EUROPEAN COMMISSION Brussels, 4.5.2016 COM(2016) 272 final 2016/0132(COD) Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on the establishment of 'Eurodac' for the comparison of fingerprints for the effective application of [Regulation (EU) No 604/2013 establishing the criteria and mechanisms for determining the Member State responsible for examining an application for international protection lodged in one of the Member States by a third-country national or a stateless person] , for identifying an illegally staying third-country national or stateless person and on requests for the comparison with Eurodac data by Member States' law enforcement authorities and Europol for law enforcement purposes (recast)



EXPLANATORY MEMORANDUM 1.CONTEXT OF THE PROPOSAL •Reasons for and objectives of the proposal EURODAC was established by Regulation (EC) No 2725/2000 concerning the establishment of "Eurodac" for the comparison of fingerprints for the effective application of the Dublin Convention. A first recast proposal for the amendment of the EURODAC Regulation was adopted by the Council and the European Parliament in June 2013, which enhanced the functioning of EURODAC and laid down conditions for law enforcement access to it under strict conditions for the prevention, detection and investigation of serious crimes and terrorist offences. Since it was established, EURODAC has sufficiently served the purpose of providing fingerprint evidence to assist determine the Member State responsible for examining an asylum application made in the EU. Its primary objective has always been to serve the implementation of Regulation (EU) No. 604/2013 (hereafter "the Dublin Regulation") and together these two instruments make up what is commonly referred to as the 'Dublin system'. When the migration and refugee crisis escalated in 2015, some Member States became overwhelmed with fingerprinting all those who arrived irregularly to the EU at the external borders, and who further transited through the EU en route to their preferred destination. As such, some Member States failed to meet their obligations to take fingerprints under the current EURODAC Regulation. The Communication of the Commission of 13 May 2015, titled "A European Agenda on Migration" noted that "Member States must also implement fully the rules on taking migrants' fingerprints at the borders". This prompted the Commission to bring forward guidance to facilitate systematic fingerprinting, in full respect of fundamental rights, backed up by practical cooperation and exchange of best practices in May 2015. In addition to this the Commission also considered the use of other biometric identifiers to be used for EURODAC, such as facial recognition and the collection of digital photos to counter challenges faced by some Member States to take fingerprints for the purposes of EURODAC. During the same period, those Member States that are not situated at the external borders began to see an increasing need to be able to store and compare information on irregular migrants that were found illegally staying on their territory, particularly where they did not seek asylum. As a consequence, thousands of migrants remain invisible in Europe, including thousands of unaccompanied minors, a situation that facilitates unauthorised secondary and subsequent movements and illegal stay within the EU. It became clear that significant steps had to be taken to tackle irregular migration that occurred within the EU as well as to the EU. The Commission's proposal establishing an Entry/Exit System to register entry and exit data of third country nationals crossing the external borders of the EU where a short-stay visa has been obtained for entry to the EU, will allow Member States to detect third-country nationals who have been staying illegally although they have entered the EU legally. However no such system exists for identifying illegally staying third-country nationals who enter the EU irregularly at the external borders and the current EURODAC system - the ideal database that could host this information - is limited to identifying whether an asylum application has been made in more than one Member State in the EU. On 6 April 2016, in its Communication "Towards a reform of the Common European Asylum System and enhancing legal avenues to Europe" the Commission considered it a priority to bring forward a reform of the Dublin Regulation and establish a sustainable and fair system for determining the Member State responsible for asylum seekers ensuring a high degree of solidarity and a fair sharing of responsibility between Member States by proposing a corrective allocation mechanism. As part of this the Commission considered that EURODAC should be reinforced to reflect changes to the Dublin mechanism and to make sure that it continues to provide the fingerprint evidence it needs to function. It was also considered the EURODAC could contribute to the fight against irregular migration by storing fingerprint data under all categories and allowing comparisons to be made with all stored data for that purpose. Therefore, this proposal amends the current EURODAC Regulation (EU) No. 603/2013, and extends its scope for the purposes of identifying illegally staying third-country nationals and those who have entered the European Union irregularly at the external borders, with a view to using this information to assist a Member State to re-document a third-country national for return purposes. Facilitating the identification of illegally staying third-country nationals or stateless persons through the use of biometrics would contribute to improve the effectiveness of the EU return policy, notably in relation to irregular migrants who use deceptive means to avoid their identification and to frustrate re-documentation. The availability of data and information on third-country nationals without any indentification or lawful reason for being in the EU who are fingerprinted in another Member State would accelerate the procedures for the identification and re-documentation of illegally staying third-county nationals apprehended and fingerprinted in another Member State, hence contributing to reduce the length of the necessary return and readmission procedures, including the period during which irregular migrants may be kept in administrative detention awaiting removal, and combat identity fraud. It would allow identifying country of transit of irregular migrants, hence facilitating their readmission in those countries. Furthermore, by providing information on the movements of irregular migrants within the EU, it would allow national authorities to carry out a more accurate individual assessment of the situation of irregular migrants, for instance on the risk that they may abscond, while undertaking return and readmission procedures. A record number of refugee and migrant children arrived in Europe in 2015 and Member States have struggled to get accurate numbers for unaccompanied and separated children, as formal registration procedures in some Member States do not always allow for their identification when they cross borders. The ongoing migration and refugee crisis has raised profound questions about how to safeguard and protect unaccompanied children by Members of the European Parliament, non-governmental organisations, international organisations and Member States. Child protection and missing children from a third-country in particular has become an additional concern of the ensuing crisis within the EU. Historically, EURODAC has always collected fingerprints of minors from the age of 14 and over, which can allow identification of an unaccompanied minor once an asylum application has been made within the EU. However, given the apparent increase in the smuggling of minors below this age to and within the EU there appears to be a stronger need to collect biometrics for the purposes of EURODAC from a lower age to help with the identification of such persons and to see whether that information can also assist to establish family links or links with a guardian in another Member State. Many Member States collect biometrics from minors at a younger age than 14 years for visas, passports, biometric residence permits and general immigration control. Thus it is also proposed that the taking of fingerprints of minors for EURODAC should be changed to six years old – the age at which research shows that fingerprint recognition of children can be achieved with a satisfactory level of accuracy. It will also be necessary to store information on illegally staying third-country nationals and those apprehended entering the EU irregularly at the external border for longer than what is currently permitted. A storage period of 18 months is the maximum permitted under the current Regulation for those apprehended at the external border and no data is retained for those found illegally staying in a Member State. This is because the current EURODAC Regulation is not concerned with storing information on irregular migrants for longer than what it necessary to establish the first country of entry under the Dublin Regulation if an asylum application had been made in a second Member State. Given the extension of the scope of EURODAC for wider migration purposes, it is necessary to retain this data for a longer period so that secondary movements can be adequately monitored within the EU, particularly where an irregular migrant makes all efforts to remain undetected. A period of five years is deemed to be adequate for these purposes, bringing the data retention period in line with other EU databases in the Justice and Home Affairs (JHA) area and the period for which an entry ban can be imposed on an irregular migrant under the Return Directive. This proposal also allows for information on the identity of an irregular migrant to be shared with a third-country where it is necessary to share that information for return purposes only. The readmission and re-documentation of irregular third-country nationals to their country of origin entails sharing information on that individual with the authorities of that country when a travel document needs to be secured. Thus, this proposal allows data to be shared on that basis and in line with data protection rules. A strict prohibition is set out for sharing any information on the fact that an asylum application has been made within the EU, which could jeopardise a rejected asylum seeker’s safety and lead to a violation of his or her fundamental rights. It is also proposed that an additional biometric – a facial image - will also be collected by Member States and stored in the Central System as well as other personal data to reduce the need for additional communication infrastructure between Member States to share information on irregular migrants that have not claimed asylum. The collection of facial images will be the pre-cursor to introducing facial recognition software in the future and will bring EURODAC in line with the other systems such as the Entry/Exit System. Eu-LISA should first conduct a study on facial recognition software that evaluates its accuracy and reliability prior to this software being added to the Central System. The Commission’s Communication on Stronger and Smarter Information Systems for Borders and Security highlights the need to improve the interoperability of information systems as a long-term objective, as also identified by the European Council and the Council. The Communication proposes to set up an Expert Group on Information Systems and Interoperability to address the legal and technical feasibility of achieving interoperability of the information systems on borders and security. The present proposal is in line with the objectives out in the Communication as it establishes EURODAC in a way that allows for future interoperability with other information systems, where necessary and proportionate. To that end, and with the support of the Expert Group on Information Systems and Interoperability, the Commission will assess the necessity and proportionality of establishing interoperability with the Schengen Information Systems (SIS) and the Visa Information Systems (VIS). In that context, and in line with the Communication, the Commission will also examine if there is a need to revise the legal framework for law enforcement access to EURODAC.

This proposal continues to allow law enforcement access to the Central System and will now permit law enforcement authorities and EUROPOL to have access to all the stored information in the system and to conduct searches based on a facial image in the future. •Consistency with other Union policies This proposal is closely linked and complements other Union policies, namely: (a)The Common European Asylum System by ensuring the effective implementation of the Dublin Regulation by using fingerprint evidence to assist to determine the Member State responsible for examining an asylum application. (b)An effective EU return policy so as to contribute to and enhance the EU system to return irregular migrants. This is essential for maintaining public trust in the EU's asylum system and support for helping persons in need of international protection. Increasing the rate of return of irregular migrants needs to go hand in hand with the EU's renewed efforts to protect those in need. (c)Internal security as was underlined in the European Agenda on Security, to prevent, detect, investigate and prosecute serious crimes and terrorism offences by enabling law enforcement authorities and Europol to process personal data of persons suspected to be involved in acts of terrorism or serious crimes. (d)European Border and Coast Guard Teams as regards the possibility to take and transmit fingerprint and facial image data of asylum applicants and irregular migrants to EURODAC on behalf of a Member State for the effective management of external border control. (e)Data Protection insofar as this proposal must ensure the protection of fundamental rights to respect for the private life of individuals whose personal data are processed in EURODAC. 2.LEGAL BASIS, SUBSIDIARITY AND PROPORTIONALITY •Legal basis The present recast proposal uses Article 78(2)(e) of the Treaty on the Functioning of the European Union (TFEU) as legal base concerning criteria and mechanisms for determining which Member State is responsible for considering an application for asylum or subsidiary protection, which is the TFEU Article corresponding to the legal base of the original proposal (Article 63(1)(a) of the Treaty establishing the European Community). In addition, it uses Article 79(2)(c) as the legal base concerning the elements of indentifying an irregular third-country national or stateless person as regards illegal immigration and unauthorised residence, including removal and repatriation of persons residing without authorisation, Article 87(2)(a) as the legal base concerning the elements related to the collation, storage, processing, analysis and exchange of relevant information for law enforcement purposes; and Article 88(2)(a) as the legal base concerning Europol's field of action and tasks including the collection, storage, processing, analysis and exchange of information. •Variable Geometry The United Kingdom and Ireland are bound by Regulation (EU) No. 603/2013 following their notification of their wish to take part in the adoption and application of that Regulation based on the above-mentioned Protocol. In accordance with Protocol 21 on the position of the United Kingdom and Ireland, those Member States may decide to take part in the adoption of this proposal. They also have this option after adoption of the proposal. Under the Protocol on the position of Denmark, annexed to the TEU and the TFEU, Denmark does not take part in the adoption by the Council of the measures pursuant to Title V of the TFEU (with the exception of "measures determining the third countries whose nationals must be in possession of a visa when crossing the external borders of the Member States, or measures relating to a uniform format for visas"). Therefore, Denmark does not take part in the adoption of this Regulation and is not bound by it nor subject to its application. However, given that Denmark applies the current Eurodac Regulation, following an international agreement that it concluded with the EU in 2006, it shall, in accordance with Article 3 of that agreement, notify the Commission of its decision whether or not to implement the content of the amended Regulation. Impact of the proposal on non-EU Member States associated to the Dublin system In parallel to the association of several non-EU Member States to the Schengen acquis, the Community concluded, or is in the process of doing so, several agreements associating these countries also to the Dublin/EURODAC acquis: –the agreement associating Iceland and Norway, concluded in 2001; –the agreement associating Switzerland, concluded on 28 February 2008; –the protocol associating Liechtenstein, concluded on 18 June 2011.

In order to create rights and obligations between Denmark – which as explained above has been associated to the Dublin/EURODAC acquis via an international agreement – and the associated countries mentioned above, two other instruments have been concluded between the Community and the associated countries. In accordance with the three above-cited agreements, the associated countries shall accept the Dublin/EURODAC acquis and its development without exception. They do not take part in the adoption of any acts amending or building upon the Dublin acquis (including therefore this proposal) but have to notify to the Commission within a given time-frame of their decision whether or not to accept the content of that act, once approved by the Council and the European Parliament. In case Norway, Iceland, Switzerland or Liechtenstein do not accept an act amending or building upon the Dublin/EURODAC acquis, the "guillotine" clause is applied and the respective agreements will be terminated, unless the Joint/Mixed Committee established by the agreements decides otherwise by unanimity. The scope of the above-cited association agreements with Iceland, Norway, Switzerland and Liechtenstein as well as the parallel agreement with Denmark does not cover law enforcement access to EURODAC. Consequently, once this Recast Regulation is adopted it will be necessary to ensure that complementary agreements with those Associated States that wish to participate have been signed and concluded. The current proposal, stipulates that the comparison of fingerprint data using EURODAC may only be made after national fingerprint databases and the Automated Fingerpirnt Databases of other Member States under Council Decision 2008/615/JHA (the Prüm Agreements) return negative results. This rule means that if any Member State has not implemented the above Council Decision and cannot perform a Prüm check, it also may not make a EURODAC check for law enforcement purposes. Similarly, any associated States that have not implemented or do not participate in the Prüm Agreements may not conduct such a EURODAC check. •Subsidiarity The proposed initiative constitutes a further development of the Dublin Regulation and EU migration policy and in order to ensure that common rules on for the taking of fingerprints and facial image data for irregular third-country nationals for the purposes of EURODAC are applied in the same way in all the Member States. It creates an instrument providing to the European Union information on how many third country nationals enter the EU irregularly and claim asylum, which is indispensable for sustainable and evidence based policy making in the field of migration and visa. It also grants access for law enforcement authorities to EURODAC, which is a timely, accurate, secure and cost-efficient way to identify irregular third-country nationals who are suspects (or victims) of terrorism or of a serious crime. This proposal will also assist Member States to identify illegally staying third-country nationals and those who have entered the European Union irregularly at the external borders, with a view to using this information to assist a Member State to re-document a third-country national for return purposes. Due to the transnational nature of the problems related to asylum and refugee protection, the EU is well placed to propose solutions in the framework of the Common European Asylum System (CEAS) to the issues described above as problems regarding the EURODAC Regulation. An amendment of the EURODAC Regulation is also required in order to add an additional purpose thereto, namely allow access for the purpose to control illegal migration to and secondary movements of irregular migrants within the EU. This objective cannot be sufficiently achieved by the Member States alone. •Proportionality Article 5 of the Treaty on the European Union states that action by the Union shall not go beyond what is necessary to achieve the objectives of the Treaty. The form chosen for this EU action must enable the proposal to achieve its objective and be implemented as effectively as possible. The proposal which conception is driven by the privacy by design principles is proportionate in terms of the right to protection of personal data in that it does not require the collection and storage of more data for a longer period than is absolutely necessary to allow the system to function and meet its objectives. In addition, all the safeguards and mechanisms required for the effective protection of the fundamental rights of travellers particularly the protection of their private life and personal data will be foreseen and implemented. No further processes or harmonisation will be necessary at EU level to make the system work; thus the envisaged measure is proportionate in that it does not go beyond what is necessary in terms of action at EU level to meet the defined objectives. •Choice of the instrument The proposed recast will also take the form of a Regulation. The present proposal will build on and enhance an existing centralised system through which Member States cooperate with each other, something which requires a common architecture and operating rules. Moreover, it lays down rules on access to the system including for the purpose of law enforcement which are uniform for all Member States. As a consequence, only a Regulation can be chosen as a legal instrument. 3.CONSULTATIONS WITH INTERESTED PARTIES In preparation of this proposal, the Commission has relied upon the discussions that have been regularly taking place in the European Council and in the Council of Ministers, as well as in the European Parliament on the measures needed to address the migratory crisis and in particular on the reform of the Dublin Regulation, which EURODAC is intrinsically attached to. The Commission has also reflected on the needs of Member States that became apparent during the refugee and migration crisis. In particular, the Council Conclusions of the European Council of 25-26 June 2015, called for the reinforcement of the management of the Union’s external borders to better contain the growing flows of illegal migration. At a further meeting of Heads of State or Government in October 2015, the European Council concluded that Member States needed to step up implementation of the Return Directive and ensure that all those arriving at the hotspots would be identified, registered and fingerprinted and at the same time ensure relocation and returns. In March 2016, the European Council further reiterated that work will also be taken forward on the future architecture of the EU's migration policy, including the Dublin Regulation.

The Commission has also informally consulted the European Data Protection Advisor on the new elements of this proposal that are subject to the new legal framework on Data Protection. •Fundamental rights The proposed Regulation has an impact on fundamental rights, notably on right to human dignity (Article 1 of the Charter of Fundamental Rights of the EU); the prohibition of slavery and forced labour (Article 5 of the Charter); right to liberty and security (Article 6 of the Charter), respect for private and family life (Article 7 of the Charter), the protection of personal data (Article 8 of the Charter), right to asylum (Article 18 of the Charter) and protection in the event of removal, expulsion or extradition (Article 19 of the Charter), the right to non-discrimination (Article 21 of the Charter), the rights of the child (Article 24 of the Charter) and the right to an effective remedy (Article 47 of the Charter). The prohibition of slavery and forced labour as well as the right to liberty and security are positively affected by the implementation of EURODAC. A better and more accurate identification (through the use of biometrics) of third-country nationals crossing the external border of the EU supports the detection of identity fraud, human being trafficking (particularly in the case of minors) and cross border criminality and thus contributes to the fight against trafficking and smuggling in human beings. It also contributes to improving the security of the citizens anyone present in the EU area on the EU territory. The proposal also positively contributes to the protection of the rights of the child and to the respect of the right to respect for family life. Many applicants for international protection and third-country nationals arriving irregularly to the European Union travel with families and in many cases very young children. Being able to identify these children with the help of fingerprints and facial images will help identify children in cases where they are separated from their families by allowing a Member State to follow up a line of inquiry where a fingerprint match indicates that they were present in another Member State. It would also strengthen the protection of unaccompanied minors who do not always formally seek international protection and who abscond from care institutions or child social services under which their care has been assigned. The obligation to take fingerprints shall be implemented in full respect of the right to human dignity and of the rights of the child. The proposal reaffirms the obligation upon Member States to ensure that the procedure for taking fingerprints and a facial image shall be determined and applied in accordance with the national practice of the Member State concerned and in accordance with the safeguards laid down in the Charter of Fundamental Rights of the European Union, in the Convention for the Protection of Human Rights and Fundamental Freedoms and in the United Nations Convention on the Rights of the Child. Penalties attached to the failure to comply with the obligation to comply with the fingerprinting process shall be in accordance with the principle of proportionality. In particular, the proposal explicitly states that detention should only be used in this context as a means of last resort if necessary to determine or verify a third-country national's identity. As regards children, the taking of fingerprints from minors, particularly young children, should be carried out in a child-sensitive and child-friendly manner. Relevant provisions also ensure that a child is not subject to any administrative sanctions where there is a justified reason for not submitting their fingerprints or a facial image and that the authorities of a Member State must ensure that where they suspect that there may be child protection issues following a refusal to submit fingerprints or where a child may have damaged fingertips or hands, they should refer the child to the national child protection authorities. The implementation of the proposal shall be without prejudice to the rights of applicant for and beneficiaries of international protection, in particular as regards the prohibition in the event of removal, expulsion and extradition, including in the context of transfers of personal data to third countries. As stipulated by Article 52(1) of the Charter, any limitation to the right to the protection of personal data must be appropriate for attaining the objective pursued and not going beyond what is necessary to achieve it. Article 8(2) of the European Convention of Human Rights also recognises that interference by a public authority with a person’s right to privacy may be justified as necessary in the interest of national security, public safety or the prevention of crime, as it is the case in the current proposal. The proposal provides for access to EURODAC for the prevention, detection or investigation of terrorist offences or other serious criminal offences for the purposes of identification of third country nationals crossing the external borders and for the purpose of accessing data on their travel history. Safeguards as regards personal data also include the right of access to or the right of correction or deletion of data. The limitation of the retention period of data referred to above in chapter 1 of this explanatory memorandum also contributes to the respect for personal data as a fundamental right. The proposal provides for access to EURODAC for the prevention, detection or investigation of terrorist offences or other serious criminal offences for the purposes of identification of third country nationals crossing the external borders and for the purpose of accessing data on their movements within the EU. Moreover, designated law enforcement authorities may only request access to EURODAC data if there are reasonable grounds to consider that such access will substantially contribute to the prevention, detection or investigation of the criminal offence in question. Such requests are verified by a designated law enforcement authority in order to check whether the strict conditions for requesting access to the EES for law enforcement purposes are fulfilled. Furthermore, the proposal also lays down strict data security measures to ensure the security of personal data processed and establishes supervision of the processing activities by independent public data protection authorities and documentation of all searches conducted. The proposal also states that the processing of all personal data carried out by law enforcement authorities in EURODAC once they have been extracted is subject to the new data protection Directive for the processing of personal data for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties that repeals Council Framework Decision 2008/977/JHA. The proposal establishes strict access rules to EURODAC and the necessary safeguards. It also foresees the individuals' rights of access, correction, deletion and redresses in particular the right to a judicial remedy and the supervision of processing operations by public independent authorities. Therefore, the proposal fully complies with the Charter of Fundamental Rights of the European Union, in particular as regards the right to the protection of personal data, and is also in line with Article 16 TFEU which guarantees everyone the right to protection of personal data concerning them. 4.BUDGETARY IMPLICATIONS The present proposal entails a technical amendment to the EURODAC central system in order to provide for the possibility to carry out comparisons for all three categories of data and for storage of all three categories of data. Further functionalities such as the storage of biographical data alongside side a facial image will require more amendments to the Central System The financial statement attached to this proposal reflects this change. The cost estimate of 29.872 million EUR includes costs for the technical upgrade and increased storage and throughput of the Central System. It also consists of IT-related services, software and hardware and would cover the upgrade and customisation to allow searches for all categories of data covering both asylum and irregular migration purposes. It also reflects the additional staffing costs required by eu-LISA. 5.OTHER ELEMENTS •Detailed explanation of the specific provisions of the proposal - Extending the scope of EURODAC for return purposes (Article 1(1)(b)): The scope of the new EURODAC Regulation has been extended to include the possibility for Member States to store and search data belonging to third-country nationals or stateless persons who are not applicants for international protection so that they can be identified for return and readmission purposes. A new legal base, Article 79(2)(c) has been added for these purposes. Thus EURODAC becomes a database for wider immigration purposes and no longer only exists to ensure the effective implementation of the Dublin III Regulation, although this function will still be an important aspect of it. At present EURODAC only compares fingerprint data taken from irregular migrants and applicants for international protection against asylum data because it is an asylum database. Comparisons are not made between fingerprint data taken from irregular migrants at the external borders and fingerprint data taken from third-country nationals found illegally staying on the territory of a Member State. Extending the scope of EURODAC will allow the competent immigration authorities of a Member State to transmit and compare data on those illegally staying third-country nationals who do not claim asylum and who may move around the European Union undetected. The information obtained in a hit result may then assist competent Member State authorities in their task of identifying illegally staying third-country nationals on their territory for return purposes. It may also provide precious elements of evidence for re-documentation and readmission purposes. - Ensuring the primacy of the Dublin procedure (Articles 15(4) and 16 (5)): a provision has been included to ensure that where a fingerprint hit indicates that an asylum application has been made in the European Union, the Member State that conducted the search should ensure that the Dublin procedure is followed as a matter of course and not a return procedure for the individual concerned. This is to guarantee that where multiple hits are retrieved from the Central System relating to the same individual, the Member State that consulted EURODAC is left in no doubt about the correct procedure to follow and so that no applicant for international protection is returned to their country of origin or to a third-country in breach of the principle of non-refoulement. Thus the notion of a “hierarchy of hits” has been introduced to allow for this.

- Obligation to take fingerprints and facial images (Article 2): the proposal specifies a clear obligation for Member States to take and transmit fingerprints and a facial image of all three categories of persons and makes sure that Member States impose these obligations on applicants of international protection and third-country nationals or stateless persons so that they are aware. The obligation to take fingerprints has always existed and was communicated to the data-subject via information in the form of a leaflet under Article 29(1)(d) of Regulation (EU) No. 603/2013. This Article also permits Member States to introduce sanctions, in accordance with their national law, for those individuals who refuse to provide a facial imagine or comply with the fingerprinting procedure, following, where relevant, the Commission Staff Working Document on the implementation of the Eurodac Regulation as that sets out a best practice approach for Member States to follow to obtain fingerprints. However, new provisions have been laid down to ensure that the taking of fingerprints and a facial image from minors, particularly young children, should be carried out in a child-sensitive and child-friendly manner. These provisions also ensure that a minor is not subject to any administrative sanctions if they do not submit their fingerprints or a facial image, where there is good reason for not submitting them and that the authorities of a Member State must ensure that where they suspect that there may be child protection issues following a refusal to submit fingerprints or a facial image or where a child may have damaged fingertips or hands, they should refer the child to the national child protection authorities. - Storing the personal data of the data-subject (Articles 12, 13 and 14): EURODAC has always functioned with fingerprints only and previously no other personal data of the data-subject was stored apart from the gender of the individual. The new proposal now permits the storage of personal data of the data-subject such as the name(s), age, date of birth, nationality, and identity documents, as well as a facial image. The storage of personal data will allow immigration and asylum authorities to easily identify an individual, without the need to request this information directly from another Member State. Personal data of the individual can be retrieved from the Central System on a hit or no hit basis only. This is to safeguard the right of access to this data, thus where there is no fingerprint or facial image match the personal data cannot be obtained. For the purposes of the Dublin Regulation, new information is required to be updated in EURODAC relating to the Member State that becomes responsible for examining an asylum application following allocation of an applicant to another Member State. This will then make clear which Member State is responsible under the recast Dublin Regulation, if an applicant absconds or claims asylum in another Member State following an allocation procedure and a fingerprint hit. - Biometric identifiers (Articles 2, 15, and 16): The current EURODAC Regulation allows for the comparison of fingerprint data only. In 2015, the European Agenda on Migration suggested the possibility to add other biometric identifiers to EURODAC in order to mitigate some of the challenges Member States were facing with damaged fingertips and non-compliance with the fingerprint process. This proposal inserts a requirement for Member States to take a facial image of the data-subject for transmission to the Central System and includes provisions to make a comparison of fingerprint and facial image data together and facial images separately under defined conditions. The insertion of facial images into the Central System now will prime the system for searches to be made with facial recognition software in the future. Member States will continue to take the fingerprints of all ten fingers as plain and rolled impressions and this will now apply to individuals who are found illegally staying in a Member State because the same set of fingerprints will be needed for all three categories to be compared accurately. - Comparison and transmission of all categories of all data (Articles 15 and 16): whereas under Regulation (EU) No. 603/2013, only two fingerprint categories were stored and data could only be searched against fingerprint data of applicants for international protection, the fingerprint and facial image data of all three categories of data will now be stored and compared against each other. This will allow the immigration authorities in a Member State to ascertain whether an illegally staying third-country national in a Member State has claimed asylum, or has entered the EU illegally at the external border. In the same vein it will allow a Member State to check whether someone apprehended crossing the external border irregularly was ever illegally staying in another Member State. Widening the scope of searches allows a pattern of irregular and secondary movements to be followed throughout the European Union, and can lead to establishing the identity of the individual concerned in the absence of valid identity documents. - Lowering the age of taking fingerprints to 6 years old (Articles 10, 13 and 14): the age for taking fingerprints has always historically been 14 years of age. The study conducted by the Commission's Joint Research Centre, on 'Fingerprint Recognition for children'indicates that fingerprints taken from children age six and above can be used in automated matching scenarios such as EURODAC when sufficient care is taken to acquire good quality images. Indeed many Member States take the fingerprints of children at a lower age than six for national purposes, such as issuing a passport or a biometric residence permit. Many applicants for international protection and third-country nationals arriving irregularly to the European Union travel with families and in many cases very young children. Being able to identify these children with the help of fingerprints and facial images will help identify children in cases where they are separated from their families by allowing a Member State to follow up a line of inquiry where a fingerprint match indicates that they were present in another Member State. It would also strengthen the protection of unaccompanied minors who do not always formally seek international protection and who abscond from care institutions or child social services under which their care has been assigned. Under the current legal and technical framework their identity cannot be established. Thus the EURODAC system could be used to register children from third-countries where they are found undocumented within the EU to help keep track of them and prevent them from ending up in scenarios of exploitation. - Data retention (Article 17): the data retention period of applicants for international protection remains the same at 10 years. This is to ensure that Member States can track secondary movements within the European Union following a grant of international protection status where the individual concerned is not authorised to reside in another Member State. Given that the recast Dublin Regulation will include in its scope beneficiaries of international protection, this data can now be used to transfer back refugees or persons granted subsidiary protection status to the Member State that granted them such protection. Fingerprint data for illegally staying third-country nationals who do not claim asylum will be retained for five years. This is because EURODAC is no longer a database for asylum applicants only and retaining this data for longer is necessary to ensure that illegal immigration and secondary movements within and to the EU can be sufficiently monitored. This storage period is aligned with the maximum period for placing an entry ban on an individual for migration purposes as set out in Article 11 of the Returns Directive 2008/115/EC, the data retention period for storing information on a visa (Article 23 of the Visa Regulation), and the proposed data retention period for storing data in the Entry/Exit System (Article 31 of the EES). - Advanced data erasure (Article 18): advanced data erasure remains the same for applicants for international protection and irregular third-country nationals or stateless persons who are granted citizenship. Data belonging to these individuals that is stored in the central system will be deleted in advance if citizenship of a Member State is obtained because they no longer fall within the scope of EURODAC. Data will no longer be deleted in advance for illegally staying third-country nationals or stateless persons who were granted a residence document or left the territory of the European Union. It is necessary to retain this data in case at some point a residence document, which normally confers limited leave, is no longer valid and the individual overstays, or the illegally staying third-country national who had returned to a third country may attempt to re-enter the EU in an irregular manner again. - Marking of data for illegally staying third-country nationals (Article 19 (4) and (5)): Currently under the EURODAC Regulation, the data of illegally staying third-country nationals who do not lodge an application for asylum within the European Union is erased in advance once a residence document is obtained. The proposal introduces changes to allow for this data to be marked instead of erased in advance, so that when a Member State conducts a search in EURODAC, which results in a marked hit from the Central system, it can ascertain immediately that the illegally staying third-country national has been given a residence document by another Member State. It may then be possible, under Article 6(2) of the Return Directive to pass back the individual to the Member State that issued the residence document. Data for applicants for international protection is blocked for law enforcement purposes after three years; however, the data of illegally staying third-country nationals, who do not apply for international protection and who have been granted a temporary residence document, will not be blocked for law enforcement purposes. This is to ensure that where a residence document expires before the five-year data retention period lapses, the data is still searchable. Data belonging to asylum applicants will continue to be treated differently in this respect because asylum applicants are more likely to obtain a renewal of their residence permit as a beneficiary of international protection or a long-term residence permit. -Sharing information obtained from EURODAC with third-countries (Article 38): sharing information with a third country, international organisation or private entity is strictly prohibited under the current Regulation. Extending the scope of EURODAC to assist a Member State to use EURODAC data for identifying and re-documenting an illegally staying third-country national for return and readmission purposes will necessarily entail sharing that data in some circumstances, with a third country - for the legitimate and sole purposes of return. Thus a specific provision to allowing sharing data with third countries for return purposes has been included, that sets out very strict conditions under which this data can be shared. It also strictly forbids the EURODAC database to be accessed by a third country, which is not a party to the Dublin Regulation, or to allow a Member State to check data on behalf of a third country. By adding this provision on sharing data with third countries, EURODAC is aligned with other databases such as the VIS and the Entry/Exit System that also contain similar provisions for sharing information for return purposes. - Access for law enforcement authorities and EUROPOL(Article 20 (3)): minor amendments have been made to the provisions for law enforcement access to make sure that all three categories of data stored in the Central System can be compared against when a law enforcement search is carried out and to allow in the future, a search based on a facial image. -Allowing European Border and Coast Guards and EASO Member State experts to take fingerprints (Article 10(3) and 13 (7): the proposal permits, at the discretion of a Member State, the European Border [and Coast] Guard Agency and Member State's asylum experts that are deployed to a Member State under the auspices of EASO, to take and transmit fingerprints to EURODAC on behalf of a Member State. The proposal limits these functions to areas where both Agencies' mandates permit them do this (i.e. at the external border for those entering illegally and for asylum applicants). - Statistics (Article 9): to allow for more transparency of EURODAC data, amendments have been made to the type of statistics that are published and the frequency of publication by eu-LISA. New provisions have been included to allow for statistical data obtained from EURODAC to be shared with the relevant Justice and Home Affairs Agencies for analysis and research purposes. Statistics produced by eu-LISA for these purposes should not report any names, individual date of births, or any personal data that would individually identify a data-subject. Amendments have also been introduced to allow the Commission to request ad-hoc statistics from eu-LISA on request. - Architecture and operational management of the Central System (Article 4 and 5): changes have been made to the communication infrastructure to allow for the Central System to make use of the Eurodomain, which will bring significant economies of scale. The operational management of DubliNet as an existing separate communication infrastructure for the purposes of the Dublin Regulation has also been incorporated under the system architecture and will ensure that both its financial and operational management is transferred to eu-LISA, who currently is only responsible for its operational management via a separate Memorandum of Understanding with the Commission (DG HOME).

- Providing information on false hits (Article 26(6)): Member States will now be required to inform only eu-LISA of the fact that a false hit was received by the Central System and give eu-LISA information relating to that hit so that they can unlink the false hit records from the database. In the future eu-LISA will compile statistics on the number of reported false hits so that the Commission will no longer need to be informed directly of a false hit. - Using real personal data for testing (Article 5(1)): When it has come to testing the EURODAC Central System, eu-LISA has been restricted to using 'dummy data' for the test environment and to test new technologies, which has failed to yield good test results because of the data used. The proposal allows for the use of real personal data when testing the Central System for diagnostics and repair, as well as the use of new technologies and techniques, subject to stringent conditions and on the basis that the data is anonymised for the testing purposes and cannot be used for individual identification. ê 603/2013 (adapted) 2016/0132 (COD) Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on the establishment of 'Eurodac' for the comparison of fingerprints for the effective application of [Regulation (EU) No 604/2013 establishing the criteria and mechanisms for determining the Member State responsible for examining an application for international protection lodged in one of the Member States by a third-country national or a stateless person] Ö , for identifying an illegally staying third-country national or stateless person Õ and on requests for the comparison with Eurodac data by Member States' law enforcement authorities and Europol for law enforcement purposes, and amending Regulation (EU) No 1077/2011 establishing a European Agency for the operational management of large-scale IT systems in the area of freedom, security and justice (recast) THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION, Having regard to the Treaty on the Functioning of the European Union, and in particular Articles 78 (2)(e), Ö 79(2)(c), Õ 87(2)(a) and 88(2)(a) thereof, Having regard to the proposal from the European Commission After transmission of the draft legislative act to the national Parliaments, Having regard to the opinion of the European Data Protection Supervisor, Acting in accordance with the ordinary legislative procedure, Whereas: ê 603/2013 recital 1 (adapted) (1)A number of substantive changes are to be made to Council Regulation (EC) No 2725/2000 of 11 December 2000 concerning the establishment of 'Eurodac' for the comparison of fingerprints for the effective application of the Dublin Convention and to Council Regulation (EC) No 407/2002 of 28 February 2002 laying down certain rules to implement Regulation (EC) No 2725/2000 concerning the establishment of "Eurodac" for the comparison of fingerprints for the effective application of the Dublin Convention Ö Regulation (EU) No 603/2013 of the European Parliament and of the Council Õ . In the interests of clarity, those Ö that Õ Regulations should be recast.

ê 603/2013 recital 2 (2)A common policy on asylum, including a Common European Asylum System, is a constituent part of the European Union's objective of progressively establishing an area of freedom, security and justice open to those who, forced by circumstances, seek international protection in the Union. ê 603/2013 recital 3 (adapted) (3)The European Council of 4 November 2004 adopted The Hague Programme which set the objectives to be implemented in the area of freedom, security and justice in the period 2005-2010. The European Pact on Immigration and Asylum endorsed by the European Council of 15-16 October 2008 called for the completion of the establishment of a Common European Asylum System by creating a single procedure comprising common guarantees and a uniform status for refugees and for persons eligible for subsidiary protection. ê 603/2013 recital 4 (adapted) (4)For the purposes of applying Regulation (EU) No […/…] of the European Parliament and of the Council ] of 26 June 2013 establishing the criteria and mechanisms for determining the Member State responsible for examining an application for international protection lodged in one of the Member States by a third-country national or a stateless person , it is necessary to establish the identity of applicants for international protection and of persons apprehended in connection with the unlawful crossing of the external borders of the Union. It is also desirable, in order effectively to apply Regulation (EU) No […/…], and in particular Articles[..] and [..]) thereof, to allow each Member State to check whether a third-country national or stateless person found illegally staying on its territory has applied for international protection in another Member State. ê 603/2013 recital 5 (adapted) ð new (5)Fingerprints ð Biometrics ï constitute an important element in establishing the exact identity of such persons. It is necessary to set up a system for the comparison of their fingerprint ð and facial image ï data. ê 603/2013 recital 6 ð new (6)To that end, it is necessary to set up a system known as 'Eurodac', consisting of a Central System, which will operate a computerised central database of fingerprint ð and facial image ï data, as well as of the electronic means of transmission between the Member States and the Central System, hereinafter the "Communication Infrastructure". ò new (7)For the purposes of applying and implementing Regulation (EU) No. […/…] it is also necessary to ensure that a separate secure communication infrastructure exists, which Member State's competent authorities for asylum can use for the exchange of information on applicants for international protection. This secure electronic means of transmission shall be known as 'DubliNet' and should be managed and operated by eu-LISA.

ê 603/2013 recital 7 (adapted) (8)The Hague Programme called for the improvement of access to existing data filing systems in the Union. In addition, The Stockholm Programme called for well targeted data collection and a development of information exchange and its tools that is driven by law enforcement needs. ò new (9)In 2015, the refugee and migration crisis brought to the fore challenges faced by some Member States with taking fingerprints of illegally staying third-country nationals or stateless persons who attempted to avoid the procedures for determining the Member State responsible for examining an application for international protection. The Communication of the Commission of 13 May 2015, titled "A European Agenda on Migration" noted that "Member States must also implement fully the rules on taking migrants' fingerprints at the borders" and further proposed that "The Commission will also explore how more biometric identifiers can be used through the Eurodac system (such as using facial recognition techniques through digital photos)". (10)To assist Member States overcome challenges relating to non-compliance with the fingerprinting process, this Regulation also permits the comparison of a facial image without fingerprints as a last resort, where it is impossible to take the fingerprints of the third-country national or stateless person because his or her fingertips are damaged, either intentionally or not, or amputated. Member States should exhaust all attempts to ensure that fingerprints can be taken from the data-subject before a comparison using a facial image only can be carried out where non-compliance based on reasons not relating to the conditions of the individual's fingertips are given. Where facial images are used in combination with fingerprint data, it allows for the reduction of fingerprints registered while enabling the same result in terms of accuracy of the identification. (11)The return of third-country nationals who do not have a right to stay in the Union, in accordance with fundamental rights as general principles of Union law as well as international law, including refugee protection and human rights obligations, and in compliance with the provisions of Directive 2008/115/EC, is an essential part of the comprehensive efforts to address migration and, in particular, to reduce and deter irregular migration. To increase the effectiveness of the Union system to return illegally staying third-country nationals is needed in order to maintain public trust in the Union migration and asylum system, and should go hand in hand with the efforts to protect those in need of protection. (12)National authorities in the Member States experience difficulties in identifying illegally staying third-country nationals who use deceptive means to avoid their identification and to frustrate the procedures for re-documentation in view of their return and readmission. It is therefore essential to ensure that information on third-country nationals or stateless persons who are found to be staying illegally in the EU are collected and transmitted to Eurodac and are compared also with those collected and transmitted for the purpose of establishing the identity of applicants for international protection and of third-country nationals apprehended in connection with the unlawful crossing of the external borders of the Union, in order to facilitate their identification and re-documentation and to ensure their return and readmission, and to reduce identity fraud. It should also contribute to reducing the length of the administrative procedures necessary for ensuring return and readmission of illegally staying third-country nationals, including the period during which they may be kept in administrative detention awaiting removal. It should also allow identifying third countries of transit, where the illegally staytng third-country national may be readmitted. (13)In its Conclusions of 8 October 2015 on the future of return policy, the Council endorsed the initiative announced by the Commission to explore an extension of the scope and purpose of Eurodac to enable the use of data for return purposes. Member States should have the necessary tools at their disposal to be able to detect illegal migration to and secondary movements of illegally staying third-country nationals in the Union. Therefore, the data in Eurodac should be available, subject to the conditions set out in this Regulation, for comparison by the designated authorities of the Member States. (14)The Commission’s Communication on Stronger and Smarter Information Systems for Borders and Security highlights the need to improve the interoperability of information systems as a long-term objective, as also identified by the European Council and the Council. The Communication proposes to set up an Expert Group on Information Systems and Interoperability to address the legal and technical feasibility of achieving interoperability of the information systems for borders and security. This group should assess the necessity and proportionality of establishing interoperability with the Schengen Information Systems (SIS) and the Visa Information Systems (VIS), and examine if there is a need to revise the legal framework for law enforcement access to EURODAC. ê 603/2013 recital 8 (15)It is essential in the fight against terrorist offences and other serious criminal offences for the law enforcement authorities to have the fullest and most up-to-date information if they are to perform their tasks. The information contained in Eurodac is necessary for the purposes of the prevention, detection or investigation of terrorist offences as referred to in Council Framework Decision 2002/475/JHA of 13 June 2002 on combating terrorism or of other serious criminal offences as referred to in Council Framework Decision 2002/584/JHA of 13 June 2002 on the European arrest warrant and the surrender procedures between Member States. Therefore, the data in Eurodac should be available, subject to the conditions set out in this Regulation, for comparison by the designated authorities of Member States and the European Police Office (Europol). ê 603/2013 recital 9 (16)The powers granted to law enforcement authorities to access Eurodac should be without prejudice to the right of an applicant for international protection to have his or her application processed in due course in accordance with the relevant law. Furthermore, any subsequent follow-up after obtaining a 'hit' from Eurodac should also be without prejudice to that right. ê 603/2013 recital 10 (adapted) (17)The Commission outlines Ö outlined Õ in its Communication to the Council and the European Parliament of 24 November 2005 on improved effectiveness, enhanced interoperability and synergies among European databases in the area of Justice and Home Affairs that authorities responsible for internal security could have access to Eurodac in well-defined cases, when there is a substantiated suspicion that the perpetrator of a terrorist or other serious criminal offence has applied for international protection. In that Communication the Commission also found that the proportionality principle requires that Eurodac be queried for such purposes only if there is an overriding public security concern, that is, if the act committed by the criminal or terrorist to be identified is so reprehensible that it justifies querying a database that registers persons with a clean criminal record, and it concluded that the threshold for authorities responsible for internal security to query Eurodac must therefore always be significantly higher than the threshold for querying criminal databases.

ê 603/2013 recital 11 (18)Moreover, Europol plays a key role with respect to cooperation between Member States' authorities in the field of cross-border crime investigation in supporting Union-wide crime prevention, analyses and investigation. Consequently, Europol should also have access to Eurodac within the framework of its tasks and in accordance with Council Decision 2009/371/JHA of 6 April 2009 establishing the European Police Office (Europol). ê 603/2013 recital 12 (19)Requests for comparison of Eurodac data by Europol should be allowed only in specific cases, under specific circumstances and under strict conditions. ê 603/2013 recital 13 ð new (20)Since Eurodac was originally established to facilitate the application of the Dublin Convention, access to Eurodac for the purposes of preventing, detecting or investigating terrorist offences or other serious criminal offences constitutes a change of the original purpose of Eurodac, which interferes with the fundamental right to respect for the private life of individuals whose personal data are processed in Eurodac. ð In line with the requirements of Article 52(1) of the Charter of Fundamental Rights of the European Union, ï Aany such interference must be in accordance with the law, which must be formulated with sufficient precision to allow individuals to adjust their conduct and it must protect individuals against arbitrariness and indicate with sufficient clarity the scope of discretion conferred on the competent authorities and the manner of its exercise. Any interference must be necessary in a democratic society to protect a legitimate and proportionate ð to genuinely meet an objective of general ï interest and proportionate to the legitimate objective it aims to achieve. ê 603/2013 recital 14 (21)Even though the original purpose of the establishment of Eurodac did not require the facility of requesting comparisons of data with the database on the basis of a latent fingerprint, which is the dactyloscopic trace which may be found at a crime scene, such a facility is fundamental in the field of police cooperation. The possibility to compare a latent fingerprint with the fingerprint data which is stored in Eurodac in cases where there are reasonable grounds for believing that the perpetrator or victim may fall under one of the categories covered by this Regulation will provide the designated authorities of the Member States with a very valuable tool in preventing, detecting or investigating terrorist offences or other serious criminal offences, when for example the only evidence available at a crime scene are latent fingerprints. ê 603/2013 recital 15 (22)This Regulation also lays down the conditions under which requests for comparison of fingerprint data with Eurodac data for the purposes of preventing, detecting or investigating terrorist offences or other serious criminal offences should be allowed and the necessary safeguards to ensure the protection of the fundamental right to respect for the private life of individuals whose personal data are processed in Eurodac. The strictness of those conditions reflects the fact that the Eurodac database registers fingerprint data of persons who are not presumed to have committed a terrorist offence or other serious criminal offence. ê 603/2013 recital 16 (adapted) (23)With a view to ensuring equal treatment for all applicants and beneficiaries of international protection, as well as in order to ensure consistency with the current Union asylum acquis, in particular with Directive 2011/95/EU of the European Parliament and of the Council of 13 December 2011 on standards for the qualification of third-country nationals or stateless persons as beneficiaries of international protection, for a uniform status for refugees or for persons eligible for subsidiary protection, and for the content of the protection granted and Regulation (EU) No […/…]604/2013, it is appropriate to extend the scope of this Regulation in order to include Ö includes Õ applicants for subsidiary protection and persons eligible for subsidiary protection Ö in its scope Õ . ê 603/2013 recital 17

ð new (24)It is also necessary to require the Member States promptly to take and transmit the fingerprint data of every applicant for international protection and of every third-country national or stateless person who is apprehended in connection with the irregular crossing of an external border of a Member State ð or is found to be staying illegally in a Member State ï , if they are at least 14 ð six ï years of age. ò new (25)In view of strengthening the protection of unaccompanied minors who have not applied for international protection and those children who may become separated from their families, it is also necessary to take fingerprints and a facial image for storage in the Central System to help establish the identity of a child and assist a Member State to trace any family or links they may have with another Member State. Establishing family links is a key element in restoring family unity and must be is closely linked to the determination of the best interests of the child and eventually, the determination of a durable solution. (26)The best interests of the minor should be a primary consideration for Member States when applying this Regulation. Where the requesting Member State establishes that Eurodac data pertain to a child, these data may only be used for law enforcement purposes by the requesting Member State in accordance with that State's laws applicable to minors and in accordance with the obligation to give primary consideration to the best interests of the child. ê 603/2013 recital 18 (adapted) ð new (27)It is necessary to lay down precise rules for the transmission of such fingerprint ð and facial image ï data to the Central System, the recording of such fingerprint ð and facial image ï data and of other relevant Ö personal Õ data in the Central System, their storage, their comparison with other fingerprint ð and facial image ï data, the transmission of the results of such comparison and the marking and erasure of the recorded data. Such rules may be different for, and should be specifically adapted to, the situation of different categories of third-country nationals or stateless persons. ê 603/2013 recital 19 (adapted) ð new (28)Member States should ensure the transmission of fingerprint ð and facial image ï data of an appropriate quality for the purpose of comparison by means of the computerised fingerprint ð and facial ï recognition system. All authorities with a right of access to Eurodac should invest in adequate training and in the necessary technological equipment. The authorities with a right of access to Eurodac should inform the European Agency for the operational management of large-scale IT systems in the area of freedom, security and justice established by Regulation (EU) No 1077/2011 of the European Parliament and of the Council (the "Agency" Ö "eu-LISA" Õ ) of specific difficulties encountered with regard to the quality of data, in order to resolve them. ê 603/2013 recital 20 ð new (29)The fact that it is temporarily or permanently impossible to take and/or to transmit fingerprint ð and facial image ï data, due to reasons such as insufficient quality of the data for appropriate comparison, technical problems, reasons linked to the protection of health or due to the data subject being unfit or unable to have his or her fingerprints ð or facial image ï taken owing to circumstances beyond his or her control, should not adversely affect the examination of or the decision on the application for international protection lodged by that person. ò new

(30)Member States should refer to the Commission's Staff Working Document on Implementation of the Eurodac Regulation as regards the obligation to take fingerprints adopted by the Council on 20 July 2015, which sets out a best practice approach to taking fingerprints of irregular third-country nationals. Where a Member State's national law allows for the taking of fingerprints by force or coercion as a last resort, those measures must fully respect the EU Charter of Fundamental Rights. Third-country nationals who are deemed to be vulnerable persons and minors should not be coerced into giving their fingerprints or facial image, except in duly justified circumstances that are permitted under national law. ê 603/2013 recital 21 (adapted) ð new (31)Hits obtained from Eurodac should be verified by a trained fingerprint expert in order to ensure the accurate determination of responsibility under Regulation (EU) No […/…]604/2013 ð ; the exact identification of the third-country national or stateless person ï and the exact identification of the criminal suspect or victim of crime whose data might be stored in Eurodac. ð Hits obtained from Eurodac based on facial images should also be verified where there is doubt that the result relates to the same person. ï ê 603/2013 recital 22 (adapted) ð new (32)Third-country nationals or stateless persons who have requested international protection in one Member State may have the option of ð try to ï requesting international protection in another Member State for many years to come. Therefore, the maximum period during which fingerprint ð and facial image ï data should be kept by the Central System should be of considerable length. Given that most third-country nationals or stateless persons who have stayed in the Union for several years will have obtained a settled status or even citizenship of a Member State after that period, a period of ten years should be considered a reasonable period for the storage of fingerprint ð and facial image ï data. ò new (33)In view of successfully preventing and monitoring unauthorised movements of third-country nationals or stateless persons who have no right to stay in the Union, and of taking the necessary measures for successfully enforcing effective return and readmission to third countries in accordance with Directive 2008/115/EC and the right to protection of personal data, a period of five years should be considered a necessary period for the storage of fingerprint and facial data. ê 603/2013 recital 23 ð new (34)The storage period should be shorter in certain special situations where there is no need to keep fingerprint ð and facial ï data ð and all other personal data ï for that length of time. Fingerprint ð and facial image ï data ð and all other personal data belonging to a third-country national ï should be erased immediately once third-country nationals or stateless persons obtain citizenship of a Member State. ê 603/2013 recital 24 ð new (35)It is appropriate to store data relating to those data subjects whose fingerprints ð and facial images ï were initially recorded in Eurodac upon lodging their applications for international protection and who have been granted international protection in a Member State in order to allow data recorded upon lodging an application for international protection to be compared against them.

ê 603/2013 recital 25 (adapted) (36)The Agency Ö eu-LISA Õ has been entrusted with the Commission's tasks relating to the operational management of Eurodac in accordance with this Regulation and with certain tasks relating to the Communication Infrastructure as from the date on which the Agency Ö eu-LISA Õ took up its responsibilities on 1 December 2012. The Agency should take up the tasks entrusted to it under this Regulation, and the relevant provisions of Regulation (EU) No 1077/2011 should be amended accordingly. In addition, Europol should have observer status at the meetings of the Management Board of the Agency Ö eu-LISA Õ when a question in relation to the application of this Regulation concerning access for consultation of Eurodac by designated authorities of Member States and by Europol for the purposes of the prevention, detection or investigation of terrorist offences or of other serious criminal offences is on the agenda. Europol should be able to appoint a representative to the Eurodac Advisory Group of Ö eu-LISA Õ the Agency. ê 603/2013 recital 26 The Staff Regulations of Officials of the European Union (Staff Regulations of Officials) and the Conditions of Employment of Other Servants of the European Union ('Conditions of Employment'), laid down in Regulation (EEC, Euratom, ECSC) No 259/68 of the Council (together referred to as the 'Staff Regulations') should apply to all staff working in the Agency on matters pertaining to this Regulation. ê 603/2013 recital 27 (adapted) (37)It is necessary to lay down clearly the respective responsibilities of the Commission and Ö eu-LISA Õ the Agency, in respect of the Central System and the Communication Infrastructure, and of the Member States, as regards data processing, data security, access to, and correction of, recorded data. ê 603/2013 recital 28 (38)It is necessary to designate the competent authorities of the Member States as well as the National Access Point through which the requests for comparison with Eurodac data are made and to keep a list of the operating units within the designated authorities that are authorised to request such comparison for the specific purposes of the prevention, detection or investigation of terrorist offences or of other serious criminal offences. ê 603/2013 recital 29 (39)Requests for comparison with data stored in the Central System should be made by the operating units within the designated authorities to the National Access Point, through the verifying authority, and should be reasoned. The operating units within the designated authorities that are authorised to request comparisons with Eurodac data should not act as a verifying authority. The verifying authorities should act independently of the designated authorities and should be responsible for ensuring, in an independent manner, strict compliance with the conditions for access as established in this Regulation. The verifying authorities should then forward the request, without forwarding the reasons for it, for comparison through the National Access Point to the Central System following verification that all conditions for access are fulfilled. In exceptional cases of urgency where early access is necessary to respond to a specific and actual threat related to terrorist offences or other serious criminal offences, the verifying authority should process the request immediately and only carry out the verification afterwards. ê 603/2013 recital 30 (40)The designated authority and the verifying authority may be part of the same organisation, if permitted under national law, but the verifying authority should act independently when performing its tasks under this Regulation. ê 603/2013 recital 31

(41)For the purposes of protection of personal data, and to exclude systematic comparisons which should be forbidden, the processing of Eurodac data should only take place in specific cases and when it is necessary for the purposes of preventing, detecting or investigating terrorist offences or other serious criminal offences. A specific case exists in particular when the request for comparison is connected to a specific and concrete situation or to a specific and concrete danger associated with a terrorist offence or other serious criminal offence, or to specific persons in respect of whom there are serious grounds for believing that they will commit or have committed any such offence. A specific case also exists when the request for comparison is connected to a person who is the victim of a terrorist offence or other serious criminal offence. The designated authorities and Europol should thus only request a comparison with Eurodac when they have reasonable grounds to believe that such a comparison will provide information that will substantially assist them in preventing, detecting or investigating a terrorist offence or other serious criminal offence. ê 603/2013 recital 32 (42)In addition, access should be allowed only on condition that comparisons with the national fingerprint databases of the Member State and with the automated fingerprinting identification systems of all other Member States under Council Decision 2008/615/JHA of 23 June 2008 on the stepping up of cross-border cooperation, particularly in combating terrorism and cross-border crime did not lead to the establishment of the identity of the data subject. That condition requires the requesting Member State to conduct comparisons with the automated fingerprinting identification systems of all other Member States under Decision 2008/615/JHA which are technically available, unless that Member State can justify that there are reasonable grounds to believe that it would not lead to the establishment of the identity of the data subject. Such reasonable grounds exist in particular where the specific case does not present any operational or investigative link to a given Member State. That condition requires prior legal and technical implementation of Decision 2008/615/JHA by the requesting Member State in the area of fingerprint data, as it should not be permitted to conduct a Eurodac check for law enforcement purposes where those above steps have not been first taken. ê 603/2013 recital 33 (43)Prior to searching Eurodac, designated authorities should also, provided that the conditions for a comparison are met, consult the Visa Information System under Council Decision 2008/633/JHA of 23 June 2008 concerning access for consultation of the Visa Information System (VIS) by designated authorities of Member States and by Europol for the purposes of the prevention, detection and investigation of terrorist offences and of other serious criminal offences. ê 603/2013 recital 34 (44)For the purpose of efficient comparison and exchange of personal data, Member States should fully implement and make use of the existing international agreements as well as of Union law concerning the exchange of personal data already in force, in particular of Decision 2008/615/JHA. ê 603/2013 recital 35 The best interests of the child should be a primary consideration for Member States when applying this Regulation. Where the requesting Member State establishes that Eurodac data pertain to a minor, these data may only be used for law enforcement purposes by the requesting Member State in accordance with that State's laws applicable to minors and in accordance with the obligation to give primary consideration to the best interests of the child. ê 603/2013 recital 36 (45)While the non-contractual liability of the Union in connection with the operation of the Eurodac system will be governed by the relevant provisions of the Treaty on the Functioning of the European Union (TFEU), it is necessary to lay down specific rules for the non-contractual liability of the Member States in connection with the operation of the system. ê 603/2013 recital 37 (adapted) ð new (46)Since the objective of this Regulation, namely the creation of a system for the comparison of fingerprint ð and facial image ï data to assist the implementation of Union asylum Ö and migration Õ policy, cannot, by its very nature, be sufficiently achieved by the Member States and can therefore be better achieved at Union level, the Union may adopt measures in accordance with the principle of subsidiarity as set out in Article 5 of the Treaty on European Union (TEU). In accordance with the principle of proportionality, as set out in that Article, this Regulation does not go beyond what is necessary in order to achieve that objective.

ê 603/2013 recital 38 (adapted) ð new (47)[Directive [2016/…/…] of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data] applies to the processing of personal data by the Member States carried out in application of this Regulation unless such processing is carried out by the designated or verifying Ö competent Õ authorities of the Member States for the purposes of the prevention, Ö investigation, Õ detection or investigation ð prosecution ï of terrorist offences or of other serious criminal offences ð including the safeguarding against and the prevention of threats to public security ï . ê 603/2013 recital 39 (adapted) ð new (48)Ö The national provisions adopted pursuant to Directive [2016/… /EU] of the European Parliament and of the Council [of … 2016] on the protection of individuals with regard to the processing of personal data by competent authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and the free movement of such data apply to Õ Tthe processing of personal data by the Ö competent Õ authorities of the Member States for the purposes of the prevention, Ö investigation, Õ detection or investigation ð prosecution ï of terrorist offences or of other serious criminal offences pursuant to this Regulation should be subject to a standard of protection of personal data under their national law which complies with Council Framework Decision 2008/977/JHA of 27 November 2008 on the protection of personal data processed in the framework of police and judicial co-operation in criminal matters . ê 603/2013 recital 40 (adapted) ð new (49)The principles ð rules ï set out in Regulation Directive [2016/…/..] 95/46/EC regarding the protection of the rights and freedoms of individuals, notably their right to Ö the protection of personal data concerning them Õ privacy, with regard to the processing of personal data should be ð specified in respect of the responsibility for the processing of the data, of safeguarding the rights of data subjects and of the supervision of data protection ï supplemented or clarified, in particular as far as certain sectors are concerned. ê 603/2013 recital 41 ð new (50)Transfers of personal data obtained by a Member State or Europol pursuant to this Regulation from the Central System to any third country or international organisation or private entity established in or outside the Union should be prohibited, in order to ensure the right to asylum and to safeguard applicants for international protection from having their data disclosed to a third country. This implies that Member States should not transfer information obtained from the Central System concerning: ð the name(s); date of birth; nationality; ï the Member State(s) of origin ð or Member State of allocation; the details of the identity or travel document; ï ; the place and date of application for international protection; the reference number used by the Member State of origin; the date on which the fingerprints were taken as well as the date on which the Member State(s) transmitted the data to Eurodac; the operator user ID; and any information relating to any transfer of the data subject under [Regulation (EU) No 604/2013]. That prohibition should be without prejudice to the right of Member States to transfer such data to third countries to which [Regulation (EU) No 604/2013] applies [ð in accordance with Regulation (EU) No […/2016]respectively with the national rules adopted pursuant to Directive [2016/…/EU] ï], in order to ensure that Member States have the possibility of cooperating with such third countries for the purposes of this Regulation. ò new (51)In individual cases, information obtained from the Central System may be shared with a third-country in order to assist with the identification of a third-country national in relation to his/her return. Sharing of any personal data must be subject to strict conditions. Where such information is shared, no information shall be disclosed to a third-country relating to the fact that an application for international protection has been made by a third-country national where the country the individual is being readmitted to, is also the individual's country of origin or another third-country where they will be readmitted. Any transfer of data to a third-country for the identification of a third-country national must be in accordance with the provisions of Chapter V of Regulation (EU) No. […2016].

ê 603/2013 recital 42 (52)National supervisory authorities should monitor the lawfulness of the processing of personal data by the Member States, and the supervisory authority set up by Decision 2009/371/JHA should monitor the lawfulness of data processing activities performed by Europol. ê 603/2013 recital 43 (53)Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data, and in particular Articles 21 and 22 thereof concerning confidentiality and security of processing, applies to the processing of personal data by Union institutions, bodies, offices and agencies carried out in application of this Regulation. However, certain points should be clarified in respect of the responsibility for the processing of data and of the supervision of data protection, bearing in mind that data protection is a key factor in the successful operation of Eurodac and that data security, high technical quality and lawfulness of consultations are essential to ensure the smooth and proper functioning of Eurodac as well as to facilitate the application of [Regulation (EU) No 604/2013]. ê 603/2013 recital 44 (adapted) ð new (54)The data subject should be informed ð in particular ï of the purpose for which his or her data will be processed within Eurodac, including a description of the aims of Regulation (EU) […/…] No 604/2013, and of the use to which law enforcement authorities may put his or her data. ê 603/2013 recital 45 (55)It is appropriate that national supervisory authorities monitor the lawfulness of the processing of personal data by the Member States, whilst the European Data Protection Supervisor, as referred to in Regulation (EC) No 45/2001, should monitor the activities of the Union institutions, bodies, offices and agencies in relation to the processing of personal data carried out in application of this Regulation. ò new (56)The European Data Protection Supervisor was consulted in accordance with Article 28(2) of Regulation (EC) No 45/2001 and delivered an opinion on […] ê 603/2013 recital 46 (57)Member States, the European Parliament, the Council and the Commission should ensure that the national and European supervisory authorities are able to supervise the use of and access to Eurodac data adequately. ê 603/2013 recital 47 (adapted)

(58)It is appropriate to monitor and evaluate the performance of Eurodac at regular intervals, including in terms of whether law enforcement access has led to indirect discrimination against applicants for international protection, as raised in the Commission's evaluation of the compliance of this Regulation with the Charter of Fundamental Rights of the European Union ('the Charter'). The Agency Ö eu-LISA Õ should submit an annual report on the activities of the Central System to the European Parliament and to the Council. ê 603/2013 recital 48 ð new (59)Member States should provide for a system of effective, proportionate and dissuasive penalties to sanction the ð unlawful ï processing of data entered in the Central System contrary to the purpose of Eurodac. ê 603/2013 recital 49 (60)It is necessary that Member States be informed of the status of particular asylum procedures, with a view to facilitating the adequate application of Regulation (EU) No 604/2013. ê 603/2013 recital 50 (61)This Regulation respects the fundamental rights and observes the principles recognised in particular by the Charter. In particular, this Regulation seeks to ensure full respect for the protection of personal data and for the right to seek international protection, and to promote the application of Articles 8 and 18 of the Charter. This Regulation should therefore be applied accordingly. ê 603/2013 recital 51 (62)In accordance with Articles 1 and 2 of Protocol No 22 on the position of Denmark, annexed to the TEU and to the TFEU, Denmark is not taking part in the adoption of this Regulation and is not bound by it or subject to its application. ê 603/2013 recital 52 (adapted) In accordance with Article 3 of Protocol No 21 on the position of the United Kingdom and Ireland in respect of the Area of Freedom, Security and Justice, annexed to the TEU and to the TFEU, the United Kingdom has notified its wish to take part in the adoption and application of this Regulation. ê 603/2013 recital 53 (adapted) In accordance with Article 1 and 2 of Protocol No 21 on the position of the United Kingdom and Ireland in respect of the Area of Freedom, Security and Justice, annexed to the TEU and to the TFEU, and without prejudice to Article 4 of that Protocol, Ireland is not taking part in the adoption of this Regulation and is not bound by it or subject to its application.

ò new (63)[In accordance with Article 3 of Protocol No 21 on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, those Member States have notified their wish to take part in the adoption and application of this Regulation] OR (64)[In accordance with Articles 1 and 2 of Protocol No 21 on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, and without prejudice to Article 4 of that Protocol, those Member States are not taking part in the adoption of this Regulation and are not bound by it or subject to its application.] OR (65)[In accordance with Articles 1 and 2 of Protocol No 21 on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, and without prejudice to Article 4 of that Protocol, the United Kingdom is not taking part in the adoption of this Regulation and is not bound by it or subject to its application. (66)In accordance with Article 3 of Protocol No 21 on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, Ireland has notified (, by letter of ...,) its wish to take part in the adoption and application of this Regulation.] OR (67)[In accordance with Article 3 of Protocol No 21 on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, the United Kingdom has notified (, by letter of ...,) its wish to take part in the adoption and application of this Regulation. (68)In accordance with Articles 1 and 2 of Protocol No 21 on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, and without prejudice to Article 4 of that Protocol, Ireland is not taking part in the adoption of this Regulation and is not bound by it or subject to its application.] ê 603/2013 recital 54 (adapted) (69)It is appropriate to restrict the territorial scope of this Regulation so as to align it on the territorial scope of Regulation (EU) No […/…] 604/2013, ê 603/2013 (adapted) HAVE ADOPTED THIS REGULATION: CHAPTER I GENERAL PROVISIONS Article 1 Purpose of "Eurodac" 1. A system known as "Eurodac" is hereby established, the purpose of which shall be to: (a) assist in determining which Member State is to be responsible pursuant to Regulation (EU) No […/…] 604/2013 for examining an application for international protection lodged in a Member State by a third-country national or a stateless person, and otherwise to facilitate the application of Regulation (EU) No […/…] 604/2013 under the conditions set out in this Regulation.;

ò new (b)assist with the control of illegal immigration to and secondary movements within the Union and with the identification of illegally staying third-country nationals for determining the appropriate measures to be taken by Member States, including removal and repatriation of persons residing without authorisation. ê 603/2013 (adapted) ð new 2. (c)This Regulation also lays down the conditions under which Member States' designated authorities and the European Police Office (Europol) may request the comparison of fingerprint ð and facial image ï data with those stored in the Central System for law enforcement purposes ð for the prevention, detection or investigation of terrorist offences or of other serious criminal offences ï . 32. Without prejudice to the processing of data intended for Eurodac by the Member State of origin in databases set up under the latter's national law, fingerprint data and other personal data may be processed in Eurodac only for the purposes set out in this Regulation and [Article 34(1) of Regulation (EU) No 604/2013]. Article 2 Obligation to take fingerprints and a facial image 1. Member States are obliged to take the fingerprints and facial image of persons referred to in Article 10(1), 13(1) and 14(1) for the purposes of Article 1(1)(a) and (b) of this Regulation and shall impose on the data-subject the requirement to provide his or her fingerprints and a facial image and inform them as such in accordance with Article 30 of this Regulation. 2. Taking fingerprints and facial images of minors from the age of six shall be carried out in a child-friendly and child-sensitive manner by officials trained specifically to enrol minor's fingerprints and facial images. The minor shall be informed in an age-appropriate manner using leaflets and/or infographics and/or demonstrations specifically designed to explain the fingerprinting and facial image procedure to minors and they shall be accompanied by a responsible adult, guardian or representative at the time their fingerprints and facial image are taken. At all times Member States must respect the dignity and physical integrity of the minor during the fingerprinting procedure and when capturing a facial image. 3. Member States may introduce administrative sanctions, in accordance with their national law, for non-compliance with the fingerprinting process and capturing a facial image in accordance with paragraph 1 of this Article. These sanctions shall be effective, proportionate and dissuasive. In this context, detention should only be used as a means of last resort in order to determine or verify a third-country national's identity. 4. Without prejudice to paragraph 3 of this Article, where enrolment of the fingerprints or facial image is not possible from third-country nationals who are deemed to be vulnerable persons and from a minor due to the conditions of the fingertips or face, the authorities of that Member State shall not use sanctions to coerce the taking of fingerprints or a facial image. A Member State may attempt to re-take the fingerprints or facial image of a minor or vulnerable person who refuses to comply, where the reason for non-compliance is not related to the conditions of the fingertips or facial image or the health of the individual and where it is duly justified to do so. Where a minor, in particular an unaccompanied or separated minor refuses to give their fingerprints or a facial image and there are reasonable grounds to suspect that there are child safeguarding or protection risks, the minor shall be referred to the national child protection authorities and /or national referral mechanisms. ê 603/2013 ð new 5. The procedure for taking fingerprints ð and a facial image ï shall be determined and applied in accordance with the national practice of the Member State concerned and in accordance with the safeguards laid down in the Charter of Fundamental Rights of the European Union, in the Convention for the Protection of Human Rights and Fundamental Freedoms and in the United Nations Convention on the Rights of the Child.

Article 2 3 Definitions 1. For the purposes of this Regulation: (a)'applicant for international protection' means a third-country national or a stateless person who has made an application for international protection as defined in Article 2(h) of Directive 2011/95/EU in respect of which a final decision has not yet been taken; (b)'Member State of origin' means: (i) in relation to a person covered by Article 9 10(1), the Member State which transmits the personal data to the Central System and receives the results of the comparison; (ii) in relation to a person covered by Article 14 13(1), the Member State which transmits the personal data to the Central System ð and receives the results of the comparison ï ; (iii) in relation to a person covered by Article 17 14(1), the Member State which transmits the personal data to the Central System and receives the results of the comparison; ò new (c)‘third-country national’ means any person who is not a citizen of the Union within the meaning of Article 20(1) of the Treaty and who is not a national of a State which participates in this Regulation by virtue of an agreeme