EN Official Journal of the European Union C 200/14

Summary of the opinion of the European Data Protection Supervisor on the new legal basis of the Schengen Information System

(The full text of this opinion can be found in English, French and German on the EDPS website www.edps.europa.eu)

(2017/C 200/08)

The Schengen Information System (‘SIS’) is one of the biggest and the longest-existing large-scale information systems which support external border control and law enforcement cooperation in the Schengen States. After the three years of the operation of its second generation the Commission conducted the overall evaluation. As a result on 21 December 2016 the legislative package repealing the current legal basis of SIS was presented. Those legal changes are also the part of a wider process of the enhancement of the external border management and the internal security in the European Union to respond to the challenges brought by the terrorism threats and the significant influx of migrants.

The EDPS notes the ongoing reflections on the interoperability of EU large-scale information systems, including the SIS, which have been created to address specific needs at a given time. This has led to a complex legal framework in the field of migration, border management and police cooperation. In this respect, the EDPS would like to encourage the legislator to further reflect, beyond the current proposals, on a more consistent, coherent and comprehensive legal framework for EU large-scale information systems for border management and security in full compliance with data protection principles.

The legislative package is composed of three draft regulations on: police and judicial cooperation, border checks and return. Those proposals aim mainly to better support European Union’s return and counter-terrorism policies, to harmonise national procedures to use SIS and to improve the security of the system.

The EDPS, having in mind his role as the supervisory authority of the central SIS system, welcomes the attention paid to the data protection in the proposals and the consistency with other data-protection-related legal acts.

The EDPS considers that the introduction of new categories of data, including new biometric identifiers, raises the question of the necessity and proportionality of proposed changes and for this reason the proposals should be complemented with the impact assessment on the right of privacy and the right to data protection enshrined in the Charter of Fundamental Rights of the EU.

Moreover the increase number of authorities having access to the system raises concerns regarding the final responsibility and accountability for the processing of personal data by different actors. The proposals should better specify in some cases the access rights to different kind of alerts in SIS. In this regard special attention should be paid to the division of roles, responsibilities and access rights of different users having access to the system.

Finally, the EDPS asks for better justification of the extension of the data retention period of alerts on persons and proposes a series of additional recommendations to further improve the proposals.

1. INTRODUCTION AND BACKGROUND

1. The Schengen Information System (hereinafter ‘SIS’) was established in 1995 by Article 92 of the Convention Implementing the Schengen Agreement (1). The second generation of the Schengen Information System (hereinafter ‘SIS II’) entered into operation on 9 April 2013 on the basis of the following legal instruments: — Regulation (EC) No 1987/2006 (2) related to the use of SIS II in checks on third-country nationals who do not fulfil the conditions of entry or stay in Schengen area, — Council Decision 2007/533/JHA (3) related to the use of SIS II for police and judicial cooperation in criminal matters, and — Regulation (EC) No 1986/2006 (4) regarding access to the SIS II by the services in the Member States responsible for vehicle registration (5).

2. In 2016, the Commission carried out an evaluation of SIS after three years of operation of its second generation (6). As a result the need of improving the effectiveness and efficiency of the system was identified. In this context on 21 December 2016 the Commission issued three proposals for regulations as a first legislative package on the Schengen Information System: — Proposal for a Regulation of the European Parliament and of the Council on the establishment, operation and use of the Schengen Information System (SIS) in the field of border checks, amending Regulation (EU) No 515/2014 and repealing Regulation (EC) No 1987/2006 (hereinafter ‘the SIS Proposal on border checks’) (7), — Proposal for a Regulation of the European Parliament and of the Council on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation and judicial cooperation in criminal matters, amending Regulation (EU) No 515/2014 and repealing Regulation (EC) No 1986/2006, Council Decision 2007/533/JHA and Commission Decision 2010/261/EU (hereinafter ‘the SIS Proposal on police and judicial cooperation’) (8), and — Proposal for a Regulation of the European Parliament and of the Council on the use of the Schengen Information System for the return of illegally staying third country nationals (hereinafter ‘the SIS Proposal on return’) (9).

3. It is worth mentioning in this context that the Commission intends to issue in the coming months a second set of legislative proposals on SIS to improve its interoperability with other large-scale IT systems in the EU on the basis of the findings of the High Level Expert Group on Information Systems and Interoperability (10).

4. The EDPS notes that the SIS as well as other existing (and proposed new) large-scale EU information systems are part of a broader reflection launched by the Commission on how to make the management and use of data, both for border management and security purposes, more effective and efficient. The EDPS understands that the objectives of such a reflection are to maximise the benefits of existing information systems and develop new and complementary actions to address gaps. One way identified by the Commission to achieve these objectives is developing interoperability between EU information systems, including the SIS (11).

5. The EDPS notes that the multiplicity of large-scale EU information systems is the result of the specific needs addressed on the basis of evolving institutional, policy and legal contexts. This has led to complexity of legal frameworks and governance models.

6. In this context, the EDPS encourages the legislator to reflect, beyond the current proposals, on a more consistent, coherent and comprehensive legal framework where EU databases for border management and for law enforcement better embed a modern set of core data protection principles such as: purpose limitation, use of state-of-the-art security, proportionate data retention periods, data quality, data protection by design, traceability, effective supervision and dissuasive sanctions for misuse.

7. As regards the current proposal, the EDPS welcomes that he was informally consulted by the Commission services before the adoption of the legislative package regarding SIS II. However, he regrets that due to the tight deadline, the complexity and the length of the proposals, it was not possible to provide a contribution at that time.

5. CONCLUSION

52. As a general observation, the EDPS notes the complexity of the existing landscape of EU information systems and would like to encourage the legislator to reflect, beyond the current proposals, on a more consistent, coherent and comprehensive legal framework for EU large-scale information systems for border management and law enforcement purposes in full compliance with the data protection principles.

53. The EDPS welcomes the attention paid to data protection throughout the proposals on SIS. Nevertheless he sees room for improvement on the following issues

54. The EDPS would like to underline that the lack of a (data protection) impact assessment does not make it possible to fully assess the necessity and proportionality of changes proposed to the current legal basis for SIS II. In particular, in view of the risks posed by the introduction of new categories of data, in particular the new biometric identifiers, in the system, the EDPS recommends conducting an assessment of the need to collect and use such data in the SIS and of the proportionality of their collection.

55. As regard access to the SIS by the EBCG Teams, teams of staff involved in return-related tasks and members of the migration management support teams, the EDPS stresses that the large number of different actors involved in the data processing should not lead to a blurring of accountability between the EBCG Agency and Member States. Therefore, he recommends specifying in the proposals that the final responsibility and accountability for the processing of personal data will be with the relevant Member States authorities, which will be considered as ‘controllers’ in accordance with EU data protection law.

56. Furthermore the EBCG Teams, teams of staff involved in return-related tasks and members of the migration management support teams should not have access to all categories of alerts in the SIS but only to those relevant for the mission of the given team. Simultaneously the proposals should clearly specify that the access to the SIS need to be restricted only to the representatives of the authorised bodies.

57. The EDPS would also like to draw the attention of the legislator on the need to fully justify the proportionality of the extension of the data retention period of alerts on person from three years in the current legal basis to five years in the proposed legislative package.

58. In addition to the main concerns identified above, the recommendations of the EDPS in the present opinion relate to the following aspects of the proposals: — the reporting of the security incidents, — the information campaign, — the architecture of the system, — the use of the automatic number plate recognition systems, — the statistics generated by the system.

59. The EDPS remains available to provide further advice on the proposals, also in relation to any delegated or implementing act adopted pursuant to the proposed regulations, which might have an impact on the processing of personal data.

Brussels, 3 May 2017. Giovanni BUTTARELLI European Data Protection Supervisor

(1) Convention Implementing the Schengen Agreement of 14 June 1985 between the Government of the States of the Benelux Economic Union, the Federal Republic of Germany and the French Republic on the gradual abolition of checks at their common borders, 19 June 1990 (OJ L 239, 22.9.2000, p. 19).

(2) Regulation (EC) No 1987/2006 of the European Parliament and of the Council of 20 December 2006 on the establishment, operation and use of the second generation Schengen Information System (SIS II) (OJ L 381, 28.12.2006, p. 4).

(3) Council Decision 2007/533/JHA of 12 June 2007 on the establishment operation and use of the second generation Schengen Information System (SIS II) (OJ L 205, 7.8.2007, p. 63).

(4) OJ L 381, 28.12.2006, p. 1.

(5) Those legal acts are complemented by the Regulation (EU) No 515/2014 of the European Parliament and of the Council of 16 April 2014 establishing, as part of the Internal Security Fund, the instrument for financial support for external borders and visa and repealing Decision No 574/2007/EC (OJ L 150, 20.5.2014, p. 143), which established financial support for the creation of SIS II.

(6) Report from the Commission to the European Parliament and the Council on the evaluation of the second generation Schengen Information System (SIS II) in accordance with Article 24(5), 43 (3) and 50 (5) of Regulation (EC) no 1987/2006 and Article 59(3) and 66 (5) of Decision 2007/533/JHA, COM(2016) 880 final.

(7) COM(2016) 882 final.

(8) COM(2016) 883 final.

(9) COM(2016) 881 final.

(10) Commission Decision 2016/C 257/03 of 17.6.2016, further information available: http://ec.europa.eu/transparency/regexpert/index.cfm?do=groupDetail.groupDetail&groupID=3435

(11) Communication of 6 April 2016 on ‘Stronger and Smarter Information Systems for Borders and Security’, COM(2016)205.