Summary of the Opinion of the European Data Protection Supervisor on the Proposal for a new Regulation on the Visa Information System

(The full text of this Opinion can be found in English, French and German on the EDPS website www.edps.europa.eu)

(2019/C 50/06)

In order to enhance security and improve the EU external borders management, the Commission adopted a Proposal which would upgrade the Visa Information System (‘VIS’), the EU centralised database that contains information about persons applying for a Schengen visa.

In particular, the Proposal provides for (a) the lowering of the fingerprint age for child applicants for a short stay visa from 12 years to 6 years; (b) the centralisation at EU level of data related to all holders of long stay visas and residence permits; and (c) the cross-check of visa applications against other EU information systems in the area of freedom, security and justice.

The EDPS stresses that biometric data such as fingerprints are highly sensitive. Their collection and use should be subject to a strict necessity analysis before deciding to store them in a database where a large number of persons will have their personal data processed. This is even more critical when it concerns fingerprints of children who are particularly vulnerable members of our society and therefore deserve special protection.

The EDPS recognises that strengthening the prevention and fight against children right's abuses such as trafficking is of utmost importance. Nevertheless, he notes that it remains unclear whether or to what extent the child trafficking is rooted in or amplified by the mis- or non-identification of children entering the EU territory on the basis of a visa. Should further elements be provided in support of this claim, the EDPS stresses the importance of ensuring that fingerprints of children would only be used when it is in the best interest of the child. Additionally, appropriate safeguards should be included in the Proposal

Furthermore, the EDPS notes that by including data on all holders of long stay visas and residence permits in the VIS, the Proposal would include the only category of third country nationals that are not currently covered by any of the EU large-scale systems in the area of freedom, security and justice. In the context of the proposed interoperability of EU large-scale systems, the Proposal would contribute to the establishment of an EU centralised network giving access to a considerable amount of information about all third-country nationals that have crossed or are considering crossing the EU borders (i.e. millions of people). He notes that there are two objectives of centralising data related to long stay visas and residence permits: (a) to ascertain the authenticity of a document and the legitimate relation with its holder; and (b) to facilitate exchange of information on individuals whose visa request has been refused for security grounds. In this context, he considers that harmonising secure documents should be further investigated and that data stored in the VIS should be limited to individuals whose long stay visa or residence permit has been refused on security grounds.

Finally, the Proposal provides for the comparison of data stored in the VIS with data stored in other systems built and used so far for purposes other than migration. In particular, the data of visa applicants would be compared with data collected and stored for police and judicial cooperation purposes. In line with his concerns about the increasing trend to blur the boundaries between migration management and fight against crime and terrorism, the EDPS notes that the Proposal does not determine clearly how and to which extent police and judicial information has to be taken into consideration in the visa issuance decision making process. He recommends to clarify in the Proposal the purpose of the comparison of the VIS data with police and judicial information as well as the procedure and conditions applicable as regards the outcome of such comparison. He also recommends to ensure in the Proposal that only police and judicial information that are legally part of the visa issuance decision-making process would be accessible to visa authorities.

1. INTRODUCTION

1.1. Background

1. Stronger and Smarter Information Systems for Borders and Security On 6 April 2016, the Commission adopted a Communication ( 1 ) to launch a discussion on the shortcomings in the functionalities of existing systems for border management and internal security in the European Union in order to optimise their performance.

2. On 17 June 2016, the Commission set up a high-level expert group on information systems and interoperability (‘HLEG’), which comprised experts in the field of information systems and interoperability, nominated by Member States, Schengen associated countries, and EU agencies and bodies. The objective of the expert group was to contribute to an overall strategic vision on how to make the management and use of data for both border management and security more effective and efficient, in full compliance with fundamental rights, and to identify solutions to implement improvements ( 2 )

3. The HLEG presented its recommendations in its final report in May 2017 ( 3 ) . With regard to the VIS, the HLEG made several recommendations, inter alia: — to extend the scope of the VIS to store long-stay visas and residence documents, — to improve access for law enforcement authorities while respecting the highest data protection standards, — to improve the data quality in the system, in particular the quality of facial images to allow multimodal searches using biometrics, — to lower the fingerprinting age for children, to respond to concerns of human trafficking involving children and child abductions, and irregular migration involving minors, — to improve VIS capacity in terms of producing statistics and reports relevant for migratory trends and phenomena (4).

4. On 17 August 2017, the Commission launched a public consultation on lowering the fingerprinting age for children in the visa procedure from twelve years to six years ( 5 ) . On 17 November 2017, the Commission launched another public consultation on extending the scope of the Visa Information System (‘VIS’) to include data on long stay visas and residence documents ( 6 ) . The EDPS participated in both public consultations and issued two statements ( 7 )

5. On 15 May 2018, the Commission published a proposal (hereinafter ‘the Proposal’) for a Regulation of the European Parliament and of the Council amending: — Regulation (EC) No 767/2008 (‘VIS Regulation’), — Regulation (EC) No 810/2009 (‘Visa Code’), — Regulation (EU) 2017/2226 (‘EES Regulation’), — Regulation (EU) 2016/399 (‘Schengen Border Code’), — Regulation XX/2018 (Interoperability Regulation), — and Decision 2004/512/EC (‘VIS Decision’), — and repealing Council Decision 2008/633/JHA (‘Law enforcement access Decision’).

6. The EDPS has been invited to contribute to the two public consultations launched by the Commission (see supra point 4). Since the Proposal relies to a major extent on the processing of personal data, he wonders why he hasn't been consulted on it by the Commission, either informally or formally.

1.2. Objectives of the Proposals

7. The Proposal aims at improving security within the Union and its borders and at facilitating the management of the Schengen external borders. In particular, the Proposal aims to improve the visa processing, expand the use of the VIS for new categories of data, make full use of the interoperability instruments, improve the data quality and enhance the VIS system.

8. To this end, the Proposal introduces the possibilities to: — Include long stay visas and residence permits in the VIS, in order to: — ascertain the authenticity and the validity of the document and the legitimate relation with the holder, — facilitate the exchange of information between Members States enabling them to check whether the person is not a threat to the security of the Member States before or when the person reaches the external border. — Lower the fingerprint age for child applicants for a short stay visa from 12 years to 6 years in order to verify the identity of a child holding a visa at the border and to contribute to the fight against human trafficking. — Check all visa applications recorded in the VIS against all other EU information systems in the area of freedom, security and justice using interoperability to increase security checks. — Store a copy of the bio-page of the applicants travel document in the VIS as evidence to support procedure to return irregular migrants to their countries of origin in case travel documents are missing. — Use fingerprints stored in the VIS for entering alerts on missing persons in the Schengen Information System (SIS).

9. The present opinion focuses on issues that have an impact of the individuals' fundamental right to data protection. The EDPS notes that the Fundamental Rights Agency has also issued an opinion on the revised Visa Information System and its fundamental rights implications ( 8 )

10. To facilitate the reading and the understanding of the Proposal, which amends several existing legislative texts, the present opinion will use the numbering of articles as introduced or amended by the Proposal in the existing legal texts.

4. CONCLUSIONS

93. The EDPS stresses that biometric data such as fingerprints are highly sensitive. Their collection and use should be subject to a strict necessity analysis before deciding to store them in a database where a large number of persons will have their personal data processed. This is even more critical when it concerns fingerprints of children who are particularly vulnerable members of our society and therefore deserve special protection.

94. The EDPS recognises that strengthening the prevention and fight against children right's abuses such as trafficking is of utmost importance. Nevertheless, he notes that it remains unclear whether or to what extent the child trafficking is rooted in or amplified by the mis- or non-identification of children entering the EU territory on the basis of a visa.

95. Should further elements be provided in support of this claim, the EDPS stresses the importance to ensure that fingerprints of the children will be used only when it is in the best interest of the child in a specific case. He therefore recommends to introduce in the Proposal a specific provision on the fingerprints of children to limit their processing to the purposes of: — verifying the child's identity in the visa application procedure and at the external borders, and — contributing to the prevention and fight against children's right abuse only in a specific case. In particular as regards the access by law enforcement authorities, the EDPS recommends to ensure that: — such access must be necessary for the purpose of the prevention, detection or investigation of a child trafficking case, — access is necessary in a specific case, — a prior search in the relevant national databases and in the specific systems at Union level has been unsuccessful, — reasonable grounds exist to consider that the consultation of the VIS will substantially contribute to the prevention, detection or investigation of the child trafficking case in question, and — the identification is in the best interest of the child.

96. The EDPS notes that by including data on all holders of long stay visas and residence permits in the VIS, the Proposal would include the only category of third country nationals that are not currently covered by any of the EU large-scale systems in the area of freedom, security and justice. In the context of the proposed interoperability of EU large-scale systems, the Proposal would contribute to the establishment of an EU centralised network giving access to a considerable amount of information about all third-country nationals that have crossed or are considering crossing the EU borders (i.e. millions of people). Given the two-fold objective for centralising data related to long stay visas and residence permits: (a) to ascertain the authenticity of a document and the legitimate relation with its holder; and (b) to facilitate exchange of information on individuals whose visa request has been refused for security grounds, the EDPS considers that the option of harmonising secure documents related to long stay visas and residence permits should be further investigated and that the information stored in the VIS should be limited to individuals: — whose data correspond to data stored in another system or where doubts remain concerning their identity, — whose request for a long stay visa or a residence permit has been refused because they have been considered to pose a threat to public policy, internal security or to public health or they have presented documents which were fraudulently acquired or falsified or tampered with.

97. As regards the comparison of data stored in the VIS with data stored in other systems, the EDPS recommends to include in the Proposal guarantees that only information stored in the ECRIS-TCN related to terrorist and other serious criminal offences would be communicated to the central authority. One possible way to achieve this could be that the central authority is not informed about the hit but a notification is automatically sent to the competent authority of the Member State that entered the data that triggered the hit. The competent authority of the Member State would then, where relevant, inform the central authority. Alternatively, the possibility to consult the ECRIS-TCN system should be deleted.

98. The EDPS also recommends to clarify in the Proposal the purpose of the comparison of the VIS data with Europol data, as well as the procedure and conditions applicable as regards the outcome of such comparison. Furthermore, he considers that the Proposal should be clarified regarding the types of SIS alerts to be taken into account in the visa issuance procedure and recommends to ensure in the Proposal that only alerts that are legally part of the visa issuance decision-making process would produce a hit accessible by visa authorities.

99. Finally, beyond the general comments and key issues identified above, the EDPS has additional recommendations related to the following aspects of the Proposals: — Categories of VIS data compared with data recorded in other systems, — Specific categories of visa applicants, — Definition of central authorities, — Use of VIS data to enter a SIS alert on missing persons, — Verifications in case of a hit, — Access for law enforcement purposes, — Statistics, — Use of anonymised data for testing purposes, — Data quality monitoring, — Supervision of the VIS.

100. The EDPS remains available to provide further advice on the Proposal, also in relation to any delegated or implementing act adopted pursuant to the proposed Regulations which might have an impact on the processing of personal data.

Brussels, 12 December 2018. Giovanni BUTTARELLI European Data Protection Supervisor

(1) https://ec.europa.eu/home-affairs/what-is-new/news/news/2016/20160406_3_en

(2) C(2016) 3780 final, Commission Decision of 17.6.2016 setting up the High Level Expert Group on Information Systems and Interoperability.

(3) http://ec.europa.eu/transparency/regexpert/index.cfm?do=groupDetail.groupDetailDoc&id=32600&no=1

(4) Ibidem, p. 19.

(5) https://ec.europa.eu/home-affairs/news/public-consultation-lowering-fingerprinting-age-children-visa-procedure-12-years-6-years_en

(6) https://ec.europa.eu/home-affairs/content/consultation-extending-scope-visa-information-system-vis-include-data-long-stay-visas-and_en

(7) EDPS response to the Commission public consultation on extending the scope of the Visa Information System (VIS) to include data on long stay visas and residence documents, available at: https://edps.europa.eu/sites/edp/files/publication/18-02-09_formal_comments_vis_consultation_long_stay_visas_residence_documents_en.pdf and EDPS formal comments in response to the Commission public consultation on lowering the fingerprinting age for children in the visa procedure from 12 to 6 years old, available at: https://edps.europa.eu/sites/edp/files/publication/17-11-09_formal_comments_2017-0809_en.pdf

(8) Opinion of the Fundamental Rights Agency on the revised Visa Information System and its fundamental rights implications, 30 August 2018, available at: http://fra.europa.eu/en/opinion/2018/visa-system