EUROPEAN COMMISSION Brussels,16.5.2018 COM(2018) 302 final 2018/0152(COD) Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL amending Regulation (EC) No 767/2008, Regulation (EC) No 810/2009, Regulation (EU) 2017/2226, Regulation (EU) 2016/399, Regulation XX/2018 [Interoperability Regulation], and Decision 2004/512/EC and repealing Council Decision 2008/633/JHA



{SWD(2018) 195 final}



{SWD(2018) 196 final}



EXPLANATORY MEMORANDUM 1.CONTEXT OF THE PROPOSAL ·Background of the proposal Since 2011, the Visa Information System (VIS) has served as the technology solution facilitating the short-stay visa procedure and helping visa, border, asylum and migration authorities to rapidly and effectively check the necessary information on third-country nationals who need a visa to travel to the EU. The VIS connects Member States’ consulates around the world and all their external border crossing points. The system performs biometric matching, primarily of fingerprints, for identification and verification purposes. As stated in the Communication on adapting the common visa policy to new challenges, the EU common visa policy is an essential part of the Schengen acquis. Visa policy is, and should remain, a tool to facilitate tourism and business, while preventing security risks and the risk of irregular migration to the EU. While the fundamental principles of visa processing have not been reviewed since the entry into force of the Visa Code in 2010 and the VIS in 2011, the environment in which visa policy operates has changed drastically. The migration and security challenges faced in recent years have shifted the political debate about the area without internal border control in general, and about visa policy in particular, and prompted the EU to reassess the balance between migration and security concerns, economic considerations and general external relations. In the Communication on preserving and strengthening Schengen the Commission already stated that in an area without controls at internal borders, cross-border threats affecting public policy or the internal security are a matter of common interest. The absence of internal border controls has been accompanied by measures on external borders, visa policy, the Schengen Information System, data protection, police cooperation, judicial cooperation in criminal matters and drugs policies. At the same time, significant technological developments are providing new opportunities to make visa processing easier for both applicants and consulates. Since VIS is an important component of the framework underpinning visa policy, thisproposal complements the recent proposal amending the Visa Code presented by the Commission on 14 March 2018. The VIS is an integral part of the Commission’s approach to managing data for borders, migration and security. It seeks to ensure that border guards, law enforcement officers, immigration officials and judicial authorities have the information they need to better protect the EU's external borders, manage migration and improve internal security forall citizens. In December 2017 the Commission proposed the rules on interoperability between EU information systems to make them work together in a smarter and more efficient way. In 2016 the Entry/Exit Sytem (EES) Regulation established that that the EES and VIS systems can be fully interoperable in order to provide a full picture of the visa application history of third-country nationals by adding information on how they used their visas. The proposal on establishing a framework for interoperability between EU information systems on boders and visa amends the VIS Regulation to establish the VIS as part of the single platform, together with EES and the European Travel Information and Authorisation System (ETIAS), on which the interoperability will be built. The multiple-identity detector introduced by the interoperability proposal will make it easier to detect multiple identities and counter identity fraud. The detector will automatically notify the visa authority processing an application if the applicant is known under different identities so that the authority can take the appropriate course of action. Once the new information systems have become operational and interoperability between them has been ensured, the possibilities for visa processing officers to perform quick background checks on applicants will be greatly increased. The European search portal (ESP) will enable single searches to receive results from different systems. This will help increase the security of the area without internal border controls. The legislation on visa processing needs amending to achieve this objective. The amendments should, in particular, includethe obligation on visa authorities to automatically consult the multiple-identity detector as well as other databases when conducting security and migratory assessments of third country nationals applying for a short-stay visa. An information gap at EU level was identified concerning the documents that allow third-country nationals to stay for a period of time of more than 90/180 days in the Schengen area: long-stay visas, residence permits and residence cards (Final Report of the high-level expert group on information systems and interoperability - HLEG - of May 2017). The Council invited the Commission to undertake a feasibility study on the establishment of a central EU repository containing information on long-stay visas, residence cards and residence permits. The study was finalised in September 2017 and concluded that a repository as part of the VIS would provide the most feasible solution in terms of IT security, ease of implementation and cost-effectiveness. A follow-up study was carried out on the necessity and the proportionality of extending the VIS to include data on long stay visas and residence documents. In addition to the interoperability work launched since April 2016 to create stronger and smarter information systems for borders and security, an overall evaluation of the VIS was carried out in 2016. The evaluation looked specifically into the system’s fitness for purpose, efficiency, effectiveness and added value for the EU. It found that the VIS meets its objectives and functions and remains one of the most advanced systems of its kind, but that new challenges in visa, border and migration management meant it needed further development in a number of specific areas. On 17 April 2018, the Commission presented a proposal on strengthening the security of residence cards of third country nationals who are family members of EU citizens. In view of this proposal, including such residence cards in the VIS is not necessary. ·Existing provisions in the area of the proposal The VIS was established by Decision 2004/512/EC and its purpose, functionalities and responsibilities are set out in Regulation (EC) No 767/2008 (the VIS Regulation). Regulation (EC) No 810/2009 of 13 July 2009 (the Visa Code) sets out the rules on the registration of biometric identifiers in the VIS. Council Decision 2008/633/JHA of 23 June 2008 lays down the conditions under which Member States’ designated authorities and Europol may obtain access to consult the VIS for the purposes of preventing, detecting and investigating terrorist offences and other serious criminal offences. This proposal is without prejudice to Directive 2004/38/EC. The proposal does not in any respect amend Directive 2004/38. ·Objectives of the proposal The general objectives of this initiative correspond to the Treaty based objectives of improving security within the EU and at its borders, facilitating the right of legitimate travellers to cross the external border, and freely move and stay within the area without internal border controls, and facilitating the management of the Schengen external borders. These objectives are further elaborated in the European Agenda on Migration and in subsequent communications, including the Communication on preserving and strengthening Schengen, the European Agenda on Security, the Commission’s progress reports towards an effective and genuine Security Union and the Communication on adapting the common visa policy to new challenges. The specific objectives of this proposal are to: (1)facilitate the visa application procedure; (2)facilitate and strengthen checks at external border crossing points and within the territory of the Member States;

(3)enhance the internal security of the Schengen area by facilitating the exchange of information among Member States on third country nationals holders of long stay visas and residence permits. A number of ancillary objectives are also pursued: (4)facilitate identity checks of third-country nationals, on the territory of a Member State, by migration and law enforcement authorities; (5)make it easier to identify missing persons; (6)assist in the process of identifying and returning any person who may not or no longer fulfil the conditions for entry to, stay or residence in the Member States; (7)help law enforcement authorities access data of applicants for and holders of short-stay visas (which is already possible under current rules), and extend this access to holders long-stay visas and residence permits, where necessary for the prevention, investigation, detection or prosecution of serious crime and terrorism, while ensuring high standards of data protection and privacy; (8)gather statistics to support evidence-based European Union migration policy making. 2.RESULTS OF EX-POST EVALUATIONS, STAKEHOLDER CONSULTATIONS AND IMPACT ASSESSMENTS ·Ex-post evaluations/fitness checks of existing legislation A REFIT evaluation of the VIS was carried out in 2016 and led to a number of recommendations to improve the functioning of the system. These recommendations provided a basis for this proposal. Overall, the VIS evaluation showed that the system is effective in meeting its objectives. However, it demonstrated a need to further develop the VIS to better respond to new challenges in visa, border and security policies. This could be done by interconnecting with existing and upcoming IT systems and exploring ways to have information on long-stay visas, including biometrics, registered in the VIS. The evaluation also showed the need for improvements, in particular in relation to the monitoring of data quality and the production of statistics. Most of the issues identified by the evaluation were of a technical nature and serve to further align the system with the new legislative proposals in this area. They mainly concern: 1) improving data quality; 2) integrating the VISMail functionality into the VIS; 3) centralising the consultation and representation functions; 4) providing support for facial image recognition or use of latent fingerprints; and 5) setting up a reporting and statistics engine based on VIS data. Between October 2016 and July 2017, eu-LISA carried out a study on all envisaged technical impacts resulting from the VIS evaluation. A detailed assessment of the impact of these technical improvements was therefore not needed. However, several issues identified in the evaluation required not only a technical analysis, but also further analysis of the possible solutions that would address them and their impacts: ·the difficulties in completing procedures to return irregular migrants to their countries of origin if travel documents are missing;

·the risks of irregular migration and visa fraud, in particular trafficking in human beings and other abuse involving children under 12 years old, when applying for a visa; ·the difficulties for border or migration authorities in verifying long-stay visas and residence permits and their holders; ·the information gap on checks for irregular migration and security risks when processing visa applications. ·the need to consider the possibility when processing visas to automatically consult other databases in the area of security and borders. This should take into account developments since the 2016 evaluation regarding EU information systems for border management and security and ensure compliance with recently adopted Commission proposals (EES) and proposed new developments and systems (recast Eurodac proposal, ETIAS, ECRIS-TCN, interoperability). ·Consultation of interested parties Annex 2 of the accompanying impact assessment sets out a detailed description of the stakeholder consultation. The Commission contracted three independent studies: one on the feasibility, necessity and proportionality of lowering the fingerprinting age for children in the visa procedure and on storing a copy of the travel document of the visa applicants in the VIS, and two studies on the feasiblity and on the necessity and proportionality of extending the VIS to include data on long-stay visas and residence documents (i.e. residence permits and residence cards). These studies also involved targeted consultations of all concerned stakeholders, including national authorities that have access to enter, amend, delete or consult data in the VIS, national authorities responsible for migration, return, child protection authorities, police and anti-trafficking authorities, authorities responsible for consular affairs, and national authorities responsible for checks at external border crossing points. Various non-EU authorities and non-governmental organisations involved in children’s rights were also consulted. In 2017-2018 the Commission carried out two open public consultations, the first from 17 August 2017 to 9 November 2017 on the issue of lowering the fingerprinting age for children in the visa procedure and the second one from 17 November 2017 to 9 December 2018 on extending the VIS to include data on long-stay visas and residence documents. The European Data Protection Supervisor provided its views on the issue of lowering the fingerprinting age for children on 9 November 2017 and on the issue of extending the VIS to include data on long stay visas and residence documents on 9 February 2018. The EDPS and the Fundamental Rights Agency have provided their views on various aspects of the proposal during targeted interviews as part of the stakeholder consultations conducted in the preparation of the impact assessment. ·Impact assessment An impact assessment was carried out in 2018, focusing on those issues needing further assessment to draft this proposal. It was based on three independent studies contracted out by the Commission and carried out in 2017 and 2018. The findings of eu-LISA’s study on the technical feasibility of all possible VIS developments, which was carried out in November 2016 and February 2017, and the feasibility study on integrated border management for people not recorded in the EES (ETIAS study) were also taken into account. The impact assessment looked into alternative options for: ·including a digital copy of the travel document in the VIS (in a centralised or decentralised manner), considering two sub-options: storing only the biographical page or storing all used pages of the applicant’s travel document; ·lowering the fingerprinting age of children, considering two sub-options: lowering the fingerprinting age to six years or lowering the fingerprinting age to include all ages; ·including data on long-stay visas and residence documents in the VIS, with legislative options including further harmonising and securing long-stay and residence documents; creating an interconnection between national databases that would allow all Member States to search each other’s relevant national databases; integrating documents in the VIS with or without data on rejected applications; ·ensuring automated migration and security checks against available databases. This proposal follows the preferred options of the impact assessment as regards the first (storing a copy of the biographical page of the travel document), the second (lowering the fingerprinting age to 6 years) and the fourth measure above. As regads the inclusion of long-stay visas and residence documents in the VIS, information on residence cards issued to the family members of EU citizens with the right of free movement under Union law is not included in this proposal given the rights of these third country nationals stemming from their family relationship with an EU citizen. Moreover, the proposal presented by the Commission on 17 April 2018 strengthened the security of such residence cards. The Regulatory Scrutiny Board reviewed the draft impact assessment and delivered a positive opinion on 23 April 2018. 3.LEGAL BASIS, SUBSIDIARITY AND PROPORTIONALITY ·Summary of the proposed actions

The purpose, functionalities and responsibilities of the VIS must be further defined to take into account the expansion of the system to include data related to holders of long-stay visas and residence permits. This VIS must also be expanded so that the categories of data on applications for short-stay visas include storing copies of travel documents, and must integrate new functionalities such as the repository for reporting and statistics or the VISMail. This means that the rules setting out the procedure for processing visa applications in the Visa Code must be amended. Access of law enforcement authorities of the Member States and of Europol to VIS has been established by Council Decision 2008/633/JHA. This Decision, which predates the Lisbon Treaty, regulated law enforcement access in the framework of the former so called "third pillar" of the Treaty on European Union. As this "third pillar" no longer exists as such in the current Treaties, the Commission considers that the current proposal provides the opportunity to integrate the content of this Decision into the VIS Regulation. As the VIS will be expanded to contain information on long-stay visas and residence permits, the required further development and operational management of the system will be entrusted to the Agency for the operational management of large-scale IT systems in the area of freedom, security and justice (eu-LISA). Consequently, amendments will need to be made to Regulation (EC) No 810/2009 (the Visa Code), Regulation (EC) No 767/2008, Regulation (EU) 2017/2226 (the EES Regulation), Regulation (EU) XX [the Interoperability Regulation] and Regulation (EU) 2016/399 (the Schengen Borders Code). The main objectives of the proposal can be summarised as follows: Closing remaining information gaps for borders and security: include long-stay visas and residence documents in the VIS The f inal report of the High-level expert group identified an information gap at EU level concerning the documents that allow third country nationals to stay on the territory of a given EU Member State for longer than 90 days in any 180 days. Data on these documents and their holders are currently not collected and the data cannot be verified through any of the EU large-scale IT systems in the area of border and security (except SIS, to a limited extent). Member States consider that the current management of these documents can hamper the border crossing of third country nationals and their subsequent free movement in the area without internal border controls. Third country nationals who are coming to the EU for a long stay are the only category of third country nationals not covered by any of the EU large-scale IT systems (as illustrated in the figure below). Including long-stay visas and residence permits in the VIS would ensure that information about these documents and their holders is included in one of the large-scale EU IT systems, and under the same rules as for documents issued to them either under visa-free conditions (data already in ETIAS and EES) and visa-required (third country nationals coming for a short stay, whose data are already in VIS and EES). This will enable Member State authorities other than the issuing authority to check that document and its holder at the borders or within the territory of the Member States. By facilitating a systematic and better exchange of information among Member States on third country nationals holding long-stay visas and residence permits, the VIS would help improve the internal security of the Schengen area. If records of long-stay or residence permits are placed in a central system and made accessible to all relevant Member State authorities, each Member State will be able to make a more precise and impartial assessment of the security risk, based on the records found in the system when checking the document holders at border crossing points and in the territory of the Member States. Moreover, including these documents in a centralised system will help detect fraud linked to obtaining authentic documents on the basis of false breeder documents. Facilitating a better and systematic exchange of information among Member States would also minimise administrative burden and overcome the language barrier when contacting another Member State to verify the authenticity of a document presented by a third country national. When deciding whether to issue or extend a long-stay visa or residence permit, a number of automated checks will be launched using the interoperability components (the ESP) to detect whether an EU or Interpol database contains any evidence that the person could pose a threat to the security of one of the Member States. The Member State issuing the document will have to follow up on any hit in accordance with existing EU and national law. Enhancing checks in visa processing using interoperability Under the current rules, consulates are only obliged to check travellers under a visa obligation in the Schengen Information System to determine whether a visa applicant is subject to an entry ban. There is currently no obligation to check visa applicants against any other available EU databases (e.g. EURODAC), or against Interpol’s Stolen and Lost Travel Documents database and Travel Documents Associated with Notices database. Once in place, the European Search Portal will allow competent authorities — including visa processing authorities — to carry out a single search and receive results from all systems they are authorised to access (including EURODAC, EES and the European Criminal Records Information System — Third Country Nationals) rather than searching in each system individually. The European Search Portal will make it easier to detect security and irregular migration risks in the visa procedure by enabling visa officers to perform quick and efficient background checks on visa applicants. The interoperability proposal also aims to make it easier to detect multiple identities and counter identity fraud. Using this interoperability feature, the visa authority processing an application will be notified automatically if the applicant is known under different identities and will be able to take the appropriate course of action. Since the VIS is also part of the legal framework setting up interoperability, technical possibilities have opened up to ensure the practical communication between various databases in a fast, seamless and systematic manner by authorised users. Enabling the visa authorities to carry out automated checks against other databases using the European Search Portal makes this is the first time that the interoperability framework has been applied in practice. When verifying and assessing the information submitted by applicants, the VIS will automatically query each application against each of the above systems. In addition to automated queries of other databases, visa processing will benefit from specific risk indicators. The indicators will contain data analytics rules, as well as specific values provided by Member States and statistics generated from other relevant border management and security databases. This would improve risk assessments and allow the data-analytics method to be applied. The risk indicators would not contain any personal data and would be based on statistics and information provided by Member States on threats, abnormal rates of refusal or overstay by certain categories of third country nationals, and public health risks. The introduction of systematic checks for security and migration in connection to VIS data builds on the benefits opened up by the interoperability framework.

Making it easier to identify missing persons Situations may occur where persons need to be identified in their own interest – because they were lost, missing, or identified as victims of trafficking. The possibility for the police authority to identify a person with the biometric data of that person taken during an identity check has been provided within the interoperability framework, where the national law allows. However, such access would not be sufficiently effective in the specific circumstances as the ones described above. For this purpose, quick access should be given for law enforcement authorities to VIS data to enable a fast and reliable identification of the person, without the need to fulfill all the preconditions and additional safeguards for law enforcement access. Addressing remaining information gaps in short-stay visa processing: lowering the fingerprinting age of applicants and storing copies of travel documents in the VIS to support return procedures ·Lowering the fingerprinting age for child applicants from 12 years to 6 years This measure will allow officials to verify a child’s identity in the visa application procedure, and will enable checks when crossing an external border. Furthermore, by making it possible to unambiguously identify children, the measure will better protect children and help fight against trafficking and irregular migration while keeping the child’s best interests at the fore. Additional safeguards are introduced in law in order to ensure that the best interests of the child are preserved throughout the visa processing procedure and in any subsequent use of children’s data. Fingerprints will be taken from every visa applicant from 6 years of age and above, thereby increasing the group of applicants for short-stay visas by adding the 6 to 11 year-old age-group. When Regulation (EC) No 810/2009 was adopted, it was recognised that the issue of the sufficient reliability for identification and verification purposes of the fingerprints of children under 12 and, in particular, how fingerprints evolve with age, would have to be addressed at a later stage. In 2013, the European Commission’s Joint Research Centre (JRC) therefore carried out a study into whether or not automated fingerprint recognition for children can produce recognition rates similar to those of adults. The JRC study concluded that fingerprint recognition of children aged between 6 and 12 years is achievable with a satisfactory level of accuracy under certain conditions. One such condition would, for example, be to ensure that operators receive an appropriate level of training to acquire high quality images. A second study confirmed this finding and provided further insight into the effect of aging on fingerprint quality. The Commission conducted a further study looking into the necessity and proportionality of lowering the fingerprinting age for children in the visa procedure. This study found that lowering the fingerprinting age would help better achieve the VIS objectives, in particular in relation to facilitating the fight against identity fraud and streamlining checks at external border crossing points. It also found that lowering the fingerprinting age could bring additional benefits by strengthening the prevention and fight against abuses of children’s rights, in particular by making it possible to identify or verify the identity of third country national children who are found in the territory of the Member States in a situation where their rights may be or have been violated (e.g. child victims of human trafficking, missing children and unaccompanied minors applying for asylum). ·Storing a copy of the bio-page of the applicant's travel document in the VIS to support return procedures The proposal introduces a new category of data to be stored in the VIS when submitting a visa application. Currently Member States take copies of the applicant’s travel document. However, there are no EU rules laying down uniform conditions for retaining or exchanging this information among Member States. Retaining a copy of the travel document will make it possible to run better checks of these documents and increase the efficiency of return procedures. Using the VIS to implement this measure would support the EU’s return policy. The competent authorities for identification (and/or verification within the territory) and return – namely migration and return authorities – which already have access to search the system using the fingerprints of the third country national, would be able to retrieve this copy, subject to strict access rules. Under Article 2(e) of the VIS Regulation, one of the objectives of VIS is ‘to assist in the identification of any person who may not, or may no longer, fulfil the conditions for entry to, stay or residence on the territory of the Member States’. Article 31(2) enables the Member States to transfer or to make available a limited set of these data to a third country for the purpose of proving the identity of third country nationals for the purpose of return. The VIS has been further enhanced with this measure to help identify and return irregular migrants. Upgrading other technical components of the VIS The VISMail mechanism for consultations is integrated in the VIS in order to streamline the exchanges between the VIS central system and the national systems. The configuration of the central system is adapted to better respond to the need to rapidly and efficiently ensure availability in periods of disruption (i.e. back-up system turned into an active/active configuration). To improve the quality of the data recorded in the VIS, indicators on data quality defects have been introduced at application level. Eu-LISA has been entrusted with the role of managing data quality checks in the VIS. A functionality has been included to ensure that the VIS refuses to launch a request for prior consultation until all appropriate information has been properly filled in. Another functionality makes it possible to distinguish between the cases where fingerprints are not required for legal reasons and the cases where they cannot be provided. To address problems in collecting biometrics, in particular those affecting the quality of facial images, alternative standards will be put in place, such as a direct collection of photographs (i.e. facial image taken live). A centralised technical solution is envisaged for prior consultation, representation and subsequent notification, enabling Member States to manage and update their own information regarding these functions. ·Legal basis The legal basis consists of this Regulation consists of the following articles of the Treaty on the Functioning of the European Union: Article 16(2), Article 77(2)(a), (b), (d) and (e), Article 78(2)(d), (e) and (g), Article 79(2)(c) and (d), Article 87(2)(a) and Article 88(2)(a). Under Article 77(2), (a), (b), (d) and (e) TFEU respectively, the European Parliament and the Council can adopt measures concerning the common policy on visas and other short-stay residence permits, the checks to which persons crossing external borders are subject, and any measure necessary for the gradual establishment of an integrated management system for external borders and the absence of any controls on persons, whatever their nationality, when crossing internal borders. This is the main legal basis for this proposed Regulation. Under Article 16(2) TFEU, the Union has the power to adopt measures relating to the protection of individuals with regard to the processing of personal data by Union institutions, bodies, offices and agencies and by Member States when carrying out activities which fall within the scope of Union law, and the rules relating to the free movement of such data. This Treaty provision is also an important legal basis for this proposal. An ancillary objective of this proposal is to allow, under strict conditions, national law enforcement authorities and to Europol to access VIS data for law enforcement purposes. The proposal therefore also relies on Article 87(2)(a) and Article 88(2)(a) TFEU respectively. Both these additional legal bases command the same ordinary legislative procedure which is applicable under Article 77(2).

This proposal pursues a number of further ancillary objectives, such as contributing to the Dublin and asylum examination procedure, which are measures developed under Article 78(2)(d), (e) and (g) TFEU; helping identify and return third country nationals as part of the measures developed under Article 79(2)(c) TFEU, and supporting the identification of victims and combat trafficking in persons as part of the measures developed under Article 79(2)(d) TFEU. Those additional legal bases are also compatible with the main ones. ·Subsidiarity principle Article 77(2)(a) TFEU empowers the Union to develop measures concerning ‘the common policy on visas and other short-stay residence permits.’ This proposal is within the limits set by this provision. The objective is to further develop and improve the rules on the electronic processing of applications for intended stays in the territory of Member States not exceeding 90 days in any 180-day period. This cannot be sufficiently achieved by the Member States acting alone, because only the Union can amend an existing Union Act (the VIS Regulation). Freedom of movement within the area without internal border controls requires that its external borders are effectively managed to ensure security. Member States have therefore agreed to address these challenges collectively, especially by sharing information through centralised EU systems in the area of justice and home affairs. This is confirmed by the various conclusions that have been adopted by both the European Council and the Council, especially since 2015. The absence of internal border controls requires sound management of the external borders, where each Member State or associated country has to control the external border on behalf of the others. No Member State can cope on its own with irregular migration and cross-border crime. Third country nationals who enter the area without internal border controls are able to travel freely within this area. In an area without internal borders, common action against irregular immigration and international crime and terrorism, including through the detection of identity fraud, should be taken and can only be successfully addressed at EU level. Under Article 77(2)(b) of the Treaty on the Functioning of the European Union, the Union has the power to adopt measures relating to the checks on persons and efficient monitoring of the crossing of external borders of the Member States. Current EU law on the visa procedure needs to be modified to take into account the travel movements of third country nationals applying for a short-stay visa, in particular the recent EES provisions doing away with the stamping obligation and instituting an entry and exit record for the third country nationals admitted for a short stay, thus allowing Members States’ authorities to assess the lawful use of previous short stays in an area without internal border controls. As regards long-stay visas and residence permits, Article 21 of the Schengen Convention provides for their mutual recognition as documents allowing their holders to move freely within the Schengen area for 90 days in any 180 days (i.e. similar to a short-stay visa), provided they fulfil the conditions in Article 6(1)(a), (c) and (e) of Regulation (EU) 2016/399 (the Schengen Borders Code). Various Council conclusions have called for new measures to fill the information gaps for border management and law enforcement in relation to border crossings by holders of long-stay visas and residence permits, possibly by creating an EU repository of such data. Including data on these documents so that the data can be shared among Member States and the holder’s documents be verified at external borders or within the EU by Member States other than the one that issued a document and in order to verify whether the person could pose a threat to the security of one of the Member States responds to objectives set under Article 77 of the Treaty on the Functioning of the European Union. Therefore, this objective of the proposal cannot be sufficiently achieved by the Member States acting alone and is better achieved at Union level. ·Proportionality principle As explained in the impact assessment accompanying this proposal for a revised Regulation, the policy choices made in this proposal are considered proportionate. They do not go beyond what is necessary to achieve the agreed objectives. Article 5 of the Treaty on the European Union states that action by the Union must not go beyond what is necessary to achieve the objectives of the Treaty. The form chosen for this EU action must enable the proposal to achieve its objective and be implemented as effectively as possible. The proposed initiative constitutes a further development of the rules on border-free travel in order to ensure that common rules at external borders are applied in the same way in all the Member States which have abolished controls at internal borders. It further builds on an instrument providing to the European Union information on third country nationals. It codifies and improves existing law enforcement authorities' access to the VIS information on these categories of third country nationals, which is a timely, accurate, secure and cost-efficient way to identify third country nationals suspected (or victims) of terrorism or a serious crime and to enable the authorities to consult the application history of third country nationals who are suspects (or victims) of such crimes. The proposal has been designed around the ‘data protection by design’ principles and is proportionate in terms of the right to protection of personal data because it does not require the collection and storage of more data for a longer period than is absolutely necessary to allow the system to function and meet its objectives. In addition, the proposal will provide for and implement all the safeguards and mechanisms required for the effective protection of the fundamental rights of travellers, particularly their private life and personal data. No further processes or harmonisation will be necessary at EU level to make the system work. The envisaged measure is therefore proportionate because it does not go beyond what is necessary in terms of action at EU level to meet the defined objectives. The preferred option is also proportionate in terms of costs, taking into account the benefits the system will provide to all Member States in managing the common external border and progressing towards a common EU migration policy. The proposal therefore complies with the proportionality principle. ·Choice of instrument This proposal builds on an existing centralised system through which Member States cooperate with each other, and which requires a common architecture and operating rules. Moreover, it lays down rules on border checks at the external borders and on access to the system, including for the purpose of law enforcement, which are uniform for all Member States. As a consequence, only a Regulation can be chosen as a legal instrument. ·Fundamental rights The proposed Regulation has an impact on fundamental rights, notably on the right to dignity (Article 1 of the Charter of Fundamental Rights of the EU); the right to liberty and security (Article 6 of the Charter), respect for private and family life (Article 7 of the Charter), the protection of personal data (Article 8 of the Charter), the right to asylum and protection of the principle of non-refoulement (Articles 18 and 19 of the Charter) and protection in the event of removal, expulsion or extradition (Article 19 of the Charter), the right to non-discrimination (Article 21 of the Charter), the rights of the child (Article 24 of the Charter) and the right to an effective remedy (Article 47 of the Charter). The 2008 VIS Regulation establishes strict rules on access to the VIS and the necessary safeguards. It also provides for individuals’ rights of access, correction, deletion and redress (i.e. rectification, erasure and remedies in the terms of the General Data Protection Regulation) in particular the right to a judicial remedy and the supervision of processing operations by public independent authorities. Additional safeguards are introduced by this proposal to cover the specific needs of the new categories of data, data processing and data subjects that will be covered by the VIS. Therefore, the proposal fully complies with the Charter of Fundamental Rights of the European Union, in particular as regards the right to the protection of personal data, and is also in line with Article 16 TFEU which guarantees everyone the right to protection of personal data concerning them.

4.BUDGETARY IMPLICATIONS Following the technical study carried out by eu-LISA in 2016 on the technical modification to the VIS resulting from the REFIT exercise and the impact assessment, this proposal follows the option of extending the VIS to include data on long-stay visas and residence permits, to carry out automated checks against EU and Interpol databases for security and, as applicable, irregular migration checks, and to lower the fingerprinting age for children and store a copy of the bio-page of the travel document of the applicants in the VIS. The study assessed that this will require EUR 182 million. The development phase is expected between 2021 and 2023, so the necessary funds will be covered from the allocated amount under the next EU budget. If the proposal is adopted before the next financial framework, the necessary resources (estimated at EUR 1.5 million) will be financed from the ISF-Borders and Visa budget line and the amounts will be deducted from the money earmarked for 2021-2023. The EUR 1.5 million would be used to launch the preparatory work leading to the implementation of the measures set out in this proposal, such as those related to preparing the implementing acts and launching public procurement contracts. Should political agreement on this proposal be reached by March 2019 (i.e. under current legislature) the objective is to implement the proposal by end 2021. The resources required for this proposal (both for the Border Management Fund and for each of the agencies concerned) are compatible with the Commission proposal for the 2021-2027 Multiannual Financial Framework of 2 May 2018. The costs linked to the implementation of this proposal are allocated as follows: –EUR 105 million to eu-LISA (indirect management); –EUR 45 million to the Member States, earmarked in their National Programmes (shared management); –EUR 2 million to the European Border and Coast Guard Agency (EBCGA) (indirect management); –EUR 30 million to Europol (indirect management). The cost model applied is explained in Annex 3 - "Who is affected and how", Section 2 on "Summary of costs and benefits" and in Annex 4 "REFIT" of the Impact Assessment, as well as analysed more in-depth in the study on "Feasibility and Implications of Lowering the Fingerprinting age for Children", the study on "Storing a scanned copy of the visa applicants' travel document in the Visa Information System", the "Feasibility study to include in a repository documents for Long-Stay visas, Residence and Local Border Traffic Permits" and the "Legal Analysis on the Necessity and Proportionality of Extending the Scope of the Visa Information System (VIS) to Include Data on Long Stay Visas and Residence Documents", suporting the Impact Assessment. 5.ADDITIONAL INFORMATION ·Implementation plans and monitoring, evaluation and reporting arrangements The Commission will ensure the monitoring of the functioning of the VIS and evaluate its main policy objectives. Four years after the start of the application of the revised VIS Regulation and every four years thereafter, the Commission will submit a report to the European Parliament and to the Council. The report will present an overall evaluation of the functioning of the system, including its direct and indirect impacts and practical implementation on fundamental rights. It should examine results achieved against objectives, assess the progress with respect to the four main problem areas, and assess the continuing validity of the underlying rationale and any implications for future options. The implementation of the VIS is also evaluated through the Schengen evaluation mechanism in accordance with Council Regulation (EU) No 1053/2013, without prejudice to the Commission's role as guardian of the Treaties (Article 17(1) TEU). ·Variable geometry This proposal builds upon and develops the Schengen acquis regarding external borders and visas in that it concerns the crossing of external borders and the granting of short-stay visas. This has the following consequences in relation to the Treaty protocols and the agreements regarding association with the development of the Schengen acquis: Denmark: In accordance with Articles 1 and 2 of the Protocol (No 22) on the position of Denmark, annexed to the Treaty on European Union (TEU) and the Treaty on the Functioning of the European Union (TFEU), Denmark does not take part in the adoption by the Council of measures pursuant to Title V of part Three of the TFEU. Given that this Regulation builds upon the Schengen acquis, Denmark must, in accordance with Article 4 of that Protocol decide within a period of six months after the Council has decided on this Regulation whether it will implement it in its national law. United Kingdom and Ireland: In accordance with Articles 4 and 5 of the Protocol integrating the Schengen acquis into the framework of the European Union and Council Decision 2000/365/EC of 29 May 2000 concerning the request of the United Kingdom of Great Britain and Northern Ireland, and Council Decision 2002/192/EC of 28 February 2002 concerning Ireland's request to take part in some of the provisions of the Schengen acquis, the United Kingdom and Ireland do not take part in Regulation (EC) No 767/2008 (the VIS Regulation) nor in any other of the legal instruments which are commonly known as the "Schengen acquis", i.e. the legal instruments organising and supporting the abolition of controls at internal borders and the flanking measures regarding the controls at external borders. This Regulation constitutes a development of this acquis, and therefore, the United Kingdom and Ireland are not taking part in the adoption of this Regulation and are not bound by it or subject to its application. In line with the judgment of the Court of Justice in case C-482/08, United Kingdom v. Council, the circumstance that this Regulation has Articles 87(2)(a) and Article 88(2)(a) as legal bases alongside Article 77(2)(b) and (d) TFEU does not affect the above conclusion, as the access for law enforcement purposes is ancillary to the establishment of the Visa Information System. Iceland and Norway: The procedures laid down in the Association Agreement concluded by the Council and the Republic of Iceland and the Kingdom of Norway concerning the latter's association with the implementation, application and development of the Schengen acquis are applicable, since this proposal builds on the Schengen acquis as defined in Annex A to this Agreement.

Switzerland: This Regulation constitutes a development of the provisions of the Schengen acquis, as provided for by the Agreement between the European Union, the European Community and the Swiss Confederation on the latter's association with the implementation, application and development of the Schengen acquis. Liechtenstein: This Regulation constitutes a development of the provisions of the Schengen acquis, as provided for by the Protocol between the European Union, the European Community, the Swiss Confederation and the Principality of Liechtenstein on the accession of the Principality of Liechtenstein to the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation's association with the implementation, application and development of the Schengen acquis. Croatia, Cyprus, Bulgaria and Romania: The visa policy including the VIS is part of the Schengen acquis not yet applicable by Member States not yet fully applying this acquis according to their Acts of Accesions. A simplified regime for controls of persons at the external borders was introduced in accordance with Decision No 565/2014/EU of the European Parliament and of the Council. That regime is based on the unilateral recognition by Bulgaria, Croatia, Cyprus and Romania of certain documents, notably Schengen visas issued by the Member States applying the Schengen acquis in full as equivalent to their national visas for transit through or intended stays on their territories, not exceeding 90 days in any 180-day period. Council Decision (EU) 2017/1908 further allows Bulgaria and Romania access to consult, in a read-only mode, the VIS data without the right to enter, amend or delete data in the VIS, in order to facilitate their national visa application procedure and prevent fraud and any abuse of Schengen visas by verifying their validity and authenticity against the data stored in the VIS; to facilitate — with regard to third country nationals holding a short stay visa — checks at border crossing points at external borders and within the territory of the Member States; to facilitate the determination of the Member State responsible for applications for international protection; to facilitate the examination of such applications, and to increase the level of internal security in the territory of the Member States by facilitating the fight against serious crime and terrorism. Since this Regulation constitutes a development of this acquis, in the sense of extending the VIS consultation and exchange of information to long-stay visas and residence permits, which are also recognised by these Member States as equivalent to their national visas for transit through or intended stays on their territories, Bulgaria and Romania should have access to consult the long-stay visas and residence permits for the same purposes as defined in Council Decision (EU) 2017/1908. 2018/0152 (COD) Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL amending Regulation (EC) No 767/2008, Regulation (EC) No 810/2009, Regulation (EU) 2017/2226, Regulation (EU) 2016/399, Regulation XX/2018 [Interoperability Regulation], and Decision 2004/512/EC and repealing Council Decision 2008/633/JHA



THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION, Having regard to the Treaty of the Functioning of the European Union, and in particular, Article 16(2), Article 77(2)(a) (b), (d) and (e), Article 78(2)(d),(e) and (g), Article 79(2)(c), and (d), Article 87(2)(a) and Article 88(2)(a), Having regard to the proposal from the European Commission, After transmission of the draft legislative act to the national parliaments, Having regard to the opinion of the European Economic and Social Committee, Having regard to the opinion of the Committee of the Regions, Acting in accordance with the ordinary legislative procedure, Whereas: (1)The Visa Information System (VIS) was established by Council Decision 2004/512/EC to serve as the technology solution to exchange visa data between Member States. Regulation (EC) No 767/2008 of the European Parliament and of the Council laid down the VIS purpose, functionalities and responsibilities, as well as the conditions and procedures for the exchange of short-stay visa data between Member States to facilitate the examination of short-stay visa applications and related decisions. Regulation (EC) No 810/2009 of the European Parliament and of the Council set out the rules on the registration of biometric identifiers in the VIS. Council Decision 2008/633/JHA laid down the conditions under which Member States’ designated authorities and Europol may obtain access to consult the VIS for the purposes of preventing, detecting and investigating terrorist offences and other serious criminal offences. (2)The overall objectives of the VIS are to improve the implementation of the common visa policy, consular cooperation and consultation between central visa authorities by facilitating the exchange of data between Member States on applications and on the decisions relating thereto, in order to: facilitate the visa application procedure; prevent ‘visa shopping’; facilitate the fight against identity fraud; facilitate checks at external border crossing points and within the Member States’ territory; assist in the identification of any person who may not, or may no longer, fulfil the conditions for entry to, stay or residence on the territory of the Member States; facilitate the application of the Regulation (EU) No 604/2013 of the European Parliament and of the Council and contribute to the prevention of threats to the internal security of any of the Member States. (3)The Communication of the Commission of 6 April 2016 entitled 'Stronger and Smarter Information Systems for Borders and Security' outlined the need for the EU to strengthen and improve its IT systems, data architecture and information exchange in the area of border management, law enforcement and counter-terrorism and emphasised the need to improve the interoperability of IT systems. The Communication also identified a need to address information gaps, including on third country nationals holding a long-stay visa. (4)The Council endorsed a Roadmap to enhance information exchange and information management on 10 June 2016. In order to address the existing information gap in the documents issued to third-country nationals, the Council invited the Commission to assess the establishment of a central repository of residence permits and long-stay visas issued by Member States, to store information on these documents, including on expiry dates and on their possible withdrawal. Article 21 of the Convention implementing the Schengen Agreement provides a right to free movement within the territory of the states party to the Agreement for a period of not more than 90 days in any 180 days, by instituting the mutual recognition of the residence permits and long stay visas issued by these States.

(5)In Council Conclusions of 9 June 2017 on the way forward to improve information exchange and ensure the interoperability of EU information systems, the Council acknowledged that new measures might be needed in order to fill the current information gaps for border management and law enforcement, in relation to border crossings by holders of long-stay visas and residence permits. The Council invited the Commission to undertake a feasibility study as a matter of priority for the establishment of a central EU repository containing information on long-stay visas and residence permits. On this basis, the Commission conducted two studies: the first feasibility study concluded that developing a repository would be technically feasible and that re-using the VIS structure would be the best technical option, whereas the second study conducted an analysis of necessity and proportionality and concluded that it would be necessary and proportionate to extend the score of VIS to include the documents mentioned above. (6)The Communication of the Commission of 27 September 2017 on the ‘Delivery of the European Agenda on Migration’ stated that the EU's common visa policy is not only an essential element to facilitate tourism and business, but also a key tool to prevent security risks and risks of irregular migration to the EU. The Communication acknowledged the need to further adapt the common visa policy to current challenges, taking into account new IT solutions and balancing the benefits of facilitated visa travel with improved migration, security and border management. The Communication stated that the VIS legal framework would be revised, with the aim of further improving the visa processing, including on data protection related aspects and access for law enforcement authorities, further expanding the use of the VIS for new categories and uses of data and to make full use of the interoperability instruments. (7)The Communication of the Commission of 14 March 2018 on adapting the common visa policy to new challenges reaffirmed that the VIS legal framework would be revised, as part of a broader process of reflection on the interoperability of information systems. (8)When adopting Regulation (EC) No 810/2009, it was recognised that the issue of the sufficient reliability for identification and verification purposes of fingerprints of children under the age of 12 and, in particular, how fingerprints evolve with age, would have to be addressed at a later stage, on the basis of the results of a study carried out under the responsibility of the Commission. A study carried out in 2013 by the Joint Research Centre concluded that fingerprint recognition of children aged between 6 and 12 years is achievable with a satisfactory level of accuracy under certain conditions. A second study confirmed this finding in December 2017 and provided further insight into the effect of aging over fingerprint quality. On this basis, the Commission conducted in 2017 a further study looking into the necessity and proportionality of lowering the fingerprinting age for children in the visa procedure to 6 years. This study found that lowering the fingerprinting age would contribute to better achieving the VIS objectives, in particular in relation to the facilitation of the fight against identity fraud, facilitation of checks at external border crossing points, and could bring additional benefits by strengthening the prevention and fight against children's rights abuses, in particular by enabling the identification/verification of identity of third-country national (TCN) children who are found in Schengen territory in a situation where their rights may be or have been violated (e.g. child victims of trafficking in human beings, missing children and unaccompanied minors applying for asylum). (9)The best interests of the child shall be a primary consideration for Member States with respect to all procedures provided for in this Regulation. The child’s well-being, safety and security and the views of the child shall be taken into consideration and given due weight in accordance with his or her age and maturity. The VIS is in particular relevant where there is a risk of a child being a victim of trafficking. (10)The personal data provided by the applicant for a short-stay visa should be processed by the VIS to assess whether the entry of the applicant in the Union could pose a threat to the public security or to public health in the Union and also assess the risk of irregular migration of the applicant. As regards third country nationals who obtained a long stay visa or a residence permit, these checks should be limited to contributing to assess the identity of the document holder, the authenticity and the validity of the long-stay visa or residence permit as well as whether the entry of the third country national in the Union could pose a threat to public security or to public health in the Union. They should not interfere with any decision on long-stay visas or residence permits. (11)The assessement of such risks cannot be carried out without processing the personal data related to the person's identity, travel document, and, as the case may be, sponsor or, if the applicant is minor, identity of the responsible person. Each item of personal data in the applications should be compared with the data present in a record, file or alert registered in an information system (the Schengen Information System (SIS), the Visa Information System (VIS), the Europol data, the Interpol Stolen and Lost Travel Document database (SLTD), the Entry/Exit System (EES), the Eurodac, the ECRIS-TCN system as far as convictions related to terrorist offences or other forms of serious criminal offences are concerned and/or the Interpol Travel Documents Associated with Notices database (Interpol TDAWN)) or against the watchlists, or against specific risk indicators. The categories of personal data that should be used for comparison should be limited to the categories of data present in the queried information systems, the watchlist or the specific risk indicators. (12)Interoperability between EU information systems was established by [Regulation (EU) XX on interoperability] so that these EU information systems and their data supplement each other with a view to improving the management of the external borders, contributing to preventing and combating illegal migration and ensuring a high level of security within the area of freedom, security and justice of the Union, including the maintenance of public security and public policy and safeguarding the security in the territories of the Member States. (13)The interoperability between the EU information systems allows systems to supplement each other to facilitate the correct identification of persons, contribute to fighting identity fraud, improve and harmonise data quality requirements of the respective EU information systems, facilitate the technical and operational implementation by Member States of existing and future EU information systems, strengthen and simplify the data security and data protection safeguards that govern the respective EU information systems, streamline the law enforcement access to the EES, the VIS, the [ETIAS] and Eurodac, and support the purposes of the EES, the VIS, the [ETIAS], Eurodac, the SIS and the [ECRIS-TCN system]. (14)The interoperability components cover the EES, the VIS, the [ETIAS], Eurodac, the SIS, and the [ECRIS-TCN system], and Europol data to enable it to be queried simultaneously with these EU information systems and therefore it is appropriate to use these components for the purpose of carrying out the automated checks and when accessing the VIS for law enforcement purposes. The European search portal (ESP) should be used for this purpose to enable a fast, seamless, efficient, systematic and controlled access to the EU information systems, the Europol data and the Interpol databases needed to perform their tasks, in accordance with their access rights, and to support the objectives of the VIS. (15)The comparison against other databases should be automated. Whenever such comparison reveals that a correspondence (a 'hit') exists with any of the personal data or combination thereof in the applications and a record, file or alert in the above information systems, or with personal data in the watchlist, the application should be processed manually by an operator in the responsible authority. The assessment performed by the responsible authority should lead to the decision to issue or not the short-stay visa. (16)Refusal of an application for a short-stay visa should not be based only on the automated processing of personal data in the applications. (17)Applicants who have been refused a short-stay visa on the basis of an information resulted from VIS processing should have the right to appeal. Appeals should be conducted in the Member State that has taken the decision on the application and in accordance with the national law of that Member State. Existing safeguards and rules on appeal in Regulation (EC) No 767/2008 should apply. (18)Specific risk indicators corresponding to previously identified security, irregular migration or public health risk should be used to analyse the application file for a short stay visa. The criteria used for defining the specific risk indicators should in no circumstances be based solely on a person's sex or age. They shall in no circumstances be based on information revealing a person’s race, colour, ethnic or social origin, genetic features, language, political or any other opinions, religion or philosofical belief, trade union membership, membership of a national minority, property, birth, disability or sexual orientation.. (19)The continuous emergence of new forms of security threats, new patterns of irregular migration and public health threats requires effective responses and needs to be countered with modern means. Since these means entail the processing of important amounts of personal data, appropriate safeguards should be introduced to keep the interference with the rights to respect for private and family life and to the personal data limited to what is necessary in a democratic society. (20)It should be ensured that at least a similar level of checks is applied to applicants for a short-stay visa, or third country nationals who obtained a long stay visa or a residence permit, as for visa free third country nationals. To this end a watchlist is also established with information related to persons who are suspected of having committed an act of serious crime or terrorism, or regarding whom there are factual indications or reasonable grounds to believe that they will commit an act of serious crime or terrorism should be used for verifications in respect of these categories of third country nationals as well. (21)In order to fulfil their obligation under the Convention implementing the Schengen Agreement, international carriers should be able to verify whether or not third country nationals holding a short-stay visa, a long stay visa or a residence permit are in possession of the required valid travel documents. This verification should be made possible through the daily extraction of VIS data into a separate read-only database allowing the extraction of a minimum necessary subset of data to enable a query leading to an ok/not ok answer. (22)This Regulation should define the authorities of the Member States which may be authorised to have access to the VIS to enter, amend, delete or consult data on long stay visas and residence permits for the specific purposes set out in the VIS for this category of documents and their holders, and to the extent necessary for the performance of their tasks. (23)Any processing of VIS data on long stay visas and residence permits should be proportionate to the objectives pursued and necessary for the performance of tasks of the competent authorities. When using the VIS, the competent authorities should ensure that the human dignity and integrity of the person, whose data are requested, are respected and should not discriminate against persons on grounds of sex, colour, ethnic or social origin, genetic features, language, religion or belief, political or any other opinion, membership of a national minority, property, birth, disability, age or sexual orientation. (24)It is imperative that law enforcement authorities have the most up-to-date information if they are to perform their tasks in the fight against terrorist offences and other serious criminal offences. Access of law enforcement authorities of the Member States and of Europol to VIS has been established by Council Decision 2008/633/JHA. The content of this Decision should be integrated into the VIS Regulation, to bring it in line with the current treaty framework.

(25)Access to VIS data for law enforcement purpose has already proven its usefulness in identifying people who died violently or for helping investigators to make substantial progress in cases related to trafficking in human beings, terrorism or drug trafficking. Therefore, the data in the VIS related to long stays should also be available to the designated authorities of the Member States and the European Police Office ('Europol'), subject to the conditions set out in this Regulation. (26)Given that Europol plays a key role with respect to cooperation between Member States’ authorities in the field of cross-border crime investigation in supporting Union-wide crime prevention, analyses and investigation. Europol's current access to the VIS within the framework of its tasks should be codified and streamlined, taking also into account recent developments of the legal framework such as Regulation (EU) 2016/794 of the European Parliament and of the Council. (27)Access to the VIS for the purpose of preventing, detecting or investigating terrorist offences or other serious criminal offences constitutes an interference with the fundamental rights to respect for private and family life and to the protection of personal data of persons whose personal data are processed in the VIS. Any such interference must be in accordance with the law, which must be formulated with sufficient precision to allow individuals to adjust their conduct and it must protect individuals against arbitrariness and indicate with sufficient clarity the scope of discretion conferred on the competent authorities and the manner of its exercise. Any interference must be necessary in a democratic society to protect a legitimate and proportionate interest and proportionate to the legitimate objective to achieve. (28)[Regulation 2018/XX on interoperability] provides the possibility for a Member State police authority which has been so empowered by national legislative measures, to identify a person with the biometric data of that person taken during an identity check. However specific circumstances may exist where identification of a person is necessary in the interest of that person. Such cases include situations where the person was found after having gone missing, been abducted or having been identified as victim of trafficking. In such cases, quick access for law enforcement authorities to VIS data to enable a fast and reliable identification of the person, without the need to fulfill all the preconditions and additional safeguards for law enforcement access, should be provided. (29)Comparisons of data on the basis of a latent fingerprint, which is the dactyloscopic trace which may be found at a crime scene, is fundamental in the field of police cooperation. The possibility to compare a latent fingerprint with the fingerprint data which is stored in the VIS in cases where there are reasonable grounds for believing that the perpetrator or victim may be registered in the VIS should provide the law enforcement authorities of the Member States with a very valuable tool in preventing, detecting or investigating terrorist offences or other serious criminal offences, when for example the only evidence at a crime scene are latent fingerprints. (30)It is necessary to designate the competent authorities of the Member States as well as the central access point through which the requests for access to VIS data are made and to keep a list of the operating units within the designated authorities that are authorised to request such access for the specific purposes for the prevention, detection or investigation of terrorist offences or of other serious criminal offences. (31)Requests for access to data stored in the Central System should be made by the operating units within the designated authorities to the central access point and should be justified. The operating units within the designated authorities that are authorised to request access to VIS data should not act as a verifying authority. The central access points should act independently of the designated authorities and should be responsible for ensuring, in an independent manner, strict compliance with the conditions for access as established in this Regulation. In exceptional cases of urgency, where early access is necessary to respond to a specific and actual threat related to terrorist offences or other serious criminal offences, the central access point should be able to process the request immediately and only carry out the verification afterwards. (32)To protect personal data and to exclude systematic searches by law enforcement, the processing of VIS data should only take place in specific cases and when it is necessary for the purposes of preventing, detecting or investigating terrorist offences or other serious criminal offences. The designated authorities and Europol should only request access to the VIS when they have reasonable grounds to believe that such access will provide information that will substantially assist them in preventing, detecting or investigating a terrorist offence or other serious criminal offence. (33)The personal data of holders of long stay documents stored in the VIS should be kept for no longer than is necessary for the purposes of the VIS. It is appropriate to keep the data related to third country nationals for a period of five years in order to enable data to be taken into account for the assessment of short-stay visa applications, to enable detection of overstay after the end of the validity period and in order to conduct security assessments of third country nationals who obtained them. The data on previous uses of a document could facilitate the issuance of future short stay visas. A shorter storage period would not be sufficient for ensuring the stated purposes. The data should be erased after a period of five years, unless there are grounds to erase them earlier. (34)Regulation (EU) 2016/679 of the European Parliament and of the Council applies to the processing of personal data by the Member States in application of this Regulation. Processing of personal data by law enforcement authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties is governed by Directive (EU) 2016/680 of the European Parliament and of the Council. (35)Members of the European Border and Coast Guard (EBCG) teams, as well as teams of staff involved in return-related tasks are entitled by Regulation (EU) 2016/1624 of the European Parliament and the Council to consult European databases where necessary for fulfilling operational tasks specified in the operational plan on border checks, border surveillance and return, under the authority of the host Member State. For the purpose of facilitating that consultation and enabling the teams an effective access to the data entered in VIS, the ECBGA should be given access to VIS. Such access should follow the conditions and limitations of access applicable to the Member States' authorities competent under each specific purpose for which VIS data can be consulted. (36)The return of third-country nationals who do not fulfil or no longer fulfil the conditions for entry, stay or residence in the Member States, in accordance with Directive 2008/115/EC of the European Parliament and of the Council, is an essential component of the comprehensive efforts to tackle irregular migration and represents an important reason of substantial public interest. (37)The third countries of return are often not subject to adequacy decisions adopted by the Commission under Article 45 of Regulation (EU) 2016/679 or under national provisions adopted to transpose Article 36 of Directive (EU) 2016/680. Furthermore, the extensive efforts of the Union in cooperating with the main countries of origin of illegally staying third-country nationals subject to an obligation to return has not been able to ensure the systematic fulfilment by such third countries of the obligation established by international law to readmit their own nationals. Readmission agreements, concluded or being negotiated by the Union or the Member States and providing for appropriate safeguards for the transfer of data to third countries pursuant to Article 46 of Regulation (EU) 2016/679 or to the national provisions adopted to transpose Article 37 of Directive (EU) 2016/680, cover a limited number of such third countries and conclusion of any new agreement remains uncertain. In such situations, personal data could be processed pursuant to this regulation with third-country authorities for the purposes of implementing the return policy of the Union provided that the conditions laid down in Article 49(1)(d) of Regulation (EU) 2016/679 or in the national provisions transposing Article 38 or 39 of Directive (EU) 2016/680 are met. (38)Member States should make available relevant personal data processed in the VIS, in accordance with the applicable data protection rules and where required in individual cases for carrying out tasks under Regulation (EU) …/… of the European Parliament and the Council,Union Resettlement Framework Regulation], to the [European Union Asylum Agency] and relevant international bodies such as the United Nations High Commissioner for Refugees, the International Organisation on Migration and to the International Committee of the Red Cross refugee and resettlement operations, in relation to third-country nationals or stateless persons referred by them to Member States in the implementation of Regulation (EU) …/… [the Union Resettlement Framework Regulation]. (39)Regulation (EC) No 45/2001 of the European Parliament and the Council applies to the activities of the Union institutions or bodies when carrying out their tasks as responsible for the operational management of VIS. (40)The European Data Protection Supervisor was consulted in accordance with Article 28(2) of Regulation (EC) No 45/2001 and delivered an opinion on … (41)In order to enhance third countries' cooperation on readmission of irregular migrants and to facilitate the return of illegally staying third country nationals whose data might be stored in the VIS, the copies of the travel document of applicants for a short stay visa should be stored in the VIS. Contrary to information extracted from the VIS, copies of travel documents are a proof of nationality more widely recognised by third countries. (42)Consultation of the list of travel documents which entitle the holder to cross the external borders and which may be endorsed with a visa, as established by Decision No 1105/2011/EU of the European Parliament and of the Council, is a compulsory element of the visa examination procedure. Visa authorities should systematically implement this obligation and therefore this list should be incorporated in the VIS to enable automatic verification of the recognition of the applicant’s travel document. (43)Without prejudice to Member States’ responsibility for the accuracy of data entered into VIS, eu-LISA should be responsible for reinforcing data quality by introducing a central data quality monitoring tool, and for providing reports at regular intervals to the Member States. (44)In order to allow better monitoring of the use of VIS to analyse trends concerning migratory pressure and border management, eu-LISA should be able to develop a capability for statistical reporting to the Member States, the Commission, and the European Border and Cost Guard Agency without jeopardising data integrity. Therefore, a central statistical repository should be established. None of the produced statistics should contain personal data.

(45)This Regulation is without prejudice to the application of Directive 2004/38/EC of the European Parliament and of the Council. (46)Since the objectives of this Regulation cannot be sufficiently achieved by the Member States but can rather, by reason of the need to ensure the implementation of a common policy on visas, a high level of security within the area without controls at the internal borders and the gradual establishment of an integrated management system for the external borders, be better achieved at Union level, the Union may adopt measures, in accordance with the principle of subsidiarity as set out in Article 5 of the Treaty on European Union. In accordance with the principle of proportionality, as set out in that Article, this Regulation does not go beyond what is necessary in order to achieve those objectives. (47)This Regulation establishes strict access rules to the VIS and the necessary safeguards. It also foresees individuals’ rights of access, rectification, erasure and remedies in particular the right to a judicial remedy and the supervision of processing operations by public independent authorities. Additional safeguards are introduced by this Regulation to cover for the specific needs of the new categories of data that will be processed by the VIS. This Regulation therefore respects the fundamental rights and observes the principles recognised by the Charter of Fundamental Rights of the European Union, in particular the right to human dignity , the right to liberty and security, the respect for private and family life, the protection of personal data, the right to asylum and protection of the principle of non-refoulement and protection in the event of removal, expulsion or extradition, the right to non-discrimination, the rights of the child and the right to an effective remedy. (48)Specific provisions should apply to third country nationals who are subject to a visa requirement, who are family members of a Union citizen to whom Directive 2004/38/EC applies or of a national of a third country enjoying the right of free movement under Union law and who do not hold a residence card referred to under Directive 2004/38/EC. Article 21(1) of the Treaty on the Functioning of the European Union stipulates that every citizen of the Union shall have the right to move and reside freely within the territory of the Member States, subject to the limitations and conditions laid down in the Treaties and by the measures adopted to give them effect. The respective limitations and conditions are to be found in Directive 2004/38/EC. (49)As confirmed by the Court of Justice of the European Union, such family members have not only the right to enter the territory of the Member State but also to obtain an entry visa for that purpose. Member States must grant such persons every facility to obtain the necessary visas which must be issued free of charge as soon as possible and on the basis of an accelerated procedure. (50)The right to obtain a visa is not unconditional as it can be denied to those family members who represent a risk to public policy, public security or public health pursuant to Directive 2004/38/EC. Against this background, the personal data of family members can only be verified where the data relate to their identification and their status only insofar these are relevant for assessment of the security threat they could represent. Indeed, the examination of their visa applications should be made exclusively against the security concerns, and not those related to migration risks. (51)In accordance with Articles 1 and 2 of Protocol No 22 on the position of Denmark, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, Denmark is not taking part in the adoption of this Regulation and is not bound by it or subject to its application. Given that this Regulation builds upon the Schengen acquis, Denmark shall, in accordance with Article 4 of that Protocol, decide within a period of six months after the Council has decided on this Regulation whether it will implement it in its national law. (52)This Regulation constitutes a development of the provisions of the Schengen acquis in which the United Kingdom does not take part, in accordance with Council Decision 2000/365/EC; the United Kingdom is therefore not taking part in the adoption of this Regulation and is not bound by it or subject to its application. (53)This Regulation constitutes a development of the provisions of the Schengen acquis in which Ireland does not take part, in accordance with Council Decision 2002/192/EC; Ireland is therefore not taking part in the adoption of this Regulation and is not bound by it or subject to its application. (54)As regards Iceland and Norway, this Regulation constitutes a development of the provisions of the Schengen acquis within the meaning of the Agreement concluded by the Council of the European Union and the Republic of Iceland and the Kingdom of Norway concerning the latters' association with the implementation, application and development of the Schengen acquis which fall within the area referred to in Article 1, point A of Council Decision 1999/437/EC . (55)As regards Switzerland, this Regulation constitutes a development of the provisions of the Schengen acquis within the meaning of the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation's association with the implementation, application and development of the Schengen acquis which fall within the area referred to in Article 1, point A of Council Decision 1999/437/EC read in conjunction with Article 3 of Council Decision 2008/146/EC and with Article 3 of Council Decision 2008/149/JHA. (56)As regards Liechtenstein, this Regulation constitutes a development of the provisions of the Schengen acquis within the meaning of the Protocol between the European Union, the European Community, the Swiss Confederation and the Principality of Liechtenstein on the accession of the Principality of Liechtenstein to the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation's association with the implementation, application and development of the Schengen acquis which fall within the area referred to in Article 1, point A of Council Decision 1999/437/EC read in conjunction with Article 3 of Council Decision 2011/350/EU and with Article 3 of Council Decision 2011/349/EU. (57)This Regulation, with the exception of Article 22r, constitutes an act building upon, or otherwise relating to, the Schengen acquis within, respectively, the meaning of Article 3(2) of the 2003 Act of Accession, Article 4(2) of the 2005 Act of Accession and Article 4(2) of the 2011 Act of Accession, with the exception of provisions rendered applicable to Bulgaria and Romania by Council Decision (EU) 2017/1908, HAVE ADOPTED THIS REGULATION: Article 1 Regulation (EC) No 767/2008 is amended as follows: (1)In Article 1 the following paragraphs are added: "This Regulation also lays down procedures for the exchange of information between Member States on long-stay visas and residence permits, including on certain decisions on long-stay visas and residence permits. By storing identity, travel document and biometric data in the common identity repository (CIR) established by Article 17 of Regulation 2018/XX of the European Parliament and of the Council* [Regulation 2018/XX on interoperability], the VIS contributes to facilitating and assisting in the correct identification of persons registered in the VIS." _______

* Regulation 2018/XX of the European Parliament and of the Council* [Regulation 2018/XX on interoperability] (OJ L)."; (2)Article 2 is replaced by the following: “Article 2

Purpose of VIS 1. The VIS shall have the purpose of improving the implementation of the common visa policy, consular cooperation and consultation between central visa authorities by facilitating the exchange of data between Member States on applications and on the decisions relating thereto, in order: (a) to facilitate the visa application procedure; (b) to prevent the bypassing of the criteria for the determination of the Member State responsible for examining the application; (c) to facilitate the fight against fraud; (d) to facilitate checks at external border crossing points and within the territory of the Member States; (e) to assist in the identification and return of any person who may not, or may no longer, fulfil the conditions for entry to, stay or residence on the territory of the Member States; (f) to assist in the identification of persons who have gone missing; (g) to facilitate the application of Regulation (EU) No 604/2013 of the European Parliament and of the Council* and of Directive 2013/32/EU of the European Parliament and of the Council**; (h) to contribute to the prevention, detection and investigation of terrorist offences or of other serious criminal offences; (i) to contribute to the prevention of threats to the internal security of any of the Member States; (j) to ensure the correct identification of persons; (k) support the objectives of the Schengen Information System (SIS) related to the alerts in respect of third country nationals subject to a refusal of entry, persons wanted for arrest or for surrender or extradition purposes, on missing persons, on persons sought to assist with a judicial procedure and on persons for discreet checks or specific checks." 2. As regards long stay visas and residence permits, the VIS shall have the purpose of facilitating the exchange of data between Member States on the decisions related thereto, in order to: (a) support a high level of security by contributing to the assessment of whether the applicant is considered to pose a threat to public policy, internal security or public health prior to their arrival at the external borders crossing points; (b) enhance the effectiveness of border checks and of checks within the territory; (c) contribute to the prevention, detection and investigation of terrorist offences or of other serious criminal offences; (d) ensure the correct identification of persons;

(e) facilitate the application of Regulation (EU) No 604/2013 and of Directive 2013/32/EU; (f) support the objectives of the Schengen Information System (SIS) related to the alerts in respect of third country nationals subject to a refusal of entry, persons wanted for arrest or for surrender or extradition purposes, on missing persons, on persons sought to assist with a judicial procedure and on persons for discreet checks or specific checks." * Regulation (EU) No 604/2013 of the European Parliament and of the Council of 26 June 2013 establishing the criteria and mechanisms for determining the Member State responsible for examining an application for international protection lodged in one of the Member States by a third-country national or a stateless person (OJ L 180, 29.6.2013, p. 31). ** Directive 2013/32/EU of the European Parliament and of the Council of 26 June 2013 on common procedures for granting and withdrawing international protection (OJ L 180, 29.6.2013, p. 60)."; (3)Article 3 is deleted; (4)in Article 4, the following points are added: (12)'VIS data' means all data stored in the VIS Central System and in the CIR in accordance with Articles 9 to14, 22c, to 22f; (13)'identity data' means the data referred to in Article 9(4)(a) and (aa); (14)‘fingerprint data’ means the data relating fingerprints that is stored in a VIS file; (15)‘facial image’ means digital image of the face; (16)'Europol data' means personal data processed by Europol for the purpose referred to in Article 18(2)(a) of Regulation (EU) 2016/794 of the European Parliament and of the Council*; (17)'residence permit' means all residence permits issued by the Member States in accordance with the uniform format laid down by Council Regulation (EC) No 1030/2002** and all other documents referred to in Article 2(16)(b) of Regulation (EU) 2016/399; (18)'long-stay visa' means an authorisation issued by a Member State as provided for in Article 18 of the Schengen Convention; (19)’national supervisory authority’ as regards law enforcement purposes means the supervisory authorities established in accordance with Article 41 of Directive (EU) 2016/680 of the European Parliament and of the Council***; (20)'law enforcement' means the prevention, detection or investigation of terrorist offences or other serious criminal offences; (21)'terrorist offences' mean the offences under national law which correspond or are equivalent to those referred to in Directive (EU) 2017/541 of the European Parliament and of the Council****; (22)'serious criminal offences' means the offences which correspond or are equivalent to those referred to in Article 2(2) of Council Framework Decision 2002/584/JHA*****, if they are punishable under national law by a custodial sentence or a detention order for a maximum period of at least three years. ________________ * Regulation (EU) 2016/794 of the European Parliament and of the Council of 11 May 2016 on the European Union Agency for Law Enforcement Cooperation (Europol) and replacing and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHA (OJ L 135, 24.5.2016, p. 53). ** Council Regulation (EC) No 1030/2002 of 13 June 2002 laying down a uniform format for residence permits for third-country nationals (OJ L 157 15.6.2002, p. 1)

*** Directive (EU) 2016/680 of the European parliament and the Council on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89). **** Directive (EU) 2017/541 of the European Parliament and of the Council of 15 March 2017 on combating terrorism and replacing Council Framework Decision 2002/475/JHA and amending Council Decision 2005/671/JHA (OJ L 88, 31.3.2017, p. 6). ***** Council Framework Decision 2002/584/JHA of 13 June 2002 on the European arrest warrant and the surrender procedures between Member States (OJ L 190, 18.7.2002, p.1)”; (5)Article 5 is replaced by the following: “Article 5

Categories of data 1. Only the following categories of data shall be recorded in the VIS: (a) alphanumeric data on the short stay visa applicant and on visas requested, issued, refused, annulled, revoked or extended referred to in Article 9(1) to (4) and Articles 10 to 14, alphanumeric data on long stay visa and residence permits issued, withdrawn, refused, annulled, revoked or extended referred to in Articles 22c, 22d, 22e and 22f, as well as information regarding the hits referred to in Articles 9a and 22b, and the results of verifications referred to in Article 9c(6); (b) facial images referred to in Article 9(5) and Article 22c(2)(f); (c) fingerprint data referred to in Article 9(6) and Article 22c(2)(g); (d) links to other applications referred to in Article 8(3) and (4) and Article 22a(3)." 2. The messages transmitted by the VIS, referred to in Article 16, Article 24(2) and Article 25(2), shall not be recorded in the VIS, without prejudice to the recording of data processing operations pursuant to Article 34. 3. The CIR shall contain the data referred to in Article 9(4)(a) to (cc), Article 9(5) and 9(6), Article 22c(2)(a), to (cc), (f) and (g), and Article 22d(a) to (cc), (f) and (g). The remaining VIS data shall be stored in the VIS Central System." (6)the following Article 5a is inserted: "Article 5a List of recognised travel documents (1)The list of travel documents which entitle the holder to cross the external borders and which may be endorsed with a visa, as established by Decision No 1105/2011/EU of the European Parliament and of the Council*, shall be integrated in the VIS. (2)The VIS shall provide the functionality for the centralised management of the list of recognised travel documents and of the no²tification of the recognition or non-recognition of the listed travel documents pursuant to Article 4 of Decision No 1105/2011/EU. (3)The detailed rules on managing the functionality referred to in paragraph 2 shall be laid down in implementing acts. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 49(2). _________________ * Decision No 1105/2011/EU of the European Parliament and of the Council of 25 October 2011 on the list of travel documents which entitle the holder to cross the external borders and which may be endorsed with a visa and on setting up a mechanism for establishing this list (OJ L 287, 4.11.2011, p. 9).";

(7)Article 6 is amended as follows: (a) paragraph 2 is replaced by the following: "2. Access to the VIS for consulting the data shall be reserved exclusively for the duly authorised staff of the national authorities of each Member State and of the EU bodies which are competent for the purposes laid down in Articles 15 to 22, Articles 22c to 22f, Articles 22g to 22j, as well as for the purposes laid down in Articles 20 and 21 of [Regulation 2018/XX on interoperability]. That access shall be limited to the extent that the data are required for the performance of their tasks in accordance with those purposes, and proportionate to the objectives pursued."; (b) the following paragraph 4 is added: "4. The VIS shall provide the functionality for the centralised management of this list." (c) the following paragraph 5 is added: "5. The detailed rules on managing the functionality for the centralised management of the list in paragraph 3 shall be laid down in implementing acts. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 49(2)." (8) In Article 7 a new paragraph 3 is inserted: "3. The best interests of the child shall be a primary consideration for Member States with respect to all procedures provided for in this Regulation. The child’s well-being, safety and security, in particular where there is a risk of the child being a victim of human trafficking in human beings, and the views of the child shall be taken into consideration and given due weight in accordance with his or her age and maturity." (9) The title of Chapter II is replaced by the following: “ENTRY AND USE OF DATA ON SHORY STAY VISA BY VISA AUTHORITIES” (10)Article 8 is amended as follows: (a) paragraph 1 is replaced by the following: "1. When the application is admissible pursuant to Article 19 of Regulation (EC) No 810/2009, the visa authority shall create the application file within 2 working days, by entering the data referred to in Article 9 in the VIS, as far as those data are required to be provided by the applicant."; (b) the following paragraph 1a is inserted: “1a. Upon creation of the application file, the VIS shall automatically launch the query pursuant to Article 9a and return results. (c) paragraph 5 is replaced by the following: 5. Where particular data are not required to be provided for legal reasons or factually cannot be provided, the specific data field(s) shall be marked as ‘not applicable’. The absence of fingerprints should be indicated by "VIS0"; furthermore, the system shall permit a distinction to be made between the cases pursuant to Article 13(7)(a) to (d) of Regulation (EC) No 810/2009." (11)Article 9 is amended as follows:

(a) in point 4, points (a), (b) and (c) are replaced by the following: "(a)surname (family name); first name or names (given names); date of birth; nationality or nationalities; sex; (aa) surname at birth (former surname(s)); place and country of birth; nationality at birth; (b)the type and number of the travel document or documents and the three-letter code of the issuing country of the travel document or documents; (c)the date of expiry of the validity of the travel document or documents; (cc)the authority which issued the travel document and its date of issue;"; (b) point 5 is replaced by the following: "5. the facial image of the applicant, in accordance with Article 13(1) of Regulation (EC) No 810/2009."; (c) the following point 7 is added: "7. a scan of the biographic data page."; (d) the following two paragraphs are added: "8. The facial image of third country nationals referred to in point 5 of the first paragraph shall have sufficient image resolution and quality to be used in automated biometric matching. By way of derogation from the seco