the VIS evaluation was carried out by eu-LISA between October 2016 and July 2017 and its input was factored into this impact assessment to the extent relevant. However, several issues identified in that evaluation report require not only a technical analysis, but also a further analysis of relevant impacts. There are four such key issues: 1.the experienced difficulties to complete procedures to return irregular migrants to their countries of origin in case travel documents are missing; 2.the risks of irregular migration and visa fraud, including in particular for reasons of trafficking in human beings and other abuse involving children under 12 years old when applying for a visa; 3.the difficulties regarding the verification of long stay visas and residence documents and their holders, by border or migration authorities; 4.the information gap on checks for irregular migration and security risks when processing visa applications. In order to analyse them two studies were contracted. The first one addressed aspects 1 and 2 and the second one aspect 3. In addition, it also seems necessary to update the VIS to take into account the evolution that took place after the 2016 evaluation regarding EU information systems for border management and security. Therefore, in striving to align the initiative with the recently adopted (EES), proposed (recast Eurodac proposal, ETIAS, interoperability) or envisaged Commission proposals (ECRIS-TCN ), a possibility to enable automatic consultation of the other existing databases in the area of security and borders for visa processing was raised, which is further analysed as problem 4. The analysis builds upon the findings of ETIAS feasibility study, therefore no new studies were contracted. 2.Problem definition 2.1.What are the problems? 2.1.1.Lack of travel document as evidence in return proceedings Currently Member States have different national practices regarding the storing the travel document presented when applying for a short-stay visa. Many of them require applicants to submit hard copies of the bio data page (as a minimum) of the document, which are then archived for an average period of 1-3 years in the consulates’ archives. However, national authorities have no information regarding the existence of those copies kept by other Member States and there are no EU-wide rules regulating their exchange. In the absence of a valid travel document (or copy thereof), return proceedings for TCNs irregularly found on EU territory and who entered the EU using a visa are slow and often unsuccessful. The common EU rules governing return proceedings are stipulated in the Return Directive, which contains clear, transparent and common rules for the return and removal of the irregularly staying migrants, while fully respecting the human rights and fundamental freedoms of the persons concerned. In the wake of the migration crisis of 2015, the numbers of irregular migrants in the EU expected to return to their home country has grown considerably. In the six-year period of 2011-2016, 2 891 260 persons were ordered to leave, out of which 1 118 385 were returned to third countries. This means that 1 772 875 persons were not returned, out of which 600 925 in 2015-2016 alone. It can be assumed that the majority of these persons remain in the territory of the EU Member States. Irregular migrants staying in the territory of the Member States and waiting for return to their home country cause high costs for Member States in terms of housing, food, medical expenses and related expenses, as well as administrative costs, hampering in addition fast and effective procedures for legal migration and asylum seekers. The failure to efficiently return migrants to their home country is also an incentive for further irregular migration. The dangers along the road to Europe are often disregarded by irregular migrants because they know that the risk of being returned once in Europe is relatively low. The proposal to amend the Visa Code has also pursued options on how to better link visa policy and return. Among third country nationals (TCN) to be returned, there is a number of TCN who overstayed their visa and became subject to return procedures. The total number of detected overstayers at EU-level is estimated at around 294 000 cases across the EU, on average. Visa overstayers who no longer possess a travel document Based on the data provided by the Member States, it is estimated that roughly 10 to 20% of all visa overstayer return cases involve TCN visa holders who no longer possess, or fail to produce their travel document on request. This amounts to an estimated 26 445 – 52 891 cases of missing travel documents (as of December 2017). Stakeholder testimony further suggests that a significant number of return decisions are not executed due the authorities’ inability to obtain satisfactory evidence proving the nationality of the third country national in question. If it is estimated that between 60% to 75% of such return cases are not implemented on these grounds. This amounts to an estimated 15 867 to 39 668 returns of visa overstayers that could not be executed, which represents a high administrative burden for Member States. The 2016 VIS evaluation revealed that 8 out of 26 Member States had never even accessed the VIS for the purpose of identifying TCN for return. Furthermore, 3 out of the 19 responding Member States declared that they communicated VIS data to non-EU countries or international organisations for the purpose of return. It has to be noted that non-EU countries usually do not accept information extracted from VIS as prima facie evidence of nationality for return purposes. Recent trends showed an increased use of the VIS as an instrument which provides a proof of identity necessary in a return procedure. However, there is currently no mechanism in place to mutually inform and to exchange travel document copies of TCN between Member States, when needed to complete a return procedure in cases where the Member State which has to execute the return is different from the Member State which issued the visa. The absence of such a mechanism means that Member States have both practical and legal difficulties when exchanging travel document copies to this end.

Difficulties faced by Member States to acquire a copy of the travel document from the diplomatic/consular representations of the issuing countries places a high burden on them as they have to devote considerable time and resources to confirm the identity and nationality of a TCN. Not having a copy of the travel document means that it is disproportionately difficult to carry out the return of TCNs issued return decisions in practice. In this way, lack of travel document copies in VIS undermines the smooth functioning of the EU return policy and, due to its role to prevent and respond to the risk of irregular migration, indirectly also on the visa policy. 2.1.2.Lack of fingerprinting data allowing to identify minors Current EU legislation on the visa application procedure for short-stay visas exempts children under the age of 12 from providing fingerprints. This was mainly due to technical limitations regarding fingerprinting children available at the time the provisions were set in law. However, the legislator requested the Commission in Article 57(4) of the Visa Code to address in the future the issue of sufficient reliability for identification and verification purposes of fingerprints of children under the age of 12. Without fingerprints it is more difficult to unambiguously verify the identity of a child holding a visa at the border or within the Schengen territory. This phenomenon is exponentially amplified by the fact that a Schengen visa can go up to 5 years validity, which means that a child who applied with 12 years old can obtain a multiple entry visa with validity until the age of 17. On average, children under 12 make up 10 to 15 % of visa applicants , meaning that between 1.4 and 2.1 million new visas are granted to children under 12 each year. Out of this category, it is estimated that between 0.7 and 1.05 million are children younger than 6 years. On the other hand, based on available data , it is estimated that on a yearly basis there could be between 1 500 and 2 000 TCN children <12 victim of trafficking in the Schengen area. Although there is no precise information possible on how many of these child trafficking victims have travelled with a visa to the Schengen area or come from countries subject to the visa obligation (but have tried and failed to obtain such a visa), extrapolations can be made on the basis of information available regarding the main countries of origin of the trafficked children according to which it is likely that around 25 % of them went through the visa process (375-500 children on a yearly basis ). Furthermore, a multiplying factor should be taken into account, given that with a MEV valid for up to 5 years, the real scope of the problem is extended potentially to children up to 17 years old. For this age group figures on children victims of trafficking climb up to 3200-4250 on a yearly basis. Taking all these factors into considerations, it can be estimated that between 820-1000 trafficked children arrive with a visa which was taken without fingerprints each year. The Commission Report on the progress made in the fight against trafficking in human underlined that traffickers exploit loopholes in enforcement or control and that tools, such as the VIS can assist in identifying victims of trafficking in human beings and detecting traffickers. “When a person regularly requests a new visa or has been issued with a multiple-entry visa and is travelling repeatedly with different 'other' persons (for example other children), there could be a suspicion of trafficking. The biometric data in the VIS makes it furthermore impossible for multiple persons (looking alike) to travel on the same visa or passport.” Due to the lack of fingerprints for TCN children under 12, VIS benefits to prevent visa fraud and facilitate checks at external borders and within the territory of the Member States or asylum examination do not extend to all children. This is a loophole which can be used by fraudsters and traffickers and does not contribute to ensure the protection of TCN (<12 years of age at the time of applying for a visa) children at risk of abuse, either from trafficking with the help of a visa, or in case they are found in Schengen territory in a situation where their rights may be or have been violated (through trafficking, missing children, unaccompanied minors applying for asylum). 2.1.3.Lack of sufficient information on long-stay visas and residence documents The issuance of long stay visas and residence documents is not fully harmonised at EU level, since only for certain categories of third-country nationals admission conditions and procedures are regulated under EU law. Such authorisations give the right to the holder to stay and move freely within the entire Schengen territory for 90 days in any 180-day period , provided they fulfil the entry conditions set out in the Schengen Border Code. Residence documents include residence permits – issued to third country nationals for stays longer than 90 days in 180 days for reasons varying from study, research, work, to family reunification by third country nationals, and residence cards – issued to third country nationals who are family members of mobile EU citizens (i.e. those who have exercised the right to free movement). Currently, only TCN who applied for short-stay visas are in the VIS, as it is a centralised mechanism at EU level containing short-stay visa applications and visas issued. Long-stay visas, residence permits are residence cards are not contained in any EU system. The lack of a centralised mechanism at EU level enabling Member States to exchange information on these documents and their applicants or holders result in a two-fold problem: 1.authorities at borders others than of the Member State who issued a document have difficulties to effectively and efficiently verify the authenticity of these documents in connection with their rightful owner, or to fully ascertain the identity of the person holding them. Identity and document fraud are the major risks in this respect (as elaborated further down). 2.Member States do not have access to nor can exchange, in an effective and efficient manner, information enabling them to properly check whether the person is not a threat to the security of the Member States before or when the person reaches the external border (see further below). From a border-control point of view and for checks carried out within the territory of the Member States, it is crucial to be able to ascertain the authenticity and validity of the documents and the legitimate relation with the holder. Currently, this is done, for the documents provided with security features, by verifying these elements. Of the three types of documents (long-stay visas, residence permits, residence cards), only some residence permits and residence cards issued in a residence permit format have a chip , which allows electronic verification and the possibility to verify the bearer identity . Frontex observes that both the quantity and quality of fraudulent residence documents (2546 detections in 2017 on both permits and cards) circulating in the EU have increased in recent years. Moreover, an unsuccessful document authentication procedure based exclusively on verifying the security features of the document does not automatically establish a fraud case, and because it implies further second line checks, does not help to carry out a smooth and fast border check procedure.

In addition, while many residence permits and long-stay visas formats are harmonised, and for the residence cards measures to harmonise and secure them are under way , this is not yet the case for all these documents. Thus, the visual inspection of the document’s security features is made difficult by the different formats and – for some documents – the rarity with which they appear at certain border-crossing points, in addition to the heterogeneous use of security features. The border guards have different tools to gather information to assess the validity of a document, some automated (SIS and SLTD for lost, stolen, misappropriated and invalidated documents), others to be used at second-line border checks (like the FADO for images of authentic and forged documents). However, the information provided by these systems is very limited and the objective of border checks cannot be achieved on this basis in an efficient and effective manner. The SIS (which is the only EU centralised databased used at borders) does not provide information on previous fraud attempt(s) by an applicant and cannot provide information on documents that have not been reported as stolen or lost, it does it include information on withdrawn documents, nor any information on long stay visas. In case of a doubt concerning the document or its holder, border guards have to rely on bilateral contacts with the issuing Member States, via communication channels like SIRENE , the Police and Customs Cooperation Centres National Contact Centre (NCC), phone, emails or fax , which is limited by inherent constraints like language barriers and waiting times for the traveller, who sometimes runs the risk of being wrongly denied entry or passage. Moreover, the issuance of a residence document constitutes the enactment of a right established under legal migration or freedom of movement legislation to enter and stay on the territory of the Member States. The document is thus also a material proof that the right exists, but it is not to be confused with the right A person may lose the document or the document may expire (as it is the case with the validity of a residence card), but this is not equivalent to the holder losing the right enacted by that document. However, in case of expiry, loss or theft, the person cannot prove its right to enter, stay or move freely within the territory of the Member States, and currently existing systems to be checked at borders and within the territory cannot provide evidence to support the person ascertain its rights in such cases. Ultimately, this situation leads to inefficient border-crossing procedures, which are not in the spirit of freedom of movement of bona fide TCN who have a right to enter and reside in the territory of a Member State (Article 21 of TFEU and Directive 2004/38). Consulted Member States complained about these procedures as being time-consuming and inefficient. For the large majority (80%) the lack of shared information on these documents was a hurdle to their day-to day activities and as such creates administrative burden. The absolute majority of respondents to the open public consultation also perceive the identified information gap as leading to problems in the management of external borders and irregular migration within the EU. The lack of centralised storage of data on these documents renders them more likely to be tampered with, thus more susceptible to being misused. In order to be able to assess whether the person could pose a threat to the security of the Member States or whether he or she could be an identity fraudster, it is important to have access to relevant information on the previous applications made by that person and which were rejected by other Member States on grounds of national security or because of established fraudulent claims (of identity or documents). When a TCN applies for a short stay visa, a full picture of the history of movements, enabling to assess security and migration risks, including fraud, is possible by connecting information from either VIS or (in the future) ETIAS with EES, ETIAS, Eurodac and VIS. However, there is no similar possibility if the same TCN applies for a long stay document, as this information is not connected with any central system. Information is not flowing either from the short stay history of a person into a long stay assessment, nor vice versa. Apart from checking national systems, the only EU-level exchange of information migration authorities have at their disposal is the SIS for alerts on entry bans. There is no tool to share information on applications and reasons for refusal for long stay applicants, which might lead to identity fraud or security risks. This also affects negatively the efficiency of checks against the integrated IT systems for borders, i.e. checks against the border and security systems using interoperability is not possible if the information on the document is not present in at least one of these systems. Criminals are taking advantage of this loophole in the information exchange between Member States. Consultations with Europol and national law enforcement authorities revealed that due to the lack of information sharing between Member States on long stay documents, combined with the lack of checks between the various centralised systems, the exact size of the security risk posed by TCN holders of long stay visas or residence documents is difficult to measure. However, individual national authorities provided information on cases involving serious criminality by TCN going through various legal migration/asylum/residence statuses in the territories of Member States, which indicate that the phenomenon is real and raises serious concerns. Stakeholder testimony: In one such case a TCN applied for asylum in Austria. His claim was rejected and he received an entry ban (recorded in the SIS) after several convictions for drug dealing and serious property crimes in Austria and other Member States. His biometrics and DNA were recorded by the Austrian police on that occasion. Three years later a DNA hit against his data was obtained in a rape case and a European Arrest Warrant, registered in the SIS, was issued on his name. The same TCN, under a different identity, applied for and successfully obtained a Schengen visa from another Member State, with the help of which he travelled regularly from Nigeria to the EU territory. Since SIS, VIS and Eurodac are not currently interoperable and checks are not systematically launched to the other IT systems when a visa application is lodged, the identity fraud could not be detected and the visa was issued, although an arrest warrant was present in the SIS. Later on the TCN married an Austrian national and obtained a residence permit on the basis of his status as family member of an EU national. The residence document was issued without problems as there are no compulsory checks against EU databases as part of the issuance procedure for these documents. The TCN was finally apprehended by the Austrian police when he was reported by his wife for aggravated domestic violence. Based on fingerprints taken at that time and checked against the Austrian police files, the link with the previous entry ban and arrest warrant issued years before could finally be established. In addition to the two main problems identified above, this information gap and the persisting fraud problem that comes with it can create spill over effects in the form of blind spots in the border-management security framework, thus ultimately creating increased risks for internal security and irregular migration. According to Frontex’s 2017 Annual Risk Analysis , smugglers frequently provide migrants with fraudulent travel and identity documents. Fraud is used by organised crime as a means for a series of related serious offences, notably for terrorism, trafficking in human beings, migrant smuggling or drug and firearm trafficking . Smugglers are supported by criminal networks with access to expert counterfeiters who, financed by the strong demand, have set up print shops. Finally, this gap also entails costs for the society as people obtaining residency through fraudulent means make wrongful use of social security benefits or gain unjustified access to the labour market. 2.1.4.Lack of sufficient checks on migration and security risks when processing visa applications Currently the visa procedure is not taking into account the possibilities offered by available large-scale IT systems nor interoperability between them. For instance, when assessing a visa application, SIS is checked as part of the risk assessment for irregular migration pursuant to the Visa Code. However, only the checks against alerts for the purpose of refusing entry are currently done because this is an automatic ground for refusal under the Visa Code. In practice, Member States' implementation of SIS and other national databases checks depend on the technical availability and national arrangements in any case, varying from direct access to SIS in consulates to consultations of national police authorities, who themselves carry out a number of checks for migration or security risks purposes, including larger checks against SIS categories, as well as SLTD, TDAWN, as well as a number of national migration and security databases. However this remains in all cases a manual non-automated operation. This leads to different checks carried out by each Member State, which creates an uneven playing field for visa applicants who are subject to more or less stringent checks, depending on each Member State and consequently could lead to undetected security risks and granting a right to enter the territory to (see case on page 21 also relevant for this problem). This problem is worsened by the fact that in some third countries e.g. West Balkan, Caucasus countries but also in some EU countries the legal change of personal data, either family or first names, is rather easy and cheap administrative procedure. International criminals convicted or wanted for arrest in EU can change their names and get new identities. It is therefore cheaper for them to legally change identity than to use alias identities and forged documents. They can obtain genuine biometric travel documents, which do not yield any hit against previously known identities for irregular migration or criminal acts carried out with alpha-numeric data only.

Furthermore, this situation does not ensure the same minimum level of checks against large-scale databases in the field of border and security to which visa free TCNs – who in principle pose lower risks in terms of security or irregular migration – will be submitted through ETIAS, nor those to which EU nationals are currently subject when crossing an external border, both at entry and exit. Moreover, the current system of checks during the visa examination is no longer adequate for the new layered border management strategy comprising a number of large-scale IT systems, as illustrated in Figure 5, which depicts the role that different IT systems currently have for visa-required (VIS) and visa-exempt travellers (ETIAS), in combination with the upcoming EES, as part of EU integrated border management. Not having the possibility of direct, seamless and efficient checks of other databases adds to the burden of visa application processing, making it more cumbersome. In this way it is hampering the functioning of the common visa policy. 2.2.What are the problem drivers? 2.2.1.Lack of travel document as evidence in return proceedings Two main drivers were identified in the course of the study. ·Driver 1: The absence of a legal framework allowing Member States to exchange/transfer information on travel documents of TCN subject to return. Currently, EU legislation – including in the areas of visa policy and migration – does not provide for the storage of digital copies (i.e. scanned pages) of the visa applicants’ travel document in a centralised European system, nor for making them available to other Member States. Member States may, however, establish such an obligation in their national legislation. In practice, many Member States systematically require applicants to submit such copies of the bio data page (as a minimum), which are stored in paper or digital format by the individual Member States (i.e. there is no central storage of travel documents associated to the visa). ·Driver 2: Insufficient (or non-existent) and/or slow cooperation of third countries in return procedures in the absence of a (copy of) the travel document. The consensus view among consulted stakeholders is that the degree to which third countries cooperate in this field is critically dependent on the quality of relations between the third country and the returning Member State, or the EU more broadly. Bilateral return agreements between Member States and countries of origin and EU readmission agreements (EURAs) are one of the tools that can be used to ensure cooperation with countries of origin for the effective and smooth implementation of return decisions. However, even in the context of EURAs and bilateral readmission agreements, Member States face practical challenges to their implementation in the absence of valid travel documents which can prove the nationality of the person to be returned. In particular, Member States have reported that third countries often do not issue travel documents to enable the readmission / return, do not reply within deadlines or they require different levels of evidence to confirm a person without travel documents as their national. 2.2.2.Lack of fingerprinting data allowing to identify minors The lack of a legal basis allowing to collect fingerprints from children under 12 and check with these data was identified as the main driver behind this problem. Competent authorities are having difficulty to identify or verify the identity of some of the third country nationals below 17 who enter or try to enter the EU territory using a short stay visa because the EU legal framework does not allow for collecting fingerprints for TCN visa applicants under 12. The inclusion of biometric identifiers, comprising the facial image and ten fingerprints in the VIS is provided for in Article 13(2) of the Visa Code. However, children under 12 are exempt from this obligation to have their fingerprints taken. Therefore, competent authorities have difficulties to identify and/or verify the identity of third country nationals under the age of 17 (taking into account the possible 5-year validity of the visa) who enter or have tried to enter the EU using a visa. Current legislative framework does not correspond to the technological progress either – taking fingerprints of children under 12 was not technically feasible at the time of the adoption of the original VIS legal act, as will be demonstrated later when presenting the rationale for policy options. 2.2.3.Lack of sufficient information on long-stay visas and residence documents The identified problem driver has to do with the lack of and fragmentation of the information on long-stay and residence documents. Data on long-stay visas and residence documents are kept at national level. They allow border guards to check the information on a document presented against these systems and a match occurs when the document is valid and issued by the same Member State. However, border guards and migration authorities have no fast and systematic access to information on documents issued by another Member State. The available data is partial and scattered in different systems and tools (SIS, SLTD, FADO, bilateral contacts between Member States etc.) which leads to lengthy procedures to collect all the necessary data for the day-to-day activities of national authorities. Member States and the respondents to the public consultation confirmed this: 86% agreed with the identified information gap that leads to problems in management of external borders and irregular migration within the EU. 2.2.4.Lack of sufficient checks on migration and security risks when processing visa applications

The problem stems from the changed security and migratory context, legislative developments, such as ETIAS and new technical feasibility stemming from interoperability. Furthermore, the outcome of the Schengen evaluation shows that Member States would welcome the security cross-check against other applications as a way of enhancing security. This also leads to difficulties when assessing irregular migration and security risk in the process of issuing short-term visas. It also leads to less stringent, less harmonised and less evidence-based assessment of these risks because of the impossibility to use automated database-searching. 2.3.How will the problem evolve? 2.3.1.Lack of travel document as evidence in return proceedings Return of a TCN to the country of origin or to another country of transit requires an individual assessment of the person's situation and in particular an unequivocal establishment of his nationality. In the absence of solid proof such as a travel document, third country authorities are usually unwilling to confirm that a TCN subject to return is their national, which further hampers cooperation in return procedures. As regards TCN subject to a visa, their identity and nationality could currently be established on the basis of a biometric match against the VIS, which is however not an acceptable evidence for third countries. These two factors: no systematic obligation for storage and the unwillingness of third countries to accept VIS data instead of copy of travel document lead to the problem of difficult returns and accrued additional costs. This, in turn, leads to hampering of the return and indirectly of the common visa policy. Based on forecast data on future trends in visa applications, it is estimated that, in the absence of further action at EU level, the proportion of visa overstayers in 2019 will increase to more than 350 000, between 30 000 to 60 000 of which will find themselves in return proceedings without valid travel documents. It can be assumed that the political pressure to enforce return decisions will grow accordingly. 2.3.2.Lack of fingerprinting data allowing to identify minors In the continuous absence of fingerprinting from the visa application procedure and consequently of the means to verify the identity of a TCN child going up to the age of 17 years, the identified problems will continue and might even grow, as networks of irregular migration and trafficking could become increasingly aware of the existing gap and would try to exploit it. As organised criminal networks are increasingly professionalising and modernising their modus operandi and there are no indications of a reversal in migration trends , the number of children that are at risk of being trafficked will probably remain high or even increase. Under the assumption of the continuation of the current scenario, it is expected that the trafficking of TCN children (<17 and who therefore potentially entered with a visa obtained without fingerprints, thus making their subsequent identification nearly impossible) into the EU using genuine visas will remain high – or may even rise further due to the increasing number of applications and the involvement of organised criminal networks, which are becoming more professional. 2.3.3.Lack of sufficient information on long-stay visas and residence documents The risks for internal security and irregular migration created by the information gap regarding long stay visas and residence documents may increase with the existing and ongoing strengthening of border checks for other categories of travellers (e.g. ETIAS for short-stay visa-exempt travellers and EES for all short stay visitors, combined with the existing VIS for short-stay visa holders). This has an impact on overall security and safety of the Schengen Area, as well as the freedom of movement. These developments could motivate irregular travellers to look for other, less secure types of documents that would still allow them to enter the Schengen area and move across Member States. This phenomenon has already been observed with ID cards, whereby fraudsters target less secure EU ID cards for intra-Schengen movements (fraud based on the ‘weakest link’ approach). 2.3.4.Lack of sufficient checks on migration and security risks when processing visa applications If all the envisaged proposals are finally adopted and subsequently implemented (EES, ETIAS, interoperability proposal), it would lead to an asymmetric situation where automated checks would be mandatory for visa-free TCN in ETIAS against all EU information systems and other databases , whereas for visa required TCN – who are considered, in general, to pose a higher irregular migration or security risk, which is why they need a visa to enter the EU, there is no possibility of automated checks. This would have an impact on a better assessment of migration and security risks when deciding on an application, and would create a less favourable treatment for visa-free TCN in comparison with TCN under visa obligation, as well as lead to additional administrative burden for Member States when trying to overcome the lack of direct means to properly assess migration and security risks. 3.Why should the EU act? 3.1.Legal basis The current legal basis of the VIS is provided in Article 77 (2) (a) and (b), Article 87(2)(a) and Article 88(2)(a). Similar to other recent proposals in the area of IT systems for security and borders, Article 16(2) could be added in the revised VIS Regulation, as a horizontal principle. Article 74, and Article 77(2)(c) and (d) of the Treaty on the Functioning of the European Union can be added to the legal basis for amending the VIS Regulation. Article 78(2), and Article 79(2) (c), and (d) correspond to ancillary objectives of the VIS and could also be added. 3.2.Subsidiarity: Necessity of EU action The objectives of the revised VIS Regulation, to set up a common system and common procedures for the exchange of visa data between Member States, cannot be sufficiently achieved by the Member States and can therefore, by reason of the scale and impact of the action, be better achieved at EU level. The further improvement of these common procedures and rules on the exchange of data consequently requires EU action. The problems elaborated in the previous sections are unlikely to disappear in the near future and they are directly related to the current provisions of the VIS. Amendments of the VIS legal framework and related legislation are only possible at EU level. By reason of the scale, effects and impact of the envisaged actions, the fundamental objectives can only be achieved efficiently and systematically at EU level. As regards in particular the copy of the travel document and fingerprinting of minors, the subsequent analysis of the option will further demonstrate how non-EU action cannot sufficiently address the problem, as they require a solution through a centralised storage and access to data that none of the MS taken individually can achieve. As regards in particular the problem of long-stay visas and residence documents, more than 90% of the Member States consulted considered necessary an EU legislative response to address the information gap. As regards migration and security checks, it relies by its nature on an immediate access to all other MS information, which can only be achieved through EU action. The initiative will further develop and improve the rules in the VIS, which implies the highest degree of harmonised rules that cannot be solved by Member States acting alone and can only be addressed at EU level. 3.3.Subsidiarity: Added value of EU action

As described in the baseline scenario(s) below, the continued application of the current legal framework is not going to lead to resolving these problems. Regarding taking fingerprints for visa applicants under 12, the Member States cannot unilaterally decide on changing the system because the VIS Regulation is already stipulating a number of rules. National action is possible, and desirable, to try to obtain better cooperation of third countries on matters of return of irregular migrants. Nevertheless, it is unlikely that any such activities will achieve the same effect as making the travel document available in VIS for duly justified purposes. Regarding long-stay visas and residence documents, it is unlikely that national action would address the problem; Member States could act on an individual basis, by strengthening their documents, their issuance process, document checks at border-crossing points or by reinforcing or systematising bilateral cooperation. However, this approach has inherent limitations, as will be explained further below. Regarding automated checks of other databases, Member States are free to develop solutions to consult both their national, as well as EU and international databases. However, harmonising those rules at EU level seems preferable in order to enable Member States to apply the common Schengen rules in a coordinated way. 4.Objectives: What is to be achieved? This section lists the general and specific objectives any initiative should have to address the above-mentioned problems faced by Member States and visa applicants. 4.1.General objectives of the revised VIS proposal ·Contribute to the implementation of the common visa policy; ·Facilitate the checks at EU external borders and the subsequent movement within the area without internal borders; ·Improve security within the EU and at its borders; ·Improve the management of the Schengen external border. 4.2.Specific objectives The specific objectives are defined for each area for which problems and problem drivers were described. 4.2.1.For copy of the travel document ·Contribute to improving the identification and return of third country nationals that do not, or no longer fulfil the conditions for entry to, or stay on the territory of the Member States in accordance with the Return Directive. ·Improve the efficiency of the VIS for the purposes of facilitating return procedures. Achieving these objectives would lead to lowering administrative burden for Member States – with positive impacts in terms of cost savings for Member States public authorities (in terms of housing, food, administration and related expenses), better acceptance of the EU migration policy by the European public and a deterrent effect on potential future irregular migrants, thus reinforcing EU common visa policy. 4.2.2.For fingerprinting of minors Two specific objectives are defined:

·Better achieving the VIS objectives in relation to the facilitation of the fight against fraud, facilitation of checks at external border crossing points and facilitation of the application of the Dublin II Regulation. ·Strengthen the prevention and fight against children's rights abuses, such as trafficking, in particular the identification/verification of identity of TCN children who are found in Schengen territory in a situation where their rights may be or have been violated (through trafficking). 4.2.3.For long-stay visas and residence documents 4.2.4.For migration and security checks Making full use of interoperability, granting fast, seamless and systematic access to other IT systems in the area of migration, border management and security would contribute to lowering the burden for Member States and contributing to the objective of a more secure common visa policy by facilitating and improving the assessment of the risk of irregular migration and security in the visa procedure (while following the rules stipulated by the Visa Code). 5.What are the available policy options? 5.1.What is the baseline from which options are assessed? General considerations concerning data protection aspects Data protection is closely linked to respect for private and family life protected by Article 7 of the Charter. This is reflected by Article 1(2) of the General Data Protection Regulation , which indicates that the EU protects fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data. It has also to be noted that the Court of Justice of the EU has stated that the right to the protection of personal data is not an absolute right, but must be considered in relation to its function in society . The GDPR, and, where relevant, Directive (EU) 2016/68054 apply to the processing of personal data carried out for the purpose of processing the visa application by the Member States and by the EU institutions, bodies and agencies involved, respectively. According to the Commission Communication of July 2010 on information management in the area of freedom, security and justice, data protection rules should be embedded in any new instruments relying on the use of information technology. This implies the inclusion of appropriate provisions limiting data processing to what is necessary for the specific purpose of that instrument and granting data access only to those entities that ‘need to know’. It also implies the choice of appropriate and limited data retention periods depending solely on the objectives of the instrument and the adoption of mechanisms ensuring an accurate risk management and effective protection of the rights of data subjects. In this respect, the VIS revision is based on data protection by design and by default . The importance of the concepts of data protection by design and by default was repeatedly highlighted by the European Data Protection Supervisor regarding the e-Privacy reform . Safeguards are already part of the current VIS setup, namely: -Data protection is embedded into the design and architecture of the existing VIS and apply to all new functionalities added to it. -Specified purposes should be clear, limited and relevant to the circumstances (purpose specification); the collection of personal information is limited to that which is necessary for the specified purposes (collection limitation); the collection of personally identifiable information is kept to a strict minimum (data minimisation); the use, retention, and disclosure of personal information is limited to the relevant purposes (use, retention and disclosure limitation). It is important to note that the safeguards currently present in VIS (baseline scenario) will also be part of the revised VIS, for any of the proposed options. Each of the proposed measures will be assessed against the following three criteria: (a) Whether they meet an objective of general interest;

(b) whether they are necessary; (c) If so, whether they are proportional. When assessing these criteria, a series of principles are taken into account under the terms of the GDPR, including respect of the data minimisation principle (Article 5(1)(c)), according to which access to personal data must be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed, data accuracy (Article 5(1)(d)) and purpose limitation (Article 5(1)(b)), according to which data is to be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes. For the purpose of understanding the ensuing data protection considerations, it is important to clarify the scope of current data processing in the VIS: - the VIS processes and stores data from the application form, which includes biographical information of the person; - picture - fingerprints - decision of Member States on the application, i.e. visa issued, visa refused, visa revoked or annulled. No information is stored on supporting documents (secure messaging system VISMail is used to exchange additional information, upon request).The VIS setup already includes a robust set of data protection safeguards, such as limited and strictly controlled access to the data (Article 6), limited retention period with clear deletion deadlines (Article 23), advanced data deletion in case the data subject has acquired the nationality of a Member State (Article 25), responsibility for the use of data (Article 29), rights to request amendments and deletion of data and obligations for the Member States to do so in case of unlawfully or erroneously processing (Articles 24 and 38), strict data security rules (Article 32), strict embargo on transfer to third countries (Article 31) – except for very limited situations in case of return (further explained in section 2.1.1), strict rules on the liability in case of misuse of data (Article 33), detailed rules on keeping of records (Article 34), self-monitoring by Member States (Article 35), cooperation between Member States to ensure the right to data protection of the applicants is upheld (Article 39), right to effective remedy in respect of the personal data (Article 40), as along with a supervisory framework, both by National Supervisory Authorities (Article 41) and by the European Data Protection Supervisor (Article 42). 5.1.1.Copy of the travel document The current divergent approaches taken by Member States regarding the collection and storage of copies of visa applicants’ travel documents during the visa application procedure and the possibility of making them available to other Member States will continue. This would lead to an increased backlog of TCN under return procedure, with increased administrative burden and costs for Member States. The TCN under return procedure will remain in limbo, often in administrative detention. The inefficiency of the return policy will lead more TCN staying irregularly in the territory of the Member States. . 5.1.2.Fingerprinting of minors Current VIS rules regarding taking fingerprints from children under 12 remain unchanged. Technological progress and available means are not taken into account, while the risk of children right's abuses, such as trafficking of children, remains insufficiently addressed, given the available possibilities. Relevant authorities would continue to have challenges both to identify or verify the identity of young children and to offer appropriate protection if case of suspected trafficking, and to use more effective means enabling to detect and fight against trafficking networks. 5.1.3.Long-stay visas and residence documents In the current situation Member States do not share information prior to or upon issuance of a long stay document. SIS is the only system required to be checked in respect of a TCN applying for a visa or residence document, but only as regards refusals of entry and stay (i.e. entry bans). However, no means are in place to check whether the holder of the document is not a threat to the security of the Member States other than the one that issued the visa or residence document. Current inefficient border-crossing procedures will continue. In case of doubt on the document or the bearer (i.e. document unknown to the border guard due to the non-uniform format, expired document, document with non-functioning chip or simply a document holder who lost the document), there are no rapid and effective means at the border to verify the identity of the traveller. This has consequences on the waiting time for the traveller with negative consequences on the right to move freely of bona fide TCN who have a right to enter and reside in the territory of a Member State (Article 21 of TFEU and Directive 2004/38). Consulted Member States complained about these procedures as being time-consuming and inefficient. For the large majority (80%) the lack of shared information on these documents was a hurdle to their day-to day activities and as such create administrative burden. 5.1.4.Migration and security checks As regards the assessment of the irregular migration and security risks at the time of application, Member States will continue to rely on national checks and on existing bilateral exchange of information on a case-by-case basis. Member States would still have to check SIS (manually), as there would be no possibility of automated checks and, depending on their national rules, check their national or other international databases. A full assessment of the risks is not possible, which leads to both an uneven playing field for the applicant (i.e. conditions are more or less stringent, depending on the Member State of application) and security gaps are possible, depending on checks carried out by Member States. 5.2.Description of the policy options 5.2.1.Copy of the travel document

Policy options to address the problem of lack of travel documents for return should ensure that the Member States' need for a travel document to certify the identity and nationality of a TCN is covered in each individual case. ·Option 1.0 – Status quo – this situation corresponds to the baseline situation described above. ·Option 1.1 – Include a digital copy of the travel document in the central VIS (centralised) Under this option, the digital copy of the visa applicants’ travel document would be systematically stored in the VIS system. The competent authorities for identification (and/or verification within the territory) and return – namely migration and return authorities – and which already have access to search the system using the fingerprints of the apprehended TCN, would be able to retrieve this copy, subject to strict access rules. Article 2(e) of the VIS Regulation foresees that one of the objectives of VIS is ‘to assist in the identification of any person who may not, or may no longer, fulfil the conditions for entry to, stay or residence on the territory of the Member States.’ Article 31(2) enables the Member States to transfer or to make available a limited set of these data to a third country for the purpose of proving the identity of third-country nationals for the purpose of return. Thus, although not explicitly defined in Article 2, when taken together, these provisions foresee that the VIS can be used to facilitate both the identification of the irregular migrant and the return itself. ·Option 1.2 – Include a digital copy of the travel document in national visa systems (decentralised) Under this option the digital copy would be stored in the national visa systems (NS-VIS) of the Member States with which the application for a visa was lodged. When a VIS hit is obtained in respect of a TCN subject to return procedure, the MS responsible would submit a request to the MS that owns the data. In this scenario, a fast and secure channel of communication must exist between the Member States' authorities allowing them to send the request and receive the information. This channel could be ensured by the existing VISMail facility within the VIS. In addition to the main options, two additional sub-options were defined regarding the scope of the data to be stored in VIS: ·Sub-option A – Storage of biographical page only This sub-option will involve the incorporation of the standardised MRTD size 3 data page. ·Sub-option B – Storage of all used pages of the applicant’s travel document Another approach would be to scan and store a digital copy of all used visa pages of the applicants’ travel document, i.e. those containing visa stamps and stickers. Blank pages and any other pages in the TD (i.e. annotations, the back-side of the biographic data page, the page adjacent to the data page) would not be stored in VIS. The two sub-options can be applied to both Option 1.1 and Option 1.2 described above. 5.2.2.Fingerprinting of minors Policy options to address this problem should ensure that children having obtained a Schengen visa before they were 12 years old have their verification of identity correctly made at the border or within the territory, or are correctly identified in case found victims of trafficking or other forms of abuse. The reason for taking fingerprints stems from the fact that misidentification is more likely when based exclusively on alphanumeric data. Adding fingerprints to the file reduces the likelihood of misidentification to virtually zero. By storing fingerprints in the VIS the system provides a secure link to the identity to the visa applicant through biometrics. This applies to adults as well as children. Consultations with stakeholders that technological developments, including on the collection and use of biometrics, could contribute and should be used to enhance the protection of children. A majority of the respondents also consider fingerprinting children applying for a short-stay visa necessary or useful to address or prevent trafficking or other forms of abuse. ·Option 2.0 – Status quo – this situation corresponds to the baseline situation described above. ·Option 2.1 – Lowering the fingerprinting age to 6 years Under this scenario, fingerprints will be taken from every visa applicant from 6 years of age and above, thereby effectively increasing the group of applicants by adding the age-group of 6 to 11 year-old. This option is based on technological progress: in 2013 the European Commission’s Joint Research Centre (JRC) carried out a study on the question whether or not automated fingerprint recognition for children is possible with recognition rates similar to those reached for adults. The JRC study concluded that fingerprint recognition of children aged between 6 and 12 years is achievable with a satisfactory level of accuracy under appropriate conditions. One such condition would be, for example, to ensure an appropriate level of training of operators to acquire high quality images. ·Option 2.2 – Lowering the fingerprinting age including all ages

Under this scenario, fingerprints would be taken from visa applicants of all ages thereby effectively increasing the group of applicants by adding the age-group of 0 to 11 year-old. In the same JRC study evidence is presented from other studies that it is feasible to take reliable fingerprints of children even younger than 6, although this would have an impact on the reliability of the fingerprints and be more challenging in terms of technical and procedural requirements. 5.2.3.Long-stay visas and residence documents The policy options to address the identified problem should ensure that verifications of the irregular migration and security risks for a TCN applying for a long stay visa or residence document, verifying the entry conditions at external border, as well as any subsequent exchange of information on the person are done in an efficient and effective manner. ·Option 3.0 – Status quo – corresponds to the baseline situation described above Non-legislative options: ·Option 3.1.a – Improve the exchange of bilateral information on a case-by-case basis This would mean strengthening the ways MS currently exchange information in case of a doubt on long-stay or residence documents at a border check or during an application process. The main means of collaboration are via phone, fax, email and through existing networks; SIRENE, national liaison offices, Police and Customs Cooperation Centres (PCCC), National Contact Centre (NCC), etc.). However, this would overload already busy communication networks, like SIRENE, while not meeting the policy objectives. Since stakeholders described it as burdensome and inefficient, this option did not meet sufficiently the objectives to be further assessed. ·Option 3.1.b – Improve the feeding and use of information in the SIS as regards alerts on withdrawn long-stay and residence documents This option would entail improving the amount and quality of data fed into the SIS. Article 38.2(e) of Council Decision on the establishment, operation and use of the second generation Schengen Information System (SIS II) requires MS to log “issued identity papers such as passports, identity cards, driving licenses, residence permits and travel documents which have been stolen, misappropriated, lost or invalidated''. Although undoubtedly beneficial, this option would not make the exchange of information systematic and would only focus on SIS alerts. Since it does not contribute to the objective of addressing the lack of cooperation and information exchange at time of issuance it is also discarded from further analysis. ·Option 3.1.c – Promote the use of security features for the documents containing a chip: Passive Authentication and Extended Access Control This option would promote the necessity among MS to perform the systematic authentication of the content of the electronic chip of the documents that have a chip. Even if used at its full extent and in combination with the harmonisation of residence cards, would not have any benefits for long-stay visas (since they do not contain a chip). As well as the previous option, it cannot address the objective of cooperation and information exchange at time of issuance and it only partially addresses the objective of fast and effective border controls. This is why it was not further assessed. Legislative options: ·Option 3.2 – Further harmonise and secure long-stay and residence documents Residence permits and long-stay visas are already issued in harmonised format throughout the Schengen area. Both legal bases have been reinforced in 2017. In practice, this sub-option would mean strengthening the format and security features of the remaining residence cards issued without the harmonised format of residence permit. During the adoption of Regulation 380/2008, Member States committed to use the uniform format for residence permits for residence cards. However, some Member States still do not apply this approach (7/25). ·Option 3.3 – Create an interconnection between national databases that would allow all MSs to query each other’s relevant national databases This option entails setting up a distributed database system by interconnecting the existing national databases of long stay visas and residence documents. A distributed database system would allow all MS to query each other’s relevant databases when assessing a long-stay visas or residence document together with the identity of a document holder at an external border crossing point (at second line border check). ·Option 3.4.A and 3.4.B – Integration in the VIS This option is the integration of data on long-stay visas, residence permits and residence cards from national systems into the VIS. Whether to store data or not on applications differentiates the two sub-options analysed 3.4.A (without data on rejected applications) or 3.4.B (with data on rejected applications, which would allow to support future assessment procedures). Long-stayers as a category are now the only TCN category not covered in any of the IT-systems (as was already illustrated with ''missing piece of the puzzle'' in Figure 3, section 2.1.3). By including the category of documents in VIS would ensure they are included in a EU IT-system, under a comparable regime for the same TCN for documents issued either under visa-free conditions (the category of TCN whose data will already be in ETIAS, and EES) and visa-required (TCN coming for a short-stay, whose data is already in VIS, as well as EES). Since long-stayers are not covered by EES, VIS would be the only system where their data could be checked.

5.2.4.Migration and security checks For visa-free travellers, the ETIAS proposal stipulates automatic consultation of ''the data present in a record, file or alert registered in the ETIAS Central System, the Schengen Information System (SIS), [the Entry/Exit System (EES)], the Visa Information System (VIS), [the Eurodac], [the European Criminal Records Information System (ECRIS)], the Europol data, the Interpol Stolen and Lost Travel Document database (SLTD) and the Interpol Travel Documents Associated with Notices database (Interpol TDAWN)''. The same principle could by analogy be applied to checks on visa required travellers through VIS by extending its possibility to query additional databases. In this respect, several options exist: ·Option 4.0 – Status quo In this option the current situation of uneven and manual checks against other non-connected systems would persist. Depending on which Member State is doing the checks, the visa applicants would be checked against different national and European databases. As compared to visa-free travellers, fewer checks will be carried out against centralised European databases. ·Option 4.1 – Systematic and automated check against available databases (ETIAS model) Since the VIS is also part of the legal framework setting up interoperability, technical possibilities have opened up to explore the practical communication between various databases in a fast, seamless and systematic manner by authorised users. In fact, after the interoperability proposal was presented, this is the first time that this framework is applied to an EU policy line. In this way, the option 4.1 is building on the benefits opened by the interoperability proposal. VIS automated database check would follow the same logic as ETIAS. When verifying and assessing the information submitted by applicants, the system would automatically cross-check each application against each of the above mentioned systems (also illustrated in Table 1 below), as well as a dedicated watchlist and would consist of data related to persons who are suspected of having committed or taken part in a criminal offence or persons regarding whom there are factual indications or reasonable grounds to believe that they will commit criminal offences. In this option, the interoperability components will be used. The risk assessment based on checks against databases will be performed in an automated manner using the interoperability component (European Search Portal). Risk assessment Selection criteria Security Migration Serious / cross border crime terrorism Irregular stay (overstay) Entry bans / return decisions Refusal of entry Relevance Data protection Implementation complexity Databases SIS + + + +  + + ETIAS +  + ++ SLTD + +  ++ ++ TDAWN + + + + ++ EES + +  + ++ VIS Components Screening Rules + + ++ - ++ Candidate databases for future integrations ECRIS + + - -- -- EIS + + ++ - -- Watchlist + + ++ - -- EURODAC + -- -- -- ·Option 4.2 – Automated cross-checks + screening rules In addition to automated cross-checks of other databases (option 4.1), automated processing through introducing screening rules in VIS could be envisaged, analogous to the ones used in ETIAS. The screening rules is a new tool, which would be an algorithm enabling the comparison of data in the applications for a short stay visa with specific risk indicators. The screening rules would thus contain on the one hand data analytics rules, and on the other specific values provided by Member States as well as statistics generated from other relevant border management and security databases. This would enhance risk-assessment capability and in particular to allow for the data-analytics method to be applied. The screening rules would not contain any personal data and would be based on statistics and information provided by Member States concerning risk indicators or threats, abnormal rates of refusal or overstay by certain categories of TCN and public health risks. As was stated for the option 4.1, this option is also about applying the interoperability framework, building even further on the benefits opened by the interoperability initiative. 5.3.Options discarded at an early stage ·Copy of the travel document Regarding travel documents, the option of incorporating a digital copy of the travel document in another system, e.g. EES, was discarded, because there are no other large-scale IT systems, existing or planned, which could be used to obtain the same result in respect of the same target population. ·Long-stay visas and residence documents Three non-legislative options were discarded early on: ·Option 3.1.a – Improve the exchange of bilateral information on a case-by-case basis.

·Option 3.1.b – Improve the feeding and use of information in the SIS as regards alerts on withdrawn long-stay and residence documents ·Option 3.1.c – Promote the use of security features for the documents containing a chip: Passive Authentication and Extended Access Control To sum up, while acknowledging their benefits, none of the non-legislative options would fully support the objective of exchange of information, therefore they would not reduce the fragmentation of the information available on TCNs during the issuance process of a new document . 6.What are the impacts of the policy options? A summary of different impacts (including fundamental rights, social impacts and economic impacts) can be found in Annex 3. A detailed consideration on the available data, categories impacted by the envisaged measures and general considerations on data protection are presented in Annex 5. 6.1.Assessment of policy options 6.1.1.Copy of the travel document Economic costs and benefits Two cost estimates were provided during the study on all relevant costs (both one-off and recurrent, as well as recurrent compliance costs) from the options and their sub-options. Eu-LISA estimates the one-off cost for the central system (option 1.1) between € 3,3 – 4 m, while the study places it above € 5 m. For the decentralized system (option 1.2) the study suggests it would entail costs as high as € 200 m. As regards operational costs, eu-LISA places them at around € 375,000 – 560,000 / year. As shown in the following table, the measures will also produce several important economic benefits for consulates as well as Member States’ migration and return authorities. If implemented, they would reduce administrative burden for processing return cases, reduce delays in the procedure and eliminate inefficient procedures involved with retrieving, scanning, zipping and coding hard copies. In fact, both options would be very feasible in practice, since the vast majority Member States are already storing copies of travel document – the options would simply impose a harmonised rule on such storing. Such a change of administrative procedures would in many cases lead to simplification of storing (digital storage). Furthermore, rules on the retention of the travel document (which currently vary among Member States which store copies of it) would be harmonised, which implies moderate changes in national administrative practices. The identified economic benefits are primarily driven by the choice of main option. While Option 1.1 (centralized storage) performs marginally better compared to Option 1.2 (decentralized storage), both options would significantly reduce inefficiencies associated with the current procedures, reflected in significant cost savings (reflected in Table 2 below). Option 1.1 – Centralised Option 1.2 - Decentralised Consulates Cost savings from time spent on responding to supporting document requests € 0,7m – € 2,8 m (€ 366 – € 1.462 per consulate) € 0,7 – € 2,8 m (€ 366 – € 1.462 per consulate) Migration and return authorities Cost savings from time spent on retrieving TD copy € 3,2 – 12,7 m € 3,0 – 12,3 m Cost savings from reduced delays in return procedures Daily costs of delays reduced by up to 14 days € 46,3 m – 92,6 m Daily cost of delays reduced by up to 13,5 days; costs incurred for delays of ½ day € 44,6 – 89,3 m Cost savings from executing a higher proportion of return decisions, in less time € 6,7 m – 21,4 m (if 50% improvement) € 10,0 m – 32,1 m (if 75 % improvement) € 6,6 m – 21,3 m (if 50% improvement) € 9,9 m – 31,9 m (if 75% improvement) Total benefits (50 % improvement) € 57,5 m – 132,2 m € 55,6 m – 128,3 m Total benefits (75 % improvement) € 60,8 m – 142,9 m € 58,9 m – 139,0 m In terms of the impact on duration and timeliness of return proceedings, both options would significantly reduce the waiting time of migration and return authorities during the process of confirming the identity of TCNs. Under Option 1.1, the delays will be effectively eliminated, resulting in a delay reduction of up to 14 days. Option 1.2 would have a slightly lower impact as Member States’ authorities may still be required to wait for several hours before receiving a reply from the responsible national authority for storing the travel document. The potential benefits to be realised from both options will be sufficiently substantial to offset the costs incurred to implement and comply with the respective options, especially for option 1.1 (centralised storage). Policy impacts Whereas the baseline scenario could not achieve any of the two objectives, the storage of visa applicants’ travel documents in VIS will improve the implementation of the objective of facilitating returns of TCNs who have been issued with a return decision. Both Option 1.1 and Option 1.2 will enable Member States to obtain the necessary evidence for proving the nationality of TCN visa overstayers who have been issued with return decisions, but who lack a valid travel document, to equal effect. Moreover, the VIS is the only EU instrument storing data on TCN outside the EU borders, i.e. in the country of origin or another country where the person applies for a visa, therefore the only EU instrument that could provide, in a systematic manner, the necessary data to achieve the stated policy objectives in this case. No other measure is currently available at EU level enabling authorities to obtain a copy of the TCN's travel document. As regards the change of return effectiveness, the copy of the TCN’s travel document will be extremely useful as a means of evidence for the third country regarding the identity and nationality of the person to be returned and thus sufficient for facilitating the return. As return effectiveness hinges also on external factors, such as general cooperativeness of third countries on return, the actual impact is not easy to measure. Objective Option Specific objective I: assist in the identification and return of TCN Specific objective II: efficiency of VIS in return procedures 1.0 Baseline 0 0 1.1 Digital copy of the travel document in the central VIS ++ ++ 1.2 Digital copy of the travel document in national systems + + A – Biographical page only + + B – All used pages ++ ++

Based on inputs provided during the stakeholder consultation, the contracted study cautiously assumed that the proportion of effectively executed returns of TCN visa overstayers without travel documents will increase by 50% to 75% as a result of the proposed options. ·If the proportion of effectively executed returns increases by 50%, then the benefit is an additional 7.934 to 19.834 TCNs returned compared to the current situation. ·If the proportion increases by 75%, then benefit is an additional 11.900 to 29.751 persons returned. These considerations are reflected in considering the scoring of the options for meeting the objectives in Table 3 (above). Impact on the implementation of returns: Additional returns of TCNs without travel documents Estimated number of returns not implemented % improvement Number of additional returns: Scenario of 50% improvement Number of additional returns: Scenario of 75% improvement Lower Upper Lower Upper Lower Upper 15.867 39.668 50% – 75% + 7.934 TCNs returned + 19.834 TCNs returned + 11.900 TCNs returned + 29.751 TCNs returned Fundamental rights impacts The storage of a digital copy of the visa applicants’ travel document in the central VIS (Option 1.1) or national VIS (Option 1.2) can have a positive impact for the right to asylum (Article 18 CFR) and the protection of the principle of non-refoulement (Article 19 CFR) by providing designated authorities which already have access to the VIS with access to additional evidence to prove an asylum seekers’ identity. The sub-options could be useful to asylum authorities for verifying the identity of a person in need of international protection (sub-option A) or for the assessment of merits of asylum cases (sub-option B). The existing safeguard which bans the transfer of personal data to third countries if that person has requested international protection continues to apply (Article 31(3)), mitigating the risk of serious harm for asylum applicants or their families. Sub-options A and B would create an interference with the right to privacy and family life (Article 7 CFR) and the right to the protection of personal data (Article 8 CFR), as it involves the processing of personal data and access to these data by public authorities. Sub-option A implies the processing, of nearly the same amount and type of personal data as is processed in the current situation, merely stored in a different format. The additional category of data is limited to the personal (national) identification number of the document holder. This additional information does not further affect the privacy of the person, and for this reason the limitation to the right to privacy is modest. With respect to the right to data protection, storing a copy of the passport involved further data processing of the image of the document; however, it does not extend the information already available to authorities and the existing rules and conditions of access to this information. Sub-option B involves the processing of a larger amount of new data, consisting in images of used visa pages in addition to data in sub-option A, for all TCNs under visa obligation. Both sub-options meet the objective of enhancing the return rate of TCN under visa obligation and do not go beyond what is necessary to achieve this objective. Existing safeguards, including prohibiting the further processing of these data by authorities as well as to prevent unauthorised access and unlawful sharing with third parties should limit any potential negative impacts implied by both sub-options. As regards sub-option B, additional safeguards should explicitly prohibit the sharing of these data with third parties, given that it is not foreseen to positively contribute to the objective of facilitating return. For both option 1.1 and 1.2 risks with regard to purpose limitation and accessibility of personal information can be mitigated by introducing strict safeguards against unauthorised access. 6.1.2.Biometric data of minors Economic costs and benefits In terms of costs, the one-off costs are higher for option 2.2 (taking fingerprints of all children) than for option 2.1 (lowering the fingerprinting age to 6). This is due to the fact that taking fingerprints of children younger than 6 is likely to require a new, different type of scanners and software. Option 1 (6-12 years) Option 2 (all ages) One-off costs Child- friendly equipment No costs €13 002 000 Increased size of biometric samples in VIS- BMS costs Increased cost by 4.4 % increased costs by 8.8 % Training costs (ESPs, Consulates) € 138 175 € 138 175 Operational costs Workload and administrative burden Range from €52 208 to €261 066 Range from € 208 832 to € 1 044 264 Costs for Member State authorities and opportunity costs Impacts on TCN visa applicants (not related to fundamental rights) Less than one minute additional waiting time per child Less than two minutes additional waiting time per child Impacts for Member States’ visa authorities No costs/ savings No costs/ savings Impacts for Member States’ authorities dealing with missing children/ unaccompanied children Savings unknown Savings unknown Policy impacts Taking fingerprints of children under 12 would support border authorities in detecting identity fraud as it would help them to ascertain whether the child present at the border is the child that has been granted a visa, which means options 2.1 and 2.2 would satisfy the VIS objectives. However, the JRC study on fingerprints concluded that the reliability of fingerprints is lower for children under the age of 6. This is reflected in the scoring of whether the measures would meet the objectives (lowering the fingerprinting age to all ages thus scores lower since fingerprint reliability cannot be guaranteed). Fingerprints constitute a child protection safeguard since collecting and storing them facilitates the identification of traffickers and trafficking networks, as the file of the child in the VIS is linked to that of the parent/adult that accompanied the child. However, as already mentioned in the Eurostat Report on Trafficking in Human Beings, only 2% of victims of trafficking are under 12 years old. On the other hand, 17% of victims are in the 12-17 age range and this much more significant percentage of victims can already be helped if fingerprinting is lowered under 12 years, to take into account the 5-year maximum duration of the validity of the visa (i.e. the 12 to 17 age range for visa holders, corresponds to a potential range of applicants between 7 and 12 years of age). These two factors taken together: lower reliability of fingerprints for children under 6 and relatively lower number of children which could be helped with this measure means that options 2.1 and 2.2 would satisfy the objective of fighting child trafficking to a different degree – as reflected in the scoring:. option 2.2. is less effective in fighting child trafficking than option 2.1.

The prevention of identity fraud is raised by several consulates consulted as part of the supporting study as the main potential benefit of the proposed measure, which means stakeholders recognize it as a positive measure. Objective Option Specific objective I: VIS objectives (fraud, checks, Dublin regulation) Specific objective II: Fight against child trafficking 2.0 Baseline 0 0 2.1 Lowering the fingerprinting age to 6 years ++ ++ 2.2 Lowering the fingerprinting age to all ages +/0 +/0 Under the baseline scenario the fingerprints of each incoming TCN child are not checked nor verified at Schengen entry ports, which means that the baseline scenario 2.0 does not h