COMMISSION STAFF WORKING DOCUMENT

DETAILED EXPLANATION OF THE PROPOSAL BY CHAPTERS AND ARTICLES

Accompanying the document

Proposal for a Regulation of the European Parliament and of the Council

· Detailed explanation of the proposal by Chapters and Articles

Chapter One lays down the subject matter of the Regulation, the purpose and scope of the EES, the principles as regards the data to be recorded, the access to the data, the alert mechanism and the definitions.

Chapter Two details the procedures for entering the data and the use of data by border authorities.

Chapter Three is dedicated to the access to the data by other authorities, whereas Chapter Four lays down the rules for the retention and amendment of the data.

Chapter Five specifies the rules on the operational management and defines the technical architecture. It also lays down the responsibilities for the use of the data and data security, including rules on the keeping of records and penalties.

Chapter Six concerns data protection rights and supervision. Whereas Directive 95/46/EC and Regulation (EC) No 45/2001 fully apply for this Regulation, the provisions of this chapter clarify certain points related to the safeguard of the rights of data subjects and the roles of the national supervisory authorities and the European Data Protection Supervisor.

Chapter Seven covers the start of transmission and operation, the set up of a Committee to assist the Commission when adopting implementing measures, the monitoring and evaluation, the entry into force and the applicability of this Regulation.

Chapter I: General provisions

Article 1 establishes the objective of the Regulation and the core functions of the EES.

Article 2 entrusts the Agency with the tasks of development and operational management of the EES.

Article 3 establishes the scope of the EES and list the exceptions to its applicability.

Article 4 defines the purpose and specific objectives of the EES and how the system will assist authorities in the Member States in pursuing such objectives. The purpose is limited to border and migration management, thus excluding the fight against serious crime.

The definitions in Article 5 refer to the EU legislation and correspond to the definitions used in the Regulation of the European Parliament and of the Council (EC) No 562/2006 establishing a Community Code on the rules governing the movement of persons across borders (Schengen Borders Code), the Regulation of the European Parliament and of the Council (EC) No 767/2008 concerning the Visa Information System (VIS) and the exchange of data between Member States on short-stay visas (VIS Regulation), the Regulation of the European Parliament and of the Council (EC) No 810/2009 establishing a Community Code on Visas and the Regulation of the European Parliament and of the Council (EC) No 1077/2011 establishing a European Agency for the operational management of large-scale IT systems in the area of freedom, security and justice.

Article 6 sets out the architecture of the EES.

Article 7 lays down the rules for entering, amending, deleting and consulting data by the authorities in Member States. These authorities should be designated by the Member states in accordance with national law. As concerns authorities responsible for carrying out border checks and checks whithin the territory, this will be the police and/or border guard authorities of the Member States. These authorities must however respect the purpose limitation as defined in Article 2 when accessing the data in the EES.

Article 8 enunciates the general principles with regard to data protection and non discrimination.

Article 9 describes the automated calculator that should be integrated in the EES to indicate the duration of stay authorised in each case.

Article 10 defines the mechanism by which alerts of overstaying are addressed to national authorities.

Chapter II: Entry and use of data by border authorities

Article 11 paragraph 1 refers to the creation of the individual file and lists the personal data to be entered for visa holders while paragraphs 2 and 3 list the data that should be entered on entry and exit and linked to an individual file already created.

Article 12 refers to the additional biometric data that should be entered for third country nationals exempted from the visa obligation and the specific cases where fingerprints would not be required. The number of fingerprints to be enrolled on first entry into the Entry/Exit System should be ten, if physically possible. As is the case with VIS, enrolling ten fingerprints would allow for more accurate verifications and identifications, due to the expected size of the EES. The storage of fingerprints data for ten fingers guarantees that sufficient data is available in every circumstance, while keeping the amount of data to a reasonable level. Storing less fingerprints might cause problems for the travellers and border authorities at the external borders as fingerprints may be smudged, distorted or fragmented. Paragraph 5 clarifies that only alphanumeric data should be recorded during the first three years after the EES starts operation.

Article 13 establishes the procedure for entering the data at the border crossing points.

Article 14 sets out the obligation of authorites to update the information in the entry/exit records in case there are changes in the authorisation to stay. Article 15 lays down the rules on the access and use of the data by border authorites for border control purposes.

Chapter III: Access to data by other authorities

Article 16 ensures that competent visa authorities consult the EES prior to any decision on visa applications, including the decisions to annul, revoke or extend the period of validity of an issued visa. Paragraph 2 identifies the search keys that can be used by visa authorities and paragraph 3 lays down the rules on the consultation of existing files.

Similar rules on the use of the data by the competent authorities in charge of examining applications for the access to the RTP are enshrined in Article 17.

Article 18 deals with the access to the EES for the purpose of verifying whether third-country nationals found whithin the territory of the Member States fulfill the conditions for the entry or stay on that territory while Article 19 refers to the access to the EES for the purpose of identification of any third country national who may not or may no longer fulfill such conditions.

CHAPTER IV: Retention and amendment of the data

Article 20 paragraph 1 covers the retention period for data storage which is the minimum period taking into account the purposes of the EES, allowing for calculating all short stays during a period of 180 days and verifying if the maximum of 90 days is respected.

Paragraph 2 deals with the need to extend such period in the case of overstayers. If a person is signalled as not having left the Schengen after six months, the data needs to be kept, in principle, until the person does so, has been detected within the territory, or has obtained a legal reason to stay. Nevertheless, it is considered proportionate to delete the data after five years even if none of the above events have occurred.

Paragraph 1 of Article 21 enunciates the right of the competent authorites of the Member States to amend the data in the EES. Paragraph 2 introduces the obligation of these authorities to delete the information on overstayers referred to in Article 10 in case the person concerned proves that such situation was unavoidable.

Article 22 stipulates that all records should be deleted in the event that this Regulation should no longer be applicable to the person because of changes in his/her status.

CHAPTER V: Development, Operation and Responsibilities

Article 23 paragraph 1 establishes the measures that the Commission shall adopt before entrusting the development of the EES to the Agency. Paragraph 2 defines the role of the Agency – the development and operational management of the Central EES and the Uniform Interfaces. Paragraph 3 clarifies that the Commission shall adopt the technical specifications prepared by the Agency as implementing measures with comitology.

Artcile 24 lists the specific responsibilities of the Agency.

Article 25 creates in paragraphs 1 to 3 the obligation for each Member State to connect to the EES via the Network Entry Point, to designate a national authority to provide the access for the competent authorities and to observe automated procedures for processing the data. Paragraph 4 emphasises the need for training of staff before they are authorised to process data stored in the EES. Paragraph 5 clarifies the burden for the related costs, including the competence for the development of the National System and/or its adaptation to the EES.

Article 26 sets out in paragraph 1 the responsibilities of the Member States for the use of the data, acting as a controller at the moment of collection, transmission and reception of personal data. Paragraph 2 creates obligations for the Agency with regard to security and with regard to confidentiality, the latter pursuant to Articles 16 and 17 of Directive 95/46/EC and Articles 21 and 22 of Regulation (EC) No 45/2001. Paragraph 3 provides for information of the Parliament and the Council.

Article 27 provides that personal data stored in the EES cannot be communicated to third countries, international organisations or private parties. Communication to third countries or to an international organisation listed in the Annex would only be possible in individual cases for identification purposes and under specific conditions, including data protection requirements.

Article 28 deals with data security, indicating the obligations of the Member States as well as of the Agency in this regard

Article 29 sets out the applicable rules on liability of Member States for damages.

Article 30 creates the obligation for the Member States and the Agency to keep complete records of data processing operations for one year after expiry of the retention period, which may solely be used for the purposes of the monitoring of data protection and of the monitoring of data security.

Article 31 obliges Member States' authorities entitled to access EES to carry out self-monitoring and to co-operate, where necessary, with the Supervisory Authority.

Article 32 creates the obligation for each Member State to enforce the proper processing and use of data by appropriate penalties, as an essential complement to the data protection and security arrangements.

CHAPTER VI: Rights and supervision on data protection

For the protection of personal data, the relevant Community’s legislation, Directive 95/46/EC and Regulation (EC) 45/2001, fully apply for this instrument. The provisions in this chapter clarify certain points in respect of safeguarding the rights of the persons concerned and of the supervision on data protection.

Article 33 covers the right of information of third-country nationals whose data shall be stored in the EES pursuant to Article 3. Paragraph 1 contains in conformity with Article 10 of Directive 95/46/EC a list of items the person concerned has to be informed about. Paragraph 2 specifies that the information shall be provided in writing. Paragraph 3 refers to the form mentioned in Article 9(4).

Article 34 in paragraphs 1 and 2 provides any person with the rights of access, correction and deletion of data relating to him which are inaccurate or recorded unlawfully, and clarifies in paragraph 3 that the related request may be lodged in any Member State. Paragraphs 4 to 6 specify the requirements according to Article 12 of Directive 95/46/EC.

Article 35 lays down an obligation for the competent authorities to ensure the proper operation of the mechanism laid down in Article 33 and the assistance and advice by the national supervisory authority, specifying the obligations laid down in Article 28(4) and (6) of Directive 95/46/EC.

Article 36 clarifies pursuant to Article 22 of Directive 95/46/EC the right of any person to remedies before the courts of each Member State if the rights of access to or correction or deletion of data relating to him/her is refused.

Article 37 clarifies the competence of the national supervisory authorities to review the lawfulness of all the processing operations carried out by the Member States. It lays down rules on audit and obliges Member States to designate a controller. Furthermore, it specifies the information which shall be supplied to national supervisory authorities.

Article 38 provides that the European Data Protection Supervisor established by Article 41(1) of Regulation (EC) No 45/2001 shall monitor the activities of the Agency related to the processing of personal data covered by this Regulation. Paragraph 2 specifies the European Data Protection Supervisor's role on the Agency's audit which shall be carried out at least every four years. Paragraph 3 creates obligations to support this audit and monitoring.

Article 39 creates obligations for the Supervisory Authorities and the European Data Protection Supervisor to co-operate. They shall meet at least twice a year and send a joint report of activities to the European Parliament, the Council, the Commission and the Agency every two years.

CHAPTER VII: Final provisions

Article 40 lists the anonymised data that might be consulted for the purposes of reporting and statistics.

Article 41 connects the start of transmission of data to the notification of each Member State to the Commission that it has made the necessary technical and legal arrangements for the transmission of data to the central repository and that the Agency has made necessary technical arrangements.

Article 42 establishes a Committee to assist the Commission with its responsibilities under Article 23.

Article 43 details the information which Member States and the Agency shall make available to the Commission.

Article 44 establishes an Advisory Group to assist the Commission with the expertise related to the system.

Article 45 tasks the Agency with the training referred to in Article 25(4).

Article 46 creates the obligation for the Agency to monitor and evaluate the operation of the EES and produce monitoring and evaluation reports, to be submitted to the European Parliament, the Council and the Commission. Furthermore, it creates the obligation for the Commission to produce an overall evaluation of the EES, the first after two years of operation specially dedicated to examining the possible access to law enforcement authorities and the retention period. Paragraphs 6 and 7 oblige Member States and the Agency to provide the information necessary to produce the evaluation.

Article 47 concerns the entry into force and applicability. Due to the technical requirements involved in establishing the EES, it is not possible to provide for simultaneous entry into force and applicability of the Regulation.