Regulation (EC) No 1987/2006 of the European Parliament and of the Council of 20 December 2006 on the establishment, operation and use of the second generation Schengen Information System (SIS II)
Date: 2006-12-20
Institutions: Council of the European Union, European Parliament
Subjects: Schengen Information System, exchange of information, personal data, principle of proportionality, public order

L 381/4

EN

Official Journal of the European Union

28.12.2006

REGULATION (EC) No 1987/2006 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

of 20 December 2006

on the establishment, operation and use of the second generation Schengen Information System
(SIS II)

THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EURO-
PEAN UNION,

(4)

Having regard to the Treaty establishing the European Commu-
nity, and in particular Articles 62(2)(a), 63(3)(b) and 66 thereof,

The fact that the legislative basis necessary for governing
SIS II consists of separate instruments does not affect the
principle that SIS II constitutes one single information sys-
tem that should operate as such. Certain provisions of
these instruments should therefore be identical.

Having regard to the proposal from the Commission,

(5)

Acting in accordance with the procedure laid down in Article 251
of the Treaty (1),

SIS II should constitute a compensatory measure contrib-
uting to maintaining a high level of security within the
area of freedom, security and justice of the European
Union by supporting the implementation of policies
linked to the movement of persons that are part of the
Schengen acquis, as integrated into Title IV of Part Three
of the Treaty.

Whereas:

(1)

(2)

(3)

The Schengen Information System (‘SIS’) set up pursuant
the Convention of
to the provisions of Title IV of
19 June 1990 implementing the Schengen Agreement of
14 June 1985 between the governments of the States of
the Benelux Economic Union, the Federal Republic of Ger-
many and the French Republic on the gradual abolition
of checks at their common borders (2) (the ‘Schengen Con-
vention’), and its development, SIS 1+, constitute an essen-
tial tool for the application of the provisions of the
Schengen acquis as integrated into the framework of the
European Union.

The development of the second generation of SIS (‘SIS II’)
to
has been entrusted to the Commission pursuant
Council Regulation
and
Council Decision 2001/886/JHA (4) of 6 December 2001
on the development of the second generation Schengen
Information System (SIS II). SIS II will replace SIS as cre-
ated pursuant to the Schengen Convention.

(EC) No 2424/2001 (3)

This Regulation constitutes the necessary legislative basis
for governing SIS II in respect of matters falling within the
scope of the Treaty establishing the European Commu-
nity (the ‘Treaty’). Council Decision 2006/000/JHA of …
on the establishment, operation and use of the second gen-
eration Schengen Information System (SIS II) (5) consti-
tutes the necessary legislative basis for governing SIS II in
respect of matters falling within the scope of the Treaty
on European Union.

(1) Opinion of the European Parliament of 25 October 2006 (not yet
published in the Official Journal) and Council Decision of 19 Decem-
ber 2006 (not yet published in the Official Journal).

(2) OJ L 239, 22.9.2000, p. 19. Convention as last amended by Regula-

tion (EC) No 1160/2005 (OJ L 191, 22.7.2005, p. 18).

(3) OJ L 328, 13.12.2001, p. 4.
(4) OJ L 328, 13.12.2001, p. 1.
(5) OJ L …

(6)

(7)

(8)

(9)

It is necessary to specify the objectives of SIS II, its tech-
nical architecture and financing, to lay down rules con-
cerning its operation and use and to define responsibilities,
the categories of data to be entered into the system, the
purposes for which the data are to be entered, the criteria
for their entry, the authorities authorised to access the
data, the interlinking of alerts and further rules on data
processing and the protection of personal data.

SIS II is to include a central system (Central SIS II) and
national applications. The expenditure involved in the
operation of Central SIS II and related communication
infrastructure should be charged to the general budget of
the European Union.

It is necessary to establish a manual setting out the detailed
rules for the exchange of certain supplementary informa-
tion concerning the action called for by alerts. National
authorities in each Member State should ensure the
exchange of this information.

For a transitional period, the Commission should be
responsible for the operational management of Central
SIS II and of parts of the communication infrastructure.
However, in order to ensure a smooth transition to SIS II,
it may delegate some or all of these responsibilities to two
national public sector bodies. In the long term, and fol-
lowing an impact assessment containing a substantive
analysis of alternatives from a financial, operational and
organisational perspective, and legislative proposals from
the Commission, a management authority with responsi-
bility for these tasks should be established. The transi-
tional period should last for no more than five years from
the date from which this Regulation applies.

28.12.2006

EN

Official Journal of the European Union

L 381/5

(10)

SIS II is to contain alerts for the purpose of refusing entry
or stay. It is necessary to further consider harmonising the
provisions on the grounds for issuing alerts concerning
third-country nationals for the purpose of refusing entry
or stay and to clarifying their use in the framework of asy-
lum, immigration and return policies. Therefore, the Com-
mission should review, three years after the date from
which this Regulation applies, the provisions on the objec-
tives of and conditions for issuing alerts for the purpose
of refusing entry or stay.

(11) Alerts for the purpose of refusing entry or stay should not
be kept longer in SIS II than the time required to fulfil the
purposes for which they were supplied. As a general prin-
ciple, they should be automatically erased from SIS II after
a period of three years. Any decision to keep an alert for
a longer period should be based on a comprehensive indi-
vidual assessment. Member States should review these
alerts within this three-year period and keep statistics
about the number of alerts the retention period of which
has been extended.

(12)

SIS II should permit the processing of biometric data in
order to assist in the reliable identification of the individu-
als concerned. In the same perspective SIS II should also
allow for the processing of data concerning individuals
whose identity has been misused in order to avoid incon-
veniences caused by their misidentification, subject to suit-
able safeguards, in particular the consent of the individual
concerned and a strict limitation of the purposes for which
such data can be lawfully processed.

(13)

It should be possible for Member States to establish links
between alerts in SIS II. The establishment by a Member
State of links between two or more alerts should have no
impact on the action to be taken, their retention period
or the access rights to the alerts.

(16)

Regulation (EC) No 45/2001 of the European Parliament
and of the Council of 18 December 2000 on the protec-
tion of individuals with regard to the processing of per-
sonal data by the Community institutions and bodies and
on the free movement of such data (2), and in particular
the provisions thereof concerning confidentiality and secu-
rity of processing, apply to the processing of personal data
by the Community institutions or bodies when carrying
out their responsibilities in the operational management
in Regulation (EC)
of SIS II. The principles set out
No 45/2001 should be supplemented or clarified in this
Regulation, where necessary.

(17)

Insofar as confidentiality is concerned, the relevant provi-
sions of the Staff Regulations of Officials of the European
Communities and the conditions of employment of other
servants of the European Communities should apply to
officials or other servants employed and working in con-
nection with SIS II.

(18)

appointed pursuant

It is appropriate that national supervisory authorities
monitor the lawfulness of the processing of personal data
by the Member States, whilst the European Data Protec-
tion Supervisor,
to Decision
2004/55/EC of the European Parliament and of the Coun-
cil of 22 December 2003 appointing the independent
supervisory body provided for in Article 286 of the EC
Treaty (3), should monitor the activities of the Commu-
nity institutions and bodies in relation to the processing
of personal data in view of the limited tasks of the Com-
munity institutions and bodies with regard to the data
themselves.

(14) Data processed in SIS II in application of this Regulation
should not be transferred or made available to third coun-
tries or to international organisations.

(19)

Both the Member States and the Commission should draw
up a security plan in order to facilitate the implementa-
tion of security obligations and should cooperate with
each other in order to address security issues from a com-
mon perspective.

(15) Directive 95/46/EC of the European Parliament and the
Council of 24 October 1995 on the protection of indi-
viduals with regard to the processing of personal data and
on the free movement of such data (1) applies to the pro-
cessing of personal data carried out in application of this
Regulation. This includes the designation of the control-
ler and the possibility for Member States to provide for
exemptions and restrictions to some of the rights and obli-
gations provided for in that Directive including the rights
of access and information of the individual concerned. The
principles set out in Directive 95/46/EC should be supple-
mented or clarified in this Regulation, where necessary.

(20)

In order to ensure transparency, a report on the technical
functioning of Central SIS II and the communication infra-
structure, including its security, and on the exchange of
supplementary information should be produced every two
years by the Commission or, when it is established, the
management authority. An overall evaluation should be
issued by the Commission every four years.

(1) OJ L 281, 23.11.1995, p. 31.

(2) OJ L 8, 12.1.2001, p. 1.
(3) OJ L 12, 17.1.2004, p. 47.

L 381/6

EN

Official Journal of the European Union

28.12.2006

(21)

(22)

(23)

(24)

(25)

Certain aspects of SIS II, such as technical rules on enter-
ing data, including data required for entering an alert,
updating, deleting and searching data, rules on compat-
ibility and priority of alerts, links between alerts and the
exchange of supplementary information cannot, owing to
their technical nature, level of detail and need for regular
updating, be covered exhaustively by the provisions of this
Regulation. Implementing powers in respect of those
aspects should therefore be delegated to the Commission.
Technical rules on searching alerts should take into
account the smooth operation of national applications.
Subject to an impact assessment by the Commission, it
should be decided to what extent the implementing mea-
sures could be the responsibility of the management
authority, once it is set up.

The measures necessary for the implementation of this
Regulation should be adopted in accordance with Council
Decision 1999/468/EC of 28 June 1999 laying down the
procedures for the exercise of implementing powers con-
ferred on the Commission (1).

It is appropriate to lay down transitional provisions in
respect of alerts issued in SIS 1+ which are to be trans-
ferred to SIS II. Some provisions of the Schengen acquis
should continue to apply for a limited period of time until
the Member States have examined the compatibility of
those alerts with the new legal framework. The compat-
ibility of alerts on persons should be examined as a mat-
ter of priority. Furthermore, any modification, addition,
correction or update of an alert transferred from SIS 1+
to SIS II, as well as any hit on such an alert, should trig-
ger an immediate examination of its compatibility with
the provisions of this Regulation.

It is necessary to lay down specific provisions regarding
the part of the budget earmarked for operations of SIS
which is not part of the general budget of the European
Union.

Since the objectives of the action to be taken, namely the
establishment and regulation of a joint information sys-
tem, cannot be sufficiently achieved by the Member States
and can therefore, by reason of the scale and effects of the
action, be better achieved at Community level, the Com-
munity may adopt measures in accordance with the prin-
ciple of subsidiarity, as set out in Article 5 of the Treaty.
In accordance with the principle of proportionality, as set
out in that Article, this Regulation does not go beyond
what is necessary to achieve those objectives.

(26)

This Regulation respects the fundamental rights and
observes the principles recognised in particular by the
Charter of Fundamental Rights of the European Union.

(1) OJ L 184, 17.7.1999, p. 23. Decision as amended by Decision

2006/512/EC (OJ L 200, 22.7.2006, p. 11).

(27)

(28)

(29)

(30)

In accordance with Articles 1 and 2 of the Protocol on
the position of Denmark annexed to the Treaty on Euro-
pean Union and the Treaty establishing the European
Community, Denmark does not take part in the adoption
of this Regulation and is not bound by it or subject to its
application. Given that this Regulation builds upon the
Schengen acquis under the provisions of Title IV of Part
Three of the Treaty, Denmark shall, in accordance with
Article 5 of the said Protocol, decide within a period of
six months after date of the adoption of this Regulation
whether it will transpose it in its national law.

take part,

This Regulation constitutes a development of provisions
of the Schengen acquis in which the United Kingdom
does not
in accordance with Council
Decision 2000/365/EC of 29 May 2000 concerning the
request of the United Kingdom of Great Britain and North-
ern Ireland to take part in some of the provisions of the
Schengen acquis (2). The United Kingdom is therefore not
taking part in its adoption and is not bound by it or sub-
ject to its application.

This Regulation constitutes a development of provisions
of the Schengen acquis in which Ireland does not take part,
in accordance with Council Decision 2002/192/EC of
28 February 2002 concerning Ireland’s request to take part
in some of the provisions of the Schengen acquis (3). Ire-
land is therefore not taking part in its adoption and is not
bound by it or subject to its application.

This Regulation is without prejudice to the arrangements
for the United Kingdom’s and Ireland’s partial participa-
in
tion
Decision 2000/365/EC and Decision 2002/192/EC
respectively.

Schengen

defined

acquis

the

as

in

(31) As regards Iceland and Norway, this Regulation consti-
tutes a development of provisions of the Schengen acquis
within the meaning of the Agreement concluded by the
Council of the European Union and the Republic of Ice-
land and the Kingdom of Norway concerning the associa-
tion of
those two States with the implementation,
application and development of the Schengen acquis (4),
which fall within the area referred to in Article 1, point
G, of Council Decision 1999/437/EC of 17 May 1999 (5)
on certain arrangements for the application of
that
Agreement.

(2) OJ L 131, 1.6.2000, p. 43.
(3) OJ L 64, 7.3.2002, p. 20.
(4) OJ L 176, 10.7.1999, p. 36.
(5) OJ L 176, 10.7.1999, p. 31.

28.12.2006

EN

Official Journal of the European Union

L 381/7

(32) An arrangement should be made to allow representatives
of Iceland and Norway to be associated with the work of
committees assisting the Commission in the exercise of its
implementing powers. Such an arrangement has been con-
templated in the Exchanges of Letters between the Coun-
cil of the European Union and the Republic of Iceland and
the Kingdom of Norway concerning committees which
assist the European Commission in the exercise of its
executive powers (1), annexed to the abovementioned
Agreement.

HAVE ADOPTED THIS REGULATION:

CHAPTER I

GENERAL PROVISIONS

Article 1

Establishment and general purpose of SIS II

(33) As regards Switzerland, this Regulation constitutes a devel-
opment of provisions of the Schengen acquis within
the meaning of the Agreement signed between the Euro-
pean Union, the European Community and the Swiss
Confederation concerning the association of the Swiss
Confederation with the implementation, application
and development of the Schengen acquis, which fall
within the area referred to in Article 1, point G, of
Decision 1999/437/EC read in conjunction with
Article 4(1) of Council Decisions 2004/849/EC (2)
and 2004/860/EC (3).

A second generation Schengen Information System (‘SIS II’)

1.
is hereby established.

2.
The purpose of SIS II shall be, in accordance with this Regu-
lation, to ensure a high level of security within the area of free-
dom, security and justice of the European Union, including the
maintenance of public security and public policy and the safe-
guarding of security in the territories of the Member States, and
to apply the provisions of Title IV of Part Three of the Treaty
relating to the movement of persons in their territories, using
information communicated via this system.

(34) An arrangement should be made to allow representatives
of Switzerland to be associated with the work of commit-
tees assisting the Commission in the exercise of its imple-
menting powers. Such an arrangement has been
contemplated in the Exchange of Letters between the
Community and Switzerland, annexed to the abovemen-
tioned Agreement.

(35)

This Regulation constitutes an act building on the Schen-
gen acquis or otherwise related to it within the meaning
of Article 3(2) of the 2003 Act of Accession.

Article 2

Scope

This Regulation establishes the conditions and procedures
1.
for the entry and processing in SIS II of alerts in respect of third-
country nationals, the exchange of supplementary information
and additional data for the purpose of refusing entry into, or a
stay in, a Member State.

2.
This Regulation also lays down provisions on the technical
architecture of SIS II, the responsibilities of the Member States
and of the management authority referred to in Article 15, gen-
eral data processing, the rights of the persons concerned and
liability.

(36)

This Regulation should apply to the United Kingdom and
Ireland on dates determined in accordance with the pro-
cedures set out in the relevant instruments concerning the
application of the Schengen acquis to those States,

Article 3

Definitions

For the purposes of this Regulation, the following definitions
shall apply:

(1) OJ L 176, 10.7.1999, p. 53.
(2) Council Decision 2004/849/ECof 25 October 2004 on the signing,
on behalf of the European Union, and on the provisional application
of certain provisions of the Agreement between the European Union,
the European Community and the Swiss Confederation concerning
the Swiss Confederation’s association with the implementation, appli-
cation and development of
the Schengen acquis (OJ L 368,
15.12.2004, p. 26).

(3) Council Decision 2004/860/EC of 25 October 2004 on the signing,
on behalf of the European Community, and on the provisional appli-
cation of certain provisions of the Agreement between the European
Union, the European Community and the Swiss Confederation, con-
cerning the Swiss Confederation’s association with the implementa-
tion, application and development of the Schengen acquis (OJ L 370,
17.12.2004, p. 78).

(a)

(b)

‘alert’ means a set of data entered in SIS II allowing the com-
petent authorities to identify a person with a view to taking
specific action;

‘supplementary information’ means information not stored
in SIS II, but connected to SIS II alerts, which is to be
exchanged:

(i)

in order to allow Member States to consult or inform
each other when entering an alert;

L 381/8

EN

Official Journal of the European Union

28.12.2006

(ii)

following a hit, in order to allow the appropriate action
to be taken;

(iii) when the required action cannot be taken;

(iv) when dealing with the quality of SIS II data;

(v) when dealing with the compatibility and priority of

alerts;

(vi) when dealing with rights of access;

(c)

‘additional data’ means the data stored in SIS II and con-
nected with SIS II alerts which are to be immediately avail-
able to the competent authorities where a person in respect
of whom data has been entered in SIS II is located as a result
of searches made therein;

(d)

‘third-country national’ means any individual who is neither:

(i)

a citizen of the European Union within the meaning of
Article 17(1) of the Treaty;

nor

(b) a national system (the ‘N.SIS II’) in each of the Member States,
consisting of the national data systems which communicate
with Central SIS II. An N.SIS II may contain a data file (a
‘national copy’), containing a complete or partial copy of the
SIS II database;

(c) a communication infrastructure between CS-SIS and NI-SIS
(the ‘Communication Infrastructure’)
that provides an
encrypted virtual network dedicated to SIS II data and the
exchange of data between SIRENE Bureaux as referred to in
Article 7(2).

2.
SIS II data shall be entered, updated, deleted and searched
via the various N.SIS II systems. A national copy shall be avail-
able for the purpose of carrying out automated searches in the
territory of each of the Member States using such a copy. It shall
not be possible to search the data files of other Member States’
N.SIS II.

3.
CS-SIS, which performs technical supervision and adminis-
tration functions, shall be located in Strasbourg (France) and a
backup CS-SIS, capable of ensuring all functionalities of the prin-
cipal CS-SIS in the event of failure of this system, shall be located
in Sankt Johann im Pongau (Austria).

(ii) a national of a third country who, under agreements
between the Community and its Member States on the
one hand, and these countries, on the other, enjoys
rights of free movement equivalent to those of citizens
of the European Union;

4.
CS-SIS shall provide the services necessary for the entry
and processing of SIS II data, including searches in the SIS II
database. For the Member States which use a national copy,
CS-SIS shall:

(e)

(f)

‘personal data’ means any information relating to an identi-
fied or identifiable natural person (‘data subject’); an identi-
fiable person is one who can be identified, directly or
indirectly;

‘processing of personal data’ (‘processing’) means any opera-
tion or set of operations which is performed upon personal
data, whether or not by automatic means, such as collec-
tion, recording, organisation, storage, adaptation or alter-
ation, retrieval, consultation, use, disclosure by transmission,
dissemination or otherwise making available, alignment or
combination, blocking, erasure or destruction.

(a) provide the on-line update of the national copies;

(b) ensure the synchronisation of and consistency between the

national copies and the SIS II database;

(c) provide the operations for initialisation and restoration of

the national copies.

Article 4

Technical architecture and ways of operating SIS II

Article 5

Costs

1.

SIS II shall be composed of:

(a) a central system (‘Central SIS II’) composed of:

1.
The costs of setting up, operating and maintaining Central
SIS II and the Communication Infrastructure shall be borne by
the general budget of the European Union.

— a technical support function (‘CS-SIS’) containing a data-

base, the ‘SIS II database’;

— a uniform national interface (‘NI-SIS’);

These costs shall include work done with respect to CS-SIS
the services referred to in

2.
that ensures the provision of
Article 4(4).

28.12.2006

EN

Official Journal of the European Union

L 381/9

The costs of setting up, operating and maintaining

3.
each N.SIS II shall be borne by the Member State concerned.

Supplementary information shall be used only for the pur-

2.
pose for which it was transmitted.

CHAPTER II

Requests for supplementary information made by a Mem-

3.
ber State shall be answered as soon as possible.

RESPONSIBILITIES OF THE MEMBER STATES

Article 6

National systems

4.
Detailed rules for the exchange of supplementary informa-
tion shall be adopted in accordance with the procedure referred
to in Article 51(2) in the form of the SIRENE Manual, without
prejudice to the provisions of the instrument setting up the man-
agement authority.

Each Member State shall be responsible for setting up, operating
and maintaining its N.SIS II and connecting its N.SIS II to NI-SIS.

Article 9

Technical compliance

Article 7

N.SIS II Office and SIRENE Bureau

1.
Each Member State shall designate an authority (the ‘N.SIS II
Office’), which shall have central responsibility for its N.SIS II.
That authority shall be responsible for the smooth operation and
security of the N.SIS II, shall ensure the access of the competent
authorities to SIS II and shall take the necessary measures to
ensure compliance with the provisions of this Regulation. Each
Member State shall transmit its alerts via its N.SIS II Office.

2.
Each Member State shall designate the authority which shall
ensure the exchange of all supplementary information (the
‘SIRENE Bureau’) in accordance with the provisions of the SIRENE
Manual, as referred to in Article 8.

Those Bureaux shall also coordinate the verification of the qual-
ity of the information entered in the SIS II. For those purposes,
they shall have access to the data processed in SIS II.

1.
To ensure the prompt and effective transmission of data,
each Member State shall observe, when setting up its N.SIS II,
the protocols and technical procedures established to ensure the
compatibility of its N.SIS II with CS-SIS. Those protocols and
technical procedures shall be established in accordance with the
procedure referred to in Article 51(2), without prejudice to the
the instrument setting up the management
provisions of
authority.

2.
If a Member State uses a national copy it shall ensure, by
means of the services provided by CS-SIS, that data stored in the
national copy are, by means of the automatic updates referred
to in Article 4(4), identical to and consistent with the SIS II data-
base, and that a search in its national copy produces a result
equivalent to that of a search in the SIS II database.

Article 10

Security – Member States

Each Member State shall, in relation to its N.SIS II, adopt

1.
the necessary measures, including a security plan, in order to:

3.
The Member States shall inform the management author-
ity of their N.SIS II Office and of their SIRENE Bureau. The man-
agement authority shall publish the list of them together with
the list referred to in Article 31(8).

(a) physically protect data, including by making contingency

plans for the protection of critical infrastructure;

Article 8

Exchange of supplementary information

1.
Supplementary information shall be exchanged in accor-
dance with the provisions of the ‘SIRENE Manual’ and using the
communication infrastructure. Should the communication infra-
structure be unavailable, Member States may use other adequately
supplementary
for
secured technical means
information.

exchanging

(b) deny unauthorised persons access to data-processing facili-
ties used for processing personal data (facilities access
control);

(c) prevent the unauthorised reading, copying, modification or

removal of data media (data media control);

(d) prevent the unauthorised input of data and the unautho-
rised inspection, modification or deletion of stored personal
data (storage control);

L 381/10

EN

Official Journal of the European Union

28.12.2006

(e) prevent the use of automated data-processing systems by
unauthorised persons using data communication equipment
(user control);

Article 12

Keeping of records at national level

(f)

ensure that persons authorised to use an automated data-
processing system have access only to the data covered by
their access authorisation, by means of individual and unique
user identities and confidential access modes only (data
access control);

(g) ensure that all authorities with a right of access to SIS II or
to the data processing facilities create profiles describing the
functions and responsibilities of persons who are authorised
to access, enter, update, delete and search the data and make
these profiles available to the national supervisory authori-
ties referred to in Article 44(1) without delay upon their
request (personnel profiles);

(h) ensure that it is possible to verify and establish to which
bodies personal data may be transmitted using data commu-
nication equipment (communication control);

(i)

ensure that it is subsequently possible to verify and estab-
lish which personal data have been input into automated
data-processing systems, when, by whom and for what pur-
pose the data were input (input control);

(j) prevent the unauthorised reading, copying, modification or
deletion of personal data during transfers of personal data
or during transportation of data media, in particular by
means of appropriate encryption techniques (transport
control);

(k) monitor the effectiveness of the security measures referred
to in this paragraph and take the necessary organisational
measures related to internal monitoring to ensure compli-
ance with this Regulation (self-auditing).

2. Member States shall take measures equivalent to those
referred to in paragraph 1 as regards security in respect of the
exchange of supplementary information.

Article 11

Confidentiality – Member States

1. Member States not using national copies shall ensure that
every access to and all exchanges of personal data within CS-SIS
are recorded in their N.SIS II for the purposes of checking
whether or not a search is lawful, monitoring the lawfulness of
data processing, self-monitoring and ensuring the proper func-
tioning of N.SIS II, data integrity and security.

2. Member States using national copies shall ensure that every
access to and all exchanges of SIS II data are recorded for the
purposes mentioned in paragraph 1. This does not apply to the
processes referred to in Article 4(4).

The records shall show, in particular, the history of the
3.
alerts, the date and time of the data transmission, the data used
to perform a search, a reference to the data transmitted and the
name of both the competent authority and the person respon-
sible for processing the data.

The records may be used only for the purpose mentioned
4.
in paragraph 1 and 2 and shall be deleted at the earliest one year,
and at the latest three years, after their creation. The records
which include the history of alerts shall be erased one to three
years after deletion of the alerts.

Records may be kept longer if they are required for moni-

5.
toring procedures that are already under way.

The competent national authorities in charge of checking
6.
whether or not searches are lawful, monitoring the lawfulness of
data processing, self-monitoring and ensuring the proper func-
tioning of N.SIS II, data integrity and security, shall have access,
within the limits of their competence and at their request, to
these records for the purpose of fulfilling their duties.

Article 13

Self-monitoring

Each Member State shall apply its rules of professional secrecy
or other equivalent duties of confidentiality to all persons and
bodies required to work with SIS II data and supplementary infor-
mation, in accordance with its national legislation. This obliga-
tion shall also apply after
those people leave office or
employment or after the termination of the activities of those
bodies.

Member States shall ensure that each authority entitled to access
SIS II data takes the measures necessary to comply with this
Regulation and cooperates, where necessary, with the national
supervisory authority.

28.12.2006

EN

Official Journal of the European Union

L 381/11

Article 14

Staff training

Each national public-sector body referred to in paragraph 4

5.
shall meet the following selection criteria:

Before being authorised to process data stored in SIS II, the staff
of the authorities having a right to access SIS II shall receive
appropriate training about data-security and data-protection rules
and shall be informed of any relevant criminal offences and
penalties.

(a)

it must demonstrate that it has lengthy experience in oper-
ating a large-scale information system with the functional-
ities referred to in Article 4(4);

CHAPTER III

RESPONSIBILITIES OF THE MANAGEMENT AUTHORITY

(b)

it must have considerable expertise in the service and secu-
rity requirements of an information system with functional-
ities comparable to those referred to in Article 4(4);

Article 15

Operational management

1.
After a transitional period, a management authority (the
‘Management Authority’), funded from the general budget of the
European Union, shall be responsible for the operational man-
agement of Central SIS II. The Management Authority shall
ensure, in cooperation with the Member States, that at all times
the best available technology, subject to a cost-benefit analysis,
is used for Central SIS II.

(c)

it must have sufficient and experienced staff with the appro-
priate professional expertise and linguistic skills to work in
an international cooperation environment such as that
required by SIS II;

(d)

it must have a secure and custom-built facility infrastruc-
ture able, in particular, to back-up and guarantee the con-
tinuous functioning of large-scale IT systems;

2.
The Management Authority shall also be responsible for
the following tasks relating to the Communication Infrastructure:

and

(a)

supervision;

(b)

security;

(c)

the coordination of relations between the Member States and
the provider.

The Commission shall be responsible for all other tasks

3.
relating to the Communication Infrastructure, in particular:

(a)

tasks relating to implementation of the budget;

(b) acquisition and renewal;

(c)

contractual matters.

During a transitional period before the Management
4.
Authority takes up its responsibilities, the Commission shall be
responsible for the operational management of Central SIS II.
The Commission may delegate that task and tasks relating to
implementation of the budget, in accordance with the Council
Regulation (EC, Euratom) No 1605/2002 of 25 June 2002 on
the Financial Regulation applicable to the general budget of the
European Communities (1), to national public-sector bodies, in
two different countries.

(1) OJ L 248, 16.9.2002, p. 1.

(e)

its administrative environment must allow it to implement
its tasks properly and avoid any conflict of interests.

Prior to any delegation as referred to in paragraph 4 and at
6.
regular intervals thereafter, the Commission shall inform the
European Parliament and the Council of the terms of the delega-
tion,
its precise scope, and the bodies to which tasks are
delegated.

7. Where the Commission delegates its responsibility during
the transitional period pursuant to paragraph 4, it shall ensure
that this delegation fully respects the limits set by the institu-
tional system laid out in the Treaty. It shall ensure, in particular,
that this delegation does not adversely affect any effective con-
trol mechanism under Community law, whether of the Court of
Justice, the Court of Auditors or the European Data Protection
Supervisor.

8.
Operational management of Central SIS II shall consist of
all the tasks necessary to keep Central SIS II functioning 24 hours
a day, 7 days a week in accordance with this Regulation, in par-
ticular the maintenance work and technical developments neces-
sary for the smooth running of the system.

L 381/12

EN

Official Journal of the European Union

28.12.2006

Article 16

Security

(k) monitor the effectiveness of the security measures referred
to in this paragraph and take the necessary organisational
measures related to internal monitoring to ensure compli-
ance with this Regulation (self-auditing).

The Management Authority, in relation to Central SIS II,
1.
and the Commission, in relation to the Communication Infra-
structure, shall adopt the necessary measures, including a secu-
rity plan, in order to:

(a) physically protect data, including by making contingency

plans for the protection of critical infrastructure;

(b) deny unauthorised persons access to data-processing facili-
ties used for processing personal data (facilities access
control);

(c) prevent the unauthorised reading, copying, modification or

removal of data media (data media control);

(d) prevent the unauthorised input of data and the unautho-
rised inspection, modification or deletion of stored personal
data (storage control);

(e) prevent the use of automated data-processing systems by
unauthorised persons using data communication equipment
(user control);

(f)

ensure that persons authorised to use an automated data-
processing system have access only to the data covered by
their access authorisation by means of individual and unique
user identities and confidential access modes only (data
access control);

(g) create profiles describing the functions and responsibilities
of persons who are authorised to access the data or the data
processing facilities and make these profiles available to the
referred to in
European Data Protection Supervisor
(personnel
Article 45 without delay upon its request
profiles);

(h) ensure that it is possible to verify and establish to which
bodies personal data may be transmitted using data commu-
nication equipment (communication control);

(i)

ensure that it is subsequently possible to verify and estab-
lish which personal data have been input into automated
data-processing systems, when and by whom the data were
input (input control);

(j) prevent the unauthorised reading, copying, modification or
deletion of personal data during transfers of personal data
or during transportation of data media in particular by
means of appropriate encryption techniques (transport
control);

2.
The Management Authority shall take measures equivalent
to those referred to in paragraph 1 as regards security in respect
of the exchange of supplementary information through the Com-
munication Infrastructure.

Article 17

Confidentiality – Management Authority

1. Without prejudice to Article 17 of the Staff Regulations of
Officials of the European Communities, the Management Author-
ity shall apply appropriate rules of professional secrecy or other
equivalent duties of confidentiality of a comparable standard to
those provided in Article 11 of this Regulation to all its staff
required to work with SIS II data. This obligation shall also apply
after those people leave office or employment or after the termi-
nation of their activities.

2.
The Management Authority shall take measures equivalent
to those referred to in paragraph 1 as regards confidentiality in
respect of the exchange of supplementary information through
the Communication Infrastructure.

Article 18

Keeping of records at central level

1.
The Management Authority shall ensure that every access
to and all exchanges of personal data within CS-SIS are recorded
for the purposes mentioned in Article 12(1) and (2).

2.
The records shall show, in particular, the history of the
alerts, the date and time of the data transmitted, the data used to
perform searches, the reference to the data transmitted and the
name of the competent authority responsible for processing the
data.

3.
The records may only be used for the purpose mentioned
in paragraph 1 and shall be deleted at the earliest one year, and
at the latest three years, after their creation. The records which
include the history of alerts shall be erased one to three years
after deletion of the alerts.

Records may be kept longer if they are required for moni-

4.
toring procedures that are already under way.

28.12.2006

EN

Official Journal of the European Union

L 381/13

The competent authorities in charge of checking whether
5.
a search is lawful, monitoring the lawfulness of data processing,
self-monitoring and ensuring the proper functioning of CS-SIS,
data integrity and security, shall have access, within the limits of
their competence and at their request, to those records for the
purpose of fulfilling their tasks.

(e) photographs;

(f)

fingerprints;

(g) nationality(ies);

Article 19

Information campaign

(h) whether the person concerned is armed, violent or has

escaped;

The Commission shall, in cooperation with the national supervi-
sory authorities and the European Data Protection Supervisor,
accompany the start of the operation of SIS II with an informa-
tion campaign informing the public about the objectives, the data
stored, the authorities having access and the rights of persons.
After its establishment, the Management Authority, in coopera-
tion with the national supervisory authorities and the European
Data Protection Supervisor, shall repeat such campaigns regu-
larly. Member States shall, in cooperation with their national
supervisory authorities, devise and implement the necessary poli-
cies to inform their citizens about SIS II generally.

CHAPTER IV

ALERTS ISSUED IN RESPECT OF THIRD-COUNTRY
NATIONALS FOR THE PURPOSE OF REFUSING ENTRY AND
STAY

Article 20

Categories of data

(i)

reason for the alert;

(j)

authority issuing the alert;

(k) a reference to the decision giving rise to the alert;

(l)

action to be taken;

(m) link(s) to other alerts issued in SIS II in accordance with

Article 37.

3.
The technical rules necessary for entering, updating, delet-
ing and searching the data referred to in paragraph 2 shall be
established in accordance with the procedure referred to in
Article 51(2), without prejudice to the provisions of the instru-
ment setting up the Management Authority.

1. Without prejudice to Article 8(1) or the provisions of this
Regulation providing for the storage of additional data, SIS II
shall contain only those categories of data which are supplied by
each of the Member States, as required for the purposes laid down
in Article 24.

4.
The technical rules necessary for searching the data referred
to in paragraph 2 shall be similar for searches in CS-SIS, in
national copies and in technical copies, as referred to in
Article 31(2).

The information on persons in relation to whom an alert

2.
has been issued shall be no more than the following:

Article 21

Proportionality

(a)

surname(s) and forename(s), name(s) at birth and previously
used names and any aliases, which may be entered
separately;

Before issuing an alert, Member States shall determine whether
the case is adequate, relevant and important enough to warrant
entry of the alert in SIS II.

(b) any specific, objective, physical characteristics not subject to

change;

Article 22

Specific rules for photographs and fingerprints

(c) place and date of birth;

(d)

sex;

The use of photographs and fingerprints as referred to in
to the following
Article 20(2)(e) and (f) shall be subject
provisions:

L 381/14

EN

Official Journal of the European Union

28.12.2006

(a) photographs and fingerprints shall only be entered follow-
ing a special quality check to ascertain the fulfilment of a
minimum data quality standard. The specification of the spe-
cial quality check shall be established in accordance with the
procedure referred to in Article 51(2), without prejudice to
the provisions of the instrument setting up the Management
Authority;

(b) photographs and fingerprints shall only be used to confirm
the identity of a third-country national who has been located
as a result of an alphanumeric search made in SIS II;

(c) as soon as this becomes technically possible, fingerprints
may also be used to identify a third-country national on the
basis of his biometric identifier. Before this functionality is
implemented in SIS II, the Commission shall present a report
on the availability and readiness of the required technology,
on which the European Parliament shall be consulted.

Article 23

Requirement for an alert to be entered

An alert may not be entered without the data referred to

1.
in Article 20(2)(a), (d), (k) and (l).

2. When available, all other data listed in Article 20(2) shall
also be entered.

Article 24

Conditions for issuing alerts on refusal of entry or stay

(b) a third-country national in respect of whom there are seri-
ous grounds for believing that he has committed a serious
criminal offence or in respect of whom there are clear indi-
cations of an intention to commit such an offence in the ter-
ritory of a Member State.

3.
An alert may also be entered when the decision referred to
in paragraph 1 is based on the fact that the third-country national
has been subject to a measure involving expulsion, refusal of
entry or removal which has not been rescinded or suspended,
that includes or is accompanied by a prohibition on entry or,
where applicable, a prohibition on residence, based on a failure
to comply with national regulations on the entry or residence of
third-country nationals.

This Article shall not apply in respect of the persons

4.
referred to in Article 26.

5.
The Commission shall review the application of this Article
three years after the date referred to in Article 55(2). On the basis
of that review, the Commission shall, using its right of initiative
in accordance with the Treaty, make the necessary proposals to
modify the provisions of this Article to achieve a greater level of
harmonisation of the criteria for entering alerts.

Article 25

Conditions for entering alerts on third-country nationals
who are beneficiaries of the right of free movement
within the Community

1.
Data on third-country nationals in respect of whom an alert
has been issued for the purposes of refusing entry or stay shall
be entered on the basis of a national alert resulting from a deci-
sion taken by the competent administrative authorities or courts
in accordance with the rules of procedure laid down by national
law taken on the basis of an individual assessment. Appeals
lie in accordance with national
against these decisions shall
legislation.

1.
An alert concerning a third-country national who is a ben-
eficiary of the right of free movement within the Community,
within the meaning of Directive 2004/38/EC of the European
Parliament and of the Council of 29 April 2004 on the right of
citizens of the Union and their family members to move and
reside freely within the territory of the Member States (1) shall
be in conformity with the rules adopted in implementation of
that Directive.

An alert shall be entered where the decision referred to in
2.
paragraph 1 is based on a threat to public policy or public secu-
rity or to national security which the presence of the third-
country national in question in the territory of a Member State
may pose. This situation shall arise in particular in the case of:

2. Where there is a hit on an alert pursuant to Article 24 con-
cerning a third-country national who is a beneficiary of the right
of free movement within the Community, the Member State
executing the alert shall consult immediately the issuing Mem-
ber State, through its SIRENE Bureau and in accordance with the
provisions of the SIRENE Manual, in order to decide without
delay on the action to be taken.

(a) a third-country national who has been convicted in a Mem-
ber State of an offence carrying a penalty involving depriva-
tion of liberty of at least one year;

(1) OJ L 158, 30.4.2004, p. 77.

28.12.2006

EN

Official Journal of the European Union

L 381/15

Article 26

Conditions for issuing alerts on third-country nationals
subject to a restrictive measure taken in accordance with
Article 15 of the Treaty on European Union

1. Without prejudice to Article 25, alerts relating to third-
country nationals who are the subject of a restrictive measure
intended to prevent entry into or transit through the territory of
Member States, taken in accordance with Article 15 of the Treaty
on European Union, including measures implementing a travel
ban issued by the Security Council of the United Nations, shall,
insofar as data-quality requirements are satisfied, be entered in
SIS II for the purpose of refusing entry or stay.

Article 23 shall not apply in respect of alerts entered on

2.
the basis of paragraph 1 of this Article.

The Member State responsible for entering, updating and
3.
deleting these alerts on behalf of all Member States shall be des-
ignated at the moment of the adoption of the relevant measure
taken in accordance with Article 15 of the Treaty on European
Union.

(e)

and

with

Article

38(2)(d)

In addition, the right to access data entered in SIS II and
3.
the data concerning documents relating to persons entered in
accordance
of
Decision 2006/000/JHA and the right to search such data directly
may be exercised by the authorities responsible for issuing visas,
the central authorities responsible for examining visa applica-
tions and the authorities responsible for issuing residence per-
mits and for the administration of legislation relating to third-
country nationals in the context of the application of the
Community acquis relating to the movement of persons. Access
to data by these authorities shall be governed by the law of each
Member State.

The authorities referred to in this Article shall be included

4.
in the list referred to in Article 31(8).

Article 28

Scope of access

Users may only access data which they require for the perfor-
mance of their tasks.

Article 27

Authorities having a right to access alerts

Article 29

Retention period of alerts

Access to data entered in SIS II and the right to search such
1.
data directly or in a copy of SIS II data shall be reserved exclu-
sively to the authorities responsible for the identification of third-
country nationals for the purposes of:

1.
Alerts entered in SIS II pursuant to this Regulation shall be
kept only for the time required to achieve the purposes for which
they were entered.

(a) border control,

in accordance with Regulation (EC)
No 562/2006 of the European Parliament and the Council
of 15 March 2006 establishing a Community Code on the
rules governing the movement of persons across borders
(Schengen Borders Code) (1);

(b) other police and customs checks carried out within the Mem-
ber State concerned, and the coordination of such checks by
designated authorities.

2.
However, the right to access data entered in SIS II and the
right to search such data directly may also be exercised by
national judicial authorities, including those responsible for the
initiation of public prosecutions in criminal proceedings and for
judicial inquiries prior to charge, in the performance of their
tasks, as provided for in national legislation, and by their coor-
dinating authorities.

(1) OJ L 105, 13.4.2006, p. 1.

A Member State issuing an alert shall, within three years of

2.
its entry in SIS II, review the need to keep it.

Each Member State shall, where appropriate, set shorter

3.
review periods in accordance with its national law.

4. Within the review period, a Member State issuing an alert
may, following a comprehensive individual assessment, which
shall be recorded, decide to keep the alert longer, should this
prove necessary for the purposes for which the alert was issued.
In such a case, paragraph 2 shall apply also to the extension. Any
extension of an alert shall be communicated to CS-SIS.

5.
Alerts shall automatically be erased after the review period
referred to in paragraph 2 except where the Member State issu-
ing the alert has communicated the extension of the alert to
CS-SIS pursuant to paragraph 4. CS-SIS shall automatically
inform the Member States of the scheduled deletion of data from
the system four months in advance.

L 381/16

EN

Official Journal of the European Union

28.12.2006

6. Member States shall keep statistics about the number of
alerts the retention period of which has been extended in accor-
dance with paragraph 4.

Member States shall keep an up-to-date inventory of such cop-
ies, make this inventory available to their national supervisory
authority and ensure that the provisions of this Regulation, in
particular those of Article 10, are applied in respect of such
copies.

Article 30

Acquisition of citizenship and alerts

Alerts issued in respect of a person who has acquired citizenship
of any State whose nationals are beneficiaries of the right of free
movement within the Community shall be erased as soon as the
Member State which issued the alert becomes aware, or is
informed pursuant to Article 34, that the person in question has
acquired such citizenship.

CHAPTER V

GENERAL DATA-PROCESSING RULES

Article 31

Processing of SIS II data

1.
The Member States may process the data referred to in
Article 20 for the purposes of refusing entry into or a stay in
their territories.

2.
Data may only be copied for technical purposes, provided
that such copying is necessary in order for the authorities referred
to in Article 27 to carry out a direct search. The provisions of
this Regulation shall apply to such copies. Alerts issued by one
Member State may not be copied from its N.SIS II into other
national data files.

3.
Technical copies, as referred to in paragraph 2, which lead
to off-line databases may be retained for a period not exceeding
48 hours. That period may be extended in an emergency until
the emergency comes to an end.

Notwithstanding the first subparagraph, technical copies which
lead to off-line databases to be used by visa issuing authorities
shall no longer be permitted one year after the authority in ques-
tion has been connected successfully to the Communication
Infrastructure for the Visa Information System to be provided for
in a future Regulation concerning the Visa Information System
(VIS) and the exchange of data between Member States on short
stay visas except for copies made to be used only in an emer-
gency following the unavailability of the network for more than
24 hours.

Access to data shall only be authorised within the limits of
the national authorities referred to in

4.
the competence of
Article 27 and to duly authorised staff.

5.
Data may not be used for administrative purposes. By way
of derogation, data entered in accordance with this Regulation
may be used in accordance with the laws of each Member State
by the authorities referred to in Article 27(3) in the performance
of their duties.

Data entered in accordance with Article 24 of this Regula-
6.
tion and data concerning documents relating to persons entered
under Article 38(2)(d) and (e) of Decision 2006/000/JHA may
be used in accordance with the laws of each Member State for
the purposes referred to in Article 27(3) of this Regulation.

7.
Any use of data which does not comply with paragraphs 1
to 6 shall be considered as misuse under the national law of each
Member State.

Each Member State shall send to the Management Author-
8.
ity a list of its competent authorities authorised to search directly
the data contained in SIS II pursuant to this Regulation as well
as any changes to the list. That list shall specify, for each author-
ity, which data it may search and for what purposes. The Man-
agement Authority shall ensure the annual publication of the list
in the Official Journal of the European Union.

9.
Insofar as Community law does not lay down specific pro-
visions, the law of each Member State shall apply to data entered
in its N.SIS II.

Article 32

SIS II data and national files

1.
Article 31(2) shall not prejudice the right of a Member State
to keep in its national files SIS II data in connection with which
action has been taken on its territory. Such data shall be kept in
national files for a maximum period of three years, except if spe-
cific provisions of national law provide for a longer retention
period.

28.12.2006

EN

Official Journal of the European Union

L 381/17

Article 31(2) shall not prejudice the right of a Member State
2.
to keep in its national files data contained in a particular alert
issued in SIS II by that Member State.

Article 35

Distinguishing between persons with similar
characteristics

Article 33

Information in the event of non-execution of an alert

Where it becomes apparent, when a new alert is entered, that
there is already a person in SIS II with the same identity descrip-
tion element, the following procedure shall be followed:

If a requested action cannot be performed, the requested Mem-
ber State shall immediately inform the Member State issuing the
alert.

(a)

the SIRENE Bureau shall contact the requesting authority to
clarify whether or not the alert is on the same person;

Article 34

Quality of the data processed in SIS II

A Member State issuing an alert shall be responsible for
1.
ensuring that the data are accurate, up-to-date and entered in SIS
II lawfully.

2.
Only the Member State issuing an alert shall be authorised
to modify, add to, correct, update or delete data which it has
entered.

3.
If a Member State other than that which issued an alert has
evidence suggesting that an item of data is factually incorrect or
has been unlawfully stored, it shall, through the exchange of
supplementary information, inform the Member State that issued
the alert thereof at the earliest opportunity and not later than
ten days after the said evidence has come to its attention. The
Member State that issued the alert shall check the communica-
tion and, if necessary, correct or delete the item in question with-
out delay.

If the Member States are unable to reach agreement within
4.
two months, the Member State which did not issue the alert shall
submit the matter to the European Data Protection Supervisor,
who shall, jointly with the national supervisory authorities con-
cerned, act as mediator.

5.
The Member States shall exchange supplementary informa-
tion if a person complains that he is not the person wanted by
an alert. If the outcome of the check is that there are in fact two
different persons the complainant shall be informed of the pro-
visions of Article 36.

6. Where a person is already the subject of an alert in SIS II, a
Member State which enters a further alert shall reach agreement
on the entry of the alert with the Member State which entered
the first alert. The agreement shall be reached on the basis of the
exchange of supplementary information.

(b)

if the cross-check reveals that the subject of the new alert
and the person already in SIS II are indeed one and the same,
the SIRENE Bureau shall apply the procedure for entering
multiple alerts as referred to in Article 34(6). If the outcome
of the check is that there are in fact two different persons,
the SIRENE Bureau shall approve the request for entering the
second alert by adding the necessary elements to avoid any
misidentification.

Article 36

Additional data for the purpose of dealing with misused
identity

1. Where confusion may arise between the person actually
intended as the subject of an alert and a person whose identity
has been misused, the Member State which entered the alert shall,
subject to that person’s explicit consent, add data relating to the
latter to the alert in order to avoid the negative consequences of
misidentification.

Data relating to a person whose identity has been misused

2.
shall be used only for the following purposes:

(a)

to allow the competent authority to distinguish the person
whose identity has been misused from the person actually
intended as the subject of the alert;

(b)

to allow the person whose identity has been misused to
prove his identity and to establish that his identity has been
misused.

For the purpose of this Article, no more than the follow-
3.
ing personal data may be entered and further processed in SIS II:

L 381/18

EN

Official Journal of the European Union

28.12.2006

(a)

surname(s) and forename(s), name(s) at birth and previously
used names and any aliases possibly entered separately;

A Member State shall create a link between alerts only when

4.
there is a clear operational need.

(b) any specific objective and physical characteristic not subject

to change;

Links may be created by a Member State in accordance with
5.
its national legislation provided that the principles outlined in the
present Article are respected.

(c) place and date of birth;

(d)

sex;

(e) photographs;

(f)

fingerprints;

(g) nationality(ies);

(h) number(s) of identity paper(s) and date of issue.

The technical rules necessary for entering and further pro-
4.
cessing the data referred to in paragraph 3 shall be established
in accordance with the procedure referred to in Article 51(2),
without prejudice to the provisions of the instrument setting up
the Management Authority.

6. Where a Member State considers that the creation by
another Member State of a link between alerts is incompatible
with its national law or international obligations, it may take the
necessary measures to ensure that there can be no access to the
link from its national territory or by its authorities located out-
side its territory.

7.
The technical rules for linking alerts shall be adopted in
accordance with the procedure referred to in Article 51(2), with-
out prejudice to the provisions of the instrument setting up the
Management Authority.

Article 38

Purpose and retention period of supplementary
information

5.
The data referred to in paragraph 3 shall be erased at the
same time as the corresponding alert or earlier if the person so
requests.

1. Member States shall keep a reference to the decisions giv-
ing rise to an alert at the SIRENE Bureau to support the exchange
of supplementary information.

6.
Only the authorities having a right of access to the corre-
sponding alert may access the data referred to in paragraph 3.
They may do so for
avoiding
misidentification.

sole purpose of

the

Article 37

Links between alerts

1.
A Member State may create a link between alerts it enters
in SIS II. The effect of such a link shall be to establish a relation-
ship between two or more alerts.

2.
Personal data held in files by the SIRENE Bureau as a result
of information exchanged, shall be kept only for such time as
may be required to achieve the purposes for which they were
supplied. They shall in any event be deleted at the latest one year
after the related alert has been deleted from SIS II.

3.
Paragraph 2 shall not prejudice the right of a Member State
to keep in national files data relating to a particular alert which
that Member State has issued or to an alert in connection with
which action has been taken on its territory. The period for which
such data may be held in such files shall be governed by national
law.

2.
The creation of a link shall not affect the specific action to
be taken on the basis of each linked alert or the retention period
of each of the linked alerts.

Article 39

Transfer of personal data to third parties

3.
The creation of a link shall not affect the rights of access
provided for in this Regulation. Authorities with no right of
access to certain categories of alert shall not be able to see the
link to an alert to which they do not have access.

Data processed in SIS II pursuant to this Regulation shall not be
transferred or made available to third countries or to interna-
tional organisations.

28.12.2006

EN

Official Journal of the European Union

L 381/19

CHAPTER VI

DATA PROTECTION

Article 42

Right of information

Article 40

Processing of sensitive categories of data

Processing of the categories of data listed in Article 8(1) of Direc-
tive 95/46/EC shall be prohibited.

1.
Third-country nationals who are the subject of an alert
issued in accordance with this Regulation shall be informed in
accordance with Articles 10 and 11 of Directive 95/46/EC. This
information shall be provided in writing, together with a copy
of or a reference to the national decision giving rise to the alert,
as referred to in Article 24(1).

2.

This information shall not be provided:

Article 41

Right of access, correction of inaccurate data and deletion
of unlawfully stored data

(a) where

The right of persons to have access to data relating to them
1.
entered in SIS II in accordance with this Regulation shall be exer-
cised in accordance with the law of the Member State before
which they invoke that right.

(i)

the personal data have not been obtained from the
third-country national in question;

and

2.
If national law so provides, the national supervisory author-
ity shall decide whether information is to be communicated and
by what procedures.

(ii)

the provision of the information proves impossible or
would involve a disproportionate effort;

3.
A Member State other than that which has issued an alert
may communicate information concerning such data only if it
first gives the Member State issuing the alert an opportunity to
state its position. This shall be done through the exchange of
supplementary information.

4.
Information shall not be communicated to the data subject
if this is indispensable for the performance of a lawful task in
connection with an alert or for the protection of the rights and
freedoms of third parties.

5.
Any person has the right to have factually inaccurate data
relating to him corrected or unlawfully stored data relating to
him deleted.

The individual concerned shall be informed as soon as pos-
6.
sible and in any event not later than 60 days from the date on
which he applies for access or sooner, if national law so provides.

7.
The individual shall be informed about the follow-up given
to the exercise of his rights of correction and deletion as soon as
possible and in any event not later than three months from the
date on which he applies for correction or deletion or sooner, if
national law so provides.

(b) where the third country national in question already has the

information;

(c) where national law allows for the right of information to be
restricted, in particular in order to safeguard national secu-
rity, defence, public security and the prevention, investiga-
tion, detection and prosecution of criminal offences.

Article 43

Remedies

1.
Any person may bring an action before the courts or the
authority competent under the law of any Member State to
access, correct, delete or obtain information or to obtain com-
pensation in connection with an alert relating to him.

2.
The Member States undertake mutually to enforce final
decisions handed down by the courts or authorities referred to
in paragraph 1, without prejudice to the provisions of Article 48.

The rules on remedies provided for in this Article shall be

3.
evaluated by the Commission by 17 January 2009.

L 381/20

EN

Official Journal of the European Union

28.12.2006

Article 44

Supervision of N.SIS II

1.
The authority or authorities designated in each Member
State and endowed with the powers referred to in Article 28 of
Directive 95/46/EC (the ‘National Supervisory Authority’) shall
monitor independently the lawfulness of the processing of SIS II
personal data on their territory and its transmission from that
territory, and the exchange and further processing of supplemen-
tary information.

2.
The National Supervisory Authority shall ensure that an
audit of the data processing operations in its N.SIS II is carried
out in accordance with international auditing standards at least
every four years.

They shall, each acting within the scope of its respective
2.
competences, exchange relevant information, assist each other in
carrying out audits and inspections, examine difficulties of inter-
pretation or application of this Regulation, study problems with
the exercise of independent supervision or in the exercise of the
rights of data subjects, draw up harmonised proposals for joint
solutions to any problems and promote awareness of data pro-
tection rights, as necessary.

3.
The National Supervisory Authorities and the European
Data Protection Supervisor shall meet for that purpose at least
twice a year. The costs and servicing of these meetings shall be
for the account of the European Data Protection Supervisor.
Rules of procedure shall be adopted at the first meeting. Further
working methods shall be developed jointly as necessary. A joint
report of activities shall be sent to the European Parliament, the
Council, the Commission and the Management Authority every
two years.

3. Member States shall ensure that their National Supervisory
Authority has sufficient resources to fulfil the tasks entrusted to
it under this Regulation.

Article 47

Data protection during the transitional period

Article 45

Supervision of the Management Authority

The European Data Protection Supervisor shall check that
1.
the personal data processing activities of
the Management
Authority are carried out in accordance with this Regulation. The
duties and powers referred to in Articles 46 and 47 of Regula-
tion (EC) No 45/2001 shall apply accordingly.

2.
The European Data Protection Supervisor shall ensure that
an audit of the Management Authority’s personal data process-
ing activities is carried out in accordance with international audit-
ing standards at least every four years. A report of such audit
shall be sent to the European Parliament, the Council, the Man-
agement Authority, the Commission and the National Supervi-
sory Authorities. The Management Authority shall be given an
opportunity to make comments before the report is adopted.

Where the Commission delegates its responsibilities during the
transitional period to another body or bodies, pursuant to
Article 15(4), it shall ensure that the European Data Protection
Supervisor has the right and is able to fully exercise his tasks,
including carrying out on-the-spot checks, and to exercise any
other powers conferred on him by Article 47 of Regulation (EC)
No 45/2001.

CHAPTER VII

LIABILITY AND PENALTIES

Article 48

Liability

Article 46

Cooperation between National Supervisory Authorities
and the European Data Protection Supervisor

1.
Each Member State shall be liable in accordance with its
national law for any damage caused to a person through the use
of N.SIS II. This shall also apply to damage caused by the Mem-
ber State which issued the alert, where the latter entered factu-
ally inaccurate data or stored data unlawfully.

1.
The National Supervisory Authorities and the European
Data Protection Supervisor, each acting within the scope of its
respective competences, shall cooperate actively in the frame-
work of their responsibilities and shall ensure coordinated super-
vision of SIS II.

2.
If the Member State against which an action is brought is
not the Member State issuing the alert, the latter shall be required
to reimburse, on request, the sums paid out as compensation
unless the use of the data by the Member State requesting reim-
bursement infringes this Regulation.

28.12.2006

EN

Official Journal of the European Union

L 381/21

If any failure of a Member State to comply with its obliga-
3.
tions under this Regulation causes damage to SIS II, that Mem-
ber State shall be held liable for such damage, unless and insofar
as the Management Authority or another Member State partici-
pating in SIS II failed to take reasonable steps to prevent the dam-
age from occurring or to minimise its impact.

Article 49

Penalties

Member States shall ensure that any misuse of data entered in
SIS II or any exchange of supplementary information contrary
to this Regulation is subject to effective, proportionate and dis-
suasive penalties in accordance with national law.

CHAPTER VIII

FINAL PROVISIONS

Article 50

Monitoring and statistics

Three years after SIS II is brought into operation and every
5.
four years thereafter, the Commission shall produce an overall
evaluation of Central SIS II and the bilateral and multilateral
exchange of supplementary information between Member States.
This overall evaluation shall include an examination of results
achieved against objectives and an assessment of the continuing
validity of the underlying rationale, the application of this Regu-
lation in respect of Central SIS II, the security of Central SIS II
and any implications for future operations. The Commission shall
transmit the evaluation to the European Parliament and the
Council.

6. Member States shall provide the Management Authority
and the Commission with the information necessary to draft the
reports referred to in paragraphs 3, 4 and 5.

7.
The Management Authority shall provide the Commission
with the information necessary to produce the overall evalua-
tions referred to in paragraph 5.

8.
During a transitional period before the Management
Authority takes up its responsibilities, the Commission shall be
responsible for producing and submitting the reports referred to
in paragraphs 3 and 4.

Article 51

Committee

The Management Authority shall ensure that procedures
1.
are in place to monitor the functioning of SIS II against objec-
tives relating to output, cost-effectiveness, security and quality of
service.

2.
For the purposes of technical maintenance, reporting and
statistics, the Management Authority shall have access to the nec-
essary information relating to the processing operations per-
formed in Central SIS II.

3.
Each year the Management Authority shall publish statis-
tics showing the number of records per category of alert, the
number of hits per category of alert and how many times SIS II
was accessed, in total and for each Member State.

1.

The Commission shall be assisted by a Committee.

2. Where reference is made to this paragraph, Articles 5 and 7
of Decision 1999/468/EC shall apply, having regard to the pro-
visions of Article 8 thereof.

The period provided for in Article 5(6) of Decision 1999/468/EC
shall be three months.

The Committee shall exercise its function from the date of

3.
entry into force of this Regulation.

Two years after SIS II is brought into operation and every
4.
two years thereafter, the Management Authority shall submit to
the European Parliament and the Council a report on the techni-
cal functioning of Central SIS II and the Communication Infra-
structure, including the security thereof and the bilateral and
multilateral exchange of supplementary information between
Member States.

Article 52

Amendment of the provisions of the Schengen Acquis

1.
For the purposes of matters falling within the scope of the
Treaty, this Regulation shall replace, on the date referred to in
Article 55(2), the provisions of Articles 92 to 119 of the Schen-
gen Convention, with the exception of Article 102 A thereof.

L 381/22

EN

Official Journal of the European Union

28.12.2006

It shall also replace, on the date referred to in Article 55(2),
2.
the following provisions of the Schengen acquis implementing
those articles (1):

Article 53

Repeal

(a) Decision of the Executive Committee of 14 December 1993
on the Financial Regulation on the costs of installing and
operating the Schengen Information System (C.SIS)
(SCH/Com-ex (93) 16);

Regulation (EC) No 378/2004, Regulation (EC) No 871/2004,
Decision 2005/451/JHA, Decision 2005/728/JHA and Decision
2006/628/EC are repealed on the date referred to in Article 55(2).

(b) Decision of the Executive Committee of 7 October 1997 on

the development of the SIS (SCH/Com-ex (97) 24);

Article 54

Transitional period and budget

(c) Decision of the Executive Committee of 15 December 1997
amending the Financial Regulation on C.SIS (SCH/Com-ex
(97) 35);

(d) Decision of the Executive Committee of 21 April 1998 on
C.SIS with 15/18 connections (SCH/Com-ex (98) 11);

(e) Decision of the Executive Committee of 28 April 1999 on

C.SIS installation expenditure (SCH/Com-ex (99) 4);

(f) Decision of the Executive Committee of 28 April 1999 on

updating the SIRENE Manual (SCH/Com-ex (99) 5);

1.
Alerts shall be transferred from SIS 1+ to SIS II. The Mem-
ber States shall ensure, giving priority to alerts on persons, that
the contents of the alerts that are transferred from SIS 1+ to SIS
II satisfy the provisions of this Regulation as soon as possible and
within three years after the date referred to in Article 55(2) at
the latest. During this transitional period, the Member States may
continue to apply the provisions of Articles 94 and 96 of the
Schengen Convention to the contents of the alerts that are trans-
ferred from SIS 1+ to SIS II, subject to the following rules:

(a)

in the event of a modification of, an addition to, or a cor-
rection or update of the content of an alert transferred from
SIS 1+ to SIS II, the Member States shall ensure that the alert
satisfies the provisions of this Regulation as from the time
of that modification, addition, correction or update;

(g) Declaration of the Executive Committee of 18 April 1996
defining the concept of alien (SCH/Com-ex (96) decl. 5);

(b)

in the event of a hit on an alert transferred from SIS 1+ to
SIS II, the Member States shall examine the compatibility of
that alert with the provisions of this Regulation immediately,
but without delaying the action to be taken on the basis of
that alert.

(h) Declaration of the Executive Committee of 28 April 1999
on the structure of SIS (SCH/Com-ex (99) decl. 2 rev.);

(i) Decision of the Executive Committee of 7 October 1997 on
contributions from Norway and Iceland to the costs of
installing and operating of the C.SIS (SCH/Com-ex (97) 18).

3.
For the purposes of matters falling within the scope of the
Treaty, references to the replaced Articles of the Schengen Con-
vention and relevant provisions of the Schengen acquis imple-
menting those Articles shall be construed as references to this
Regulation.

(1) OJ L 239, 22.9.2000, p. 439.

The remainder of the budget at the date set in accordance
2.
with Article 55(2), which has been approved in accordance with
the provisions of Article 119 of the Schengen Convention, shall
be paid back to the Member States. The amounts to be repaid
shall be calculated on the basis of the contributions from the
Member States as laid down in the Decision of the Executive
Committee of 14 December 1993 on the financial regulation on
the costs of installing and operating the Schengen Information
System.

3.
During the transitional period referred to in Article 15(4),
references in this Regulation to the Management Authority shall
be construed as a reference to the Commission.

28.12.2006

EN

Official Journal of the European Union

L 381/23

Article 55

Entry into force, applicability and migration

1.
This Regulation shall enter into force on the twentieth day
following that of its publication in the Official Journal of the Euro-
pean Union.

2.
It shall apply to the Member States participating in SIS 1+
from dates to be fixed by the Council, acting by the unanimity
of its Members representing the governments of the Member
States participating in SIS 1+.

3.

The dates referred to in paragraph 2 shall be fixed after:

(a)

the necessary implementing measures have been adopted;

(b) all Member States fully participating in SIS 1+ have notified
the Commission that they have made the necessary techni-
cal and legal arrangements to process SIS II data and
exchange supplementary information;

(c)

the Commission has declared the successful completion of a
comprehensive test of SIS II, which shall be conducted by
the Commission together with the Member States, and the
preparatory bodies of the Council have validated the pro-
posed test result and confirmed that the level of perfor-
mance of SIS II is at least equivalent to that achieved
with SIS 1+;

(d)

the Commission has made the necessary technical arrange-
to be connected to
ments for allowing Central SIS II
the N.SIS II of the Member States concerned.

The Commission shall inform the European Parliament of
in accordance with

the tests carried out

4.
the results of
paragraph 3(c).

5.
Any Decision of the Council taken in accordance with para-
graph 2 shall be published in the Official Journal of the European
Union.

This Regulation shall be binding in its entirety and directly applicable in the Member States in
accordance with the Treaty establishing the European Community.

Done at Brussels, 20 December 2006.

For the European Parliament
The President
J. BORRELL FONTELLES

For the Council
The President
J. KORKEAOJA