Council Decision 2008/633/JHA of 23 June 2008 concerning access for consultation of the Visa Information System (VIS) by designated authorities of Member States and by Europol for the purposes of the prevention, detection and investigation of terrorist offences and of other serious criminal offences
Date: 2008-06-23
Institutions: Council of the European Union
Subjects: EU visa policy, Europol, access to information, data protection, disclosure of information, information system, personal data, terrorism

13.8.2008

EN

Official Journal of the European Union

L 218/129

III

(Acts adopted under the EU Treaty)

ACTS ADOPTED UNDER TITLE VI OF THE EU TREATY

COUNCIL DECISION 2008/633/JHA

of 23 June 2008

concerning access for consultation of the Visa Information System (VIS) by designated authorities of
Member States and by Europol for the purposes of the prevention, detection and investigation of
terrorist offences and of other serious criminal offences

THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Treaty on European Union, and in particular
Article 30(1)(b) and Article 34(2)(c) thereof,

their duties in relation to the prevention, detection and
investigation of criminal offences, including terrorist acts
and threats’,
‘subject to strict compliance with the rules
governing the protection of personal data’.

Having regard to the proposal from the Commission,

Having regard to the Opinion of the European Parliament,

Whereas:

(1) Council Decision 2004/512/EC of 8 June 2004 establishing
the Visa Information System (VIS) (1) established the VIS as
a system for the exchange of visa data between Member
States. The establishment of the VIS represents one of the
key initiatives within the policies of the European Union
aimed at establishing an area of freedom, security and
justice. The VIS should have the purpose of improving the
implementation of the common visa policy and should also
contribute towards internal security and to combating
terrorism under clearly defined and monitored circum-
stances.

(2) During its meeting of 7 March 2005 the Council adopted
conclusions stating that ‘in order to achieve fully the aim of
improving internal security and the fight against terrorism’,
Member State authorities responsible for internal security
‘in the course of
should be guaranteed access to the VIS,

(1) OJ L 213, 15.6.2004, p. 5.

(3)

It is essential in the fight against terrorism and other serious
crimes for the relevant services to have the fullest and most
up-to-date information in their
respective fields. The
Member States' competent national services need informa-
tion if they are to perform their tasks. The information
contained in the VIS may be necessary for the purposes of
preventing and combating terrorism and serious crimes
and should therefore be available, subject to the conditions
set out in this Decision, for consultation by the designated
authorities.

(4) Moreover, the European Council has stated that Europol has
a key role with respect to cooperation between Member
States' authorities
in the field of cross-border crime
investigation in supporting Union-wide crime prevention,
analyses and investigation. Consequently, Europol should
also have access to VIS data within the framework of its
tasks and in accordance with the Convention of 26 July
1995 on the Establishment of a European Police Office (2).

(5)

This Decision complements Regulation (EC) No 767/2008
of the European Parliament and of the Council of 9 July
2008 concerning the Visa Information System (VIS) and
the exchange of data between Member States on 7 stay-
visas (VIS Regulation) (3) insofar as it provides for a legal
base under Title VI of the Treaty on European Union
authorising access to the VIS for designated authorities and
for Europol.

(2) OJ C 316, 27.11.1995, p. 2. Convention as last amended by the
Protocol amending that Convention (OJ C 2, 6.1.2004, p. 3).

(3) See page 60 of this Official Journal.

L 218/130

EN

Official Journal of the European Union

13.8.2008

(6)

the VIS for

the specific purposes of

It is necessary to designate the competent Member States'
authorities as well as the central access points through
which access is done and to keep a list of the operating
units within the designated authorities that are authorised
to access
the
prevention, detection and investigation of terrorist offences
and other serious criminal offences as referred to in Council
Framework Decision 2002/584/JHA of 13 June 2002 on
the European arrest warrant and the surrender procedures
between Member States (1). It is essential to ensure that the
duly empowered staff with a right to access the VIS is
limited to those who ‘have a need to know’ and possess
appropriate knowledge about data security and data
protection rules.

(7) Requests for access to the VIS should be made by the
operating units within the designated authorities to the
central access points. These central access points should
then process the requests for access to the VIS following a
verification whether all conditions for access are fulfilled. In
an exceptional case of urgency the central access points
should process the request immediately and only do the
verification afterwards.

(8)

For the purposes of protection of personal data, and in
particular to exclude routine access, the processing of VIS
data should only be on a case-by-case basis. Such a specific
case exists in particular when the access for consultation is
connected to a specific event or to a danger associated with
serious crime, or to (a) specific person(s)
in respect of
whom there are serious grounds for believing that the
person(s) will commit or has (have) committed terrorist
offences or other serious criminal offences or that the
person(s) has (have) a relevant connection with such (a)
person(s). The designated authorities and Europol should
thus only search data contained in the VIS when they have
reasonable grounds to believe that such a search will
provide information that will substantially assist them in
preventing, detecting or investigating serious crime.

(9) Once the proposed Framework Decision on the protection
of personal data processed in the framework of police and
judicial cooperation in criminal matters has entered into
force it should apply to the personal data which are
processed pursuant to this Decision. However, until the
rules set out in that Framework Decision are applicable and
in order to supplement them, adequate provisions have to
be provided for to ensure the necessary data protection.
Each Member State should ensure an adequate data
protection level
least
corresponds to that resulting from the Council of Europe
Convention of 28 January 1981 for the Protection of
Individuals with regard to Automatic Processing of Personal
Data and the corresponding case law pursuant to Article 8
of the Convention for the Protection of Human Rights and
Fundamental Freedoms and, for those Member States which

in its national

law which at

(1) OJ L 190, 18.7.2002, p. 1.

have ratified it, the Additional Protocol of 8 November
2001 to that Convention, and should take into account
Recommendation No R (87) 15 of 17 September 1987 of
the Committee of Ministers of
the Council of Europe
Regulating the Use of Personal Data in the Police Sector.

(10) The effective monitoring of the application of this Decision

should be evaluated at regular intervals.

(11) Since the objectives of this Decision, namely the creation of
obligations and conditions for access for consultation of
VIS data by Member States' designated authorities and by
Europol, cannot be sufficiently achieved by the Member
States and can, therefore, by reason of the scale and effects
of the action, be better achieved at the level of the European
Union, the Council may adopt measures in accordance with
the principle of subsidiarity, referred to in Article 2 of the
Treaty on European Union and defined in Article 5 of the
In accor-
Treaty establishing the European Community.
dance with the principle of proportionality, as set out in
that Article, this Decision does not go beyond what is
necessary in order to achieve those objectives.

(12)

In accordance with Article 47 of the Treaty on European
Union, this Decision does not affect the competences of the
exercised in
European Community,
Regulation (EC) No 767/2008 and in Directive 95/46/EC
of
the Council of
24 October 1995 on the protection of individuals with
regard to the processing of personal data and on the free
movement of such data (2).

the European Parliament and of

in particular

as

(13) This Decision constitutes a development of provisions of
the Schengen acquis in which the United Kingdom does not
take part
in accordance with Council Decision 2000/
365/EC of 29 May 2000 concerning the request of the
United Kingdom of Great Britain and Northern Ireland to
take part
the Schengen
acquis (3). The United Kingdom is therefore not taking part
in its adoption and is not bound by it or subject to its
application.

the provisions of

in some of

(14) This Decision constitutes a development of provisions of
the Schengen acquis in which Ireland does not take part in
accordance with Council Decision 2002/192/EC of 28 Feb-
ruary 2002 concerning Ireland's request to take part in
some of the provisions of the Schengen acquis (4). Ireland is
therefore not taking part in its adoption and is not bound
by it or subject to its application.

(2) OJ L 281, 23.11.1995, p. 31. Directive as amended by Regulation

(EC) No 1882/2003 (OJ L 284, 31.10.2003, p. 1).

(3) OJ L 131, 1.6.2000, p. 43.
(4) OJ L 64, 7.3.2002, p. 20.

13.8.2008

EN

Official Journal of the European Union

L 218/131

the Member States of

(15) However, in accordance with Council Framework Decision
2006/960/JHA of 18 December 2006 on simplifying the
information and intelligence between law
exchange of
enforcement authorities of
the
European Union (1), information contained in the VIS can
be provided to the United Kingdom and Ireland by the
competent authorities of
the Member States whose
designated authorities have access to the VIS pursuant to
this Decision. Information held in the national visa registers
of the United Kingdom and Ireland can be provided to the
the other
law enforcement authorities of
competent
Member States. Any form of direct access for central
authorities of the United Kingdom and Ireland to the VIS
would, under the present state of their participation in the
require an agreement between the
Schengen acquis,
Community and those Member States, possibly to be
supplemented by other rules specifying the conditions and
procedures for such access.

(16) As regards Iceland and Norway, this Decision constitutes,
with the exception of Article 7, a development of provi-
sions of the Schengen acquis within the meaning of the
the European
Agreement concluded by the Council of
Union and the Republic of Iceland and the Kingdom of
Norway concerning the association of those two States with
the implementation, application and development of the
Schengen acquis (2) which fall within the area referred to in
Article 1, point B of Council Decision 1999/437/EC (3) on
certain arrangements for the application of that Agreement.

(17) As regards Switzerland, this Decision constitutes, with the
exception of Article 7, a development of the provisions of
the Schengen acquis within the meaning of the Agreement
signed by the European Union, the European Community
and the Swiss Confederation concerning the association of
the Swiss Confederation with the implementation, applica-
tion and development of the Schengen acquis which fall
within the area referred to in Article 1, point B of Decision
1999/437/EC read in conjunction with Article 4(1) of
Council Decision 2004/849/EC (4).

(18) This Decision, save Article 6, constitutes an act building on
the Schengen acquis or otherwise related to it within the
meaning of Article 3(2) of the 2003 Act of Accession and
Article 4(2) of the 2005 Act of Accession.

HAS DECIDED AS FOLLOWS:

Article 1

Subject matter and scope

This Decision lays down the conditions under which Member
States' designated authorities and the European Police Office
(Europol) may obtain access for consultation of
the Visa
Information System (VIS) for the purposes of the prevention,
detection and investigation of terrorist offences and of other
serious criminal offences.

Article 2

Definitions

For the purposes of this Decision, the following definitions

1.
shall apply:

(a)

(b)

(c)

(d)

(e)

‘Visa Information System (VIS)’ means the Visa Information
System as established by Decision 2004/512/EC;

‘Europol’ means the European Police Office as established
by the Convention of 26 July 1995 on the Establishment of
a European Police Office (the Europol Convention);

‘terrorist offences’ means the offences under national law
which correspond or are equivalent to the offences in
Articles 1 to 4 of Council Framework Decision 2002/475/
JHA of 13 June 2002 on combating terrorism (5);

‘serious criminal offences’ means the forms of crime which
correspond or are equivalent
to those referred to in
Article 2(2) of Framework Decision 2002/584/JHA;

authorities which are
‘designated authorities’ means
responsible for the prevention, detection or investigation
of terrorist offences or of other serious criminal offences
and designated by the Member States pursuant to Article 3.

2. The definitions in Regulation (EC) No 767/2008 shall also
apply.

Article 3

(19) This Decision respects the fundamental rights and observes
the principles reflected in particular in the Charter of
Fundamental Rights of the European Union,

(1) OJ L 386, 18.12.2006, p. 89.
(2) OJ L 176, 10.7.1999, p. 36.
(3) OJ L 176, 10.7.1999, p. 31.
(4) Decision 2004/849/EC of 25 October 2004 on the signing, on
behalf of the European Union, and on the provisional application of
certain provisions of the Agreement between the European Union,
the European Community and the Swiss Confederation concerning
the Swiss Confederation's association with the implementation,
application and development of the Schengen acquis (OJ L 368,
15.12.2004, p. 26).

Designated authorities and central access points

1. Member States shall designate the authorities referred to in
Article 2(1)(e) which are authorised to access VIS data pursuant
to this Decision.

Every Member State shall keep a list of the designated
2.
authorities. By 2 December 2008 every Member State shall
notify in a declaration to the Commission and the General
Secretariat of the Council their designated authorities and may at
any time amend or replace its declaration by another declaration.

(5) OJ L 164, 22.6.2002, p. 3.

L 218/132

EN

Official Journal of the European Union

13.8.2008

Every Member State shall designate the central access
3.
point(s) through which the access is done. Member States may
designate more than one central access point to reflect their
organisational and administrative structure in fulfilment of their
constitutional or legal requirements. By 2 December 2008 every
Member State shall notify in a declaration to the Commission
and the General Secretariat of the Council their central access
point(s) and may at any time amend or replace its declaration by
another declaration.

4. The Commission shall publish the declarations referred to in
paragraphs 2 and 3 in the Official Journal of the European Union.

(c)

there are reasonable grounds to consider that consultation
of VIS data will substantially contribute to the prevention,
detection or investigation of any of the criminal offences in
question.

2. Consultation of the VIS shall be limited to searching with
any of the following VIS data in the application file:

(a)

surname,
name(s); sex; date, place and country of birth;

surname at birth (former

surname(s));

first

(b)

current nationality and nationality at birth;

5. At national level, each Member State shall keep a list of the
operating units within the designated authorities
that are
authorised to access the VIS through the central access point(s).

(c)

type and number of the travel document, the authority
which issued it and the date of issue and of expiry;

6. Only duly empowered staff of the operational units as well
as the central access point(s) shall be authorised to access the VIS
in accordance with Article 4.

(d) main destination and duration of the intended stay;

(e)

purpose of travel;

Article 4

(f)

intended date of arrival and departure;

Procedure for access to the VIS

(g)

intended border of first entry or transit route;

1. Where the conditions of Article 5 are fulfilled the operating
units referred to in Article 3(5) shall submit a reasoned written
or electronic request to the central access points referred to in
Article 3(3) to access the VIS. Upon receipt of a request for access
the central access point(s) shall verify whether the conditions for
access referred to in Article 5 are fulfilled. If all conditions for
access are fulfilled, the duly authorised staff of the central access
point(s) shall process the requests. The VIS data accessed shall be
transmitted to the operating units referred to in Article 3(5) in
such a way as not to compromise the security of the data.

In an exceptional case of urgency, the central access point(s)
2.
may receive written, electronic or oral requests. In such cases, the
central access point(s) shall process the request immediately and
only verify ex-post whether all the conditions of Article 5 are
fulfilled,
including whether an exceptional case of urgency
existed. The ex-post verification shall take place without undue
delay after the processing of the request.

(h)

residence;

(i)

fingerprints;

(j)

type of visa and the number of the visa sticker;

(k)

details of the person issuing an invitation and/or liable to
pay the applicant's subsistence costs during the stay.

3. Consultation of the VIS shall, in the event of a hit, give
access to all of the data listed in paragraph 2 as well as to:

(a)

any other data taken from the application form;

(b)

photographs;

Article 5

(c)

the data entered in respect of any visa issued, refused,
annulled, revoked or extended.

Conditions for access to VIS data by designated authorities
of Member States

Article 6

1. Access to the VIS for consultation by designated authorities
shall take place within the scope of their powers and if the
following conditions are met:

(a)

access for consultation must be necessary for the purpose
of the prevention, detection or investigation of terrorist
offences or other serious criminal offences;

Conditions for access to VIS data by designated authorities
of a Member State in respect of which Regulation (EC) No
767/2008 has not yet been put into effect

1. Access to the VIS for consultation by designated authorities
of a Member State in respect of which Regulation (EC) No 767/
2008 has not yet been put into effect shall take place within the
scope of their powers and

(b)

access for consultation must be necessary in a specific case;

(a)

subject to the same conditions as referred to in Article 5(1);
and

13.8.2008

EN

Official Journal of the European Union

L 218/133

(b)

by a duly motivated written or electronic request to a
designated authority of a Member State to which Regulation
(EC) No 767/2008 applies; that authority shall then request
the national central access point(s) to consult the VIS.

2. A Member State in respect of which Regulation (EC) No
767/2008 has not yet been put into effect shall make its visa
information available to Member States to which Regulation (EC)
No 767/2008 applies, on the basis of a duly reasoned written or
electronic request, subject to compliance with the conditions laid
down in Article 5(1).

3. Article 8(1) and (3) to (6), Article 9(1), Article 10(1) and (3),
Article 12, Article 13(1) and (3) shall apply accordingly.

Article 7

Conditions for access to VIS data by Europol

processing of personal data consulted under this Decision, each
Member State shall ensure an adequate data protection level in its
national law which at least corresponds to that resulting from the
Council of Europe Convention of 28 January 1981 for the
Protection of Individuals with regard to Automatic Processing of
Personal Data and, for those Member States which have ratified
the Additional Protocol of 8 November 2001 to that
it,
Convention, and shall
take into account Recommendation
No R (87)15 of 17 September 1987 of the Committee of
Ministers of
the Council of Europe Regulating the Use of
Personal Data in the Police Sector.

2. The processing of personal data by Europol pursuant to this
Decision shall be in accordance with the Europol Convention
and the rules adopted in implementation thereof and supervised
by the independent
joint supervisory body established by
Article 24 of the Convention.

1. Access to the VIS for consultation by Europol shall take
place within the limits of its mandate and:

Personal data obtained pursuant to this Decision from the
3.
VIS shall only be processed for the purposes of the prevention,
detection, investigation and prosecution of terrorist offences or
other serious criminal offences.

(a) when necessary for the performance of its tasks pursuant to
Article 3(1), point 2 of the Europol Convention and for the
purposes of a specific analysis as referred to in Article 10 of
the Europol Convention; or

(b) when necessary for the performance of its tasks pursuant to
Article 3(1), point 2 of the Europol Convention and for an
analysis of a general nature and of a strategic type, as
the Europol Convention,
referred to in Article 10 of
provided that VIS data is rendered anonymous by Europol
prior to such processing and retained in a form in which
identification of the data subjects is no longer possible.

2. Article 5(2) and (3) shall apply accordingly.

3.
Europol shall designate a specialised unit for the purpose of
this Decision with duly empowered Europol officials to act as the
central access point to access the VIS for consultation.

4.
Processing of information obtained by Europol from access
to the VIS shall be subject to the consent of the Member State
which has entered that data in the VIS. Such consent shall be
obtained via the Europol national unit of that Member State.

Article 8

Protection of personal data

4.
Personal data obtained pursuant to this Decision from the
VIS shall not be transferred or made available to a third country
or to an international organisation. However, in an exceptional
case of urgency such data may be transferred or made available
to a third country or an international organisation, exclusively
for the purposes of the prevention and detection of terrorist
offences and of other serious criminal offences and under the
conditions set out in Article 5(1) of this Decision, subject to the
consent of the Member State having entered the data into the VIS
and in accordance with the national law of the Member State
transferring the data or making them available. In accordance
with national law, Member States shall ensure that records are
kept of such transfers and make them available to national data
protection authorities on request. The transfer of data by the
Member State that entered the data in the VIS according to
Regulation (EC) No 767/2008 shall be subject to the national law
of that Member State.

5. The competent body or bodies which, in accordance with
national law, are charged with the supervision of the processing
of personal data by the authorities designated under
this
the processing of
Decision shall monitor the lawfulness of
personal data pursuant to this Decision. The Member States shall
ensure that these bodies have sufficient resources to fulfil the
tasks entrusted to them under this Decision.

1. The processing of personal data consulted under
this
Decision shall be subject to the following rules and to the
national law of the consulting Member State. With regard to the

6. The bodies referred to in paragraph 5 shall ensure that at
least every four years an audit of the processing of personal data
to this Decision is carried out, where applicable
pursuant
according to international auditing standards.

L 218/134

EN

Official Journal of the European Union

13.8.2008

7. Member States and Europol shall allow the competent body
or bodies referred to in paragraphs 2 and 5 to obtain the
necessary information to enable them to carry out their tasks in
accordance with this Article.

8. Before being authorised to process data stored in the VIS, the
staff of the authorities having a right to access the VIS shall
receive appropriate training about data security and data
protection rules and shall be informed of any relevant criminal
offences and penalties.

(i)

(j)

ensure that it is possible to verify and establish what data
has been retrieved from the VIS, when, by whom and for
what purpose (control of data recording);

prevent the unauthorised reading and copying of personal
data during their transmission from the VIS, in particular
by means of appropriate encryption techniques (transport
control);

Article 9

Data security

(k) monitor the effectiveness of the security measures referred
to in this paragraph and take the necessary organisational
measures related to internal monitoring to ensure com-
pliance with this Decision (self-auditing).

1. The Member State responsible shall ensure the security of
the data during transmission to the designated authorities and
when received by them.

Each Member State shall adopt

the necessary security
2.
measures with respect to data to be retrieved from the VIS
pursuant to this Decision and to be subsequently stored,
in
particular in order to:

(a)

physically protect data, including by making contingency
plans for the protection of critical infrastructure;

(b)

deny unauthorised persons access to national installations
in which the Member State stores data (checks at entrance
to the installation);

(c)

prevent the unauthorised reading, copying, modification or
removal of data media (data media control);

Article 10

Liability

1. Any person who, or Member State which, has suffered
damage as a result of an unlawful processing operation or any act
incompatible with this Decision shall be entitled to receive
compensation from the Member State which is responsible for
the damage suffered. That Member State shall be exempted from
if it proves that it is not
its liability,
responsible for the event giving rise to the damage.

in whole or in part,

If any failure of a Member State to comply with its
2.
obligations under this Decision causes damage to the VIS, that
Member State shall be held liable for such damage, unless and
insofar as another Member State failed to take reasonable
measures to prevent the damage from occurring or to minimise
its impact.

(d)

prevent
deletion of stored personal data (storage control);

the unauthorised inspection, modification or

3. Claims for compensation against a Member State for the
damage referred to in paragraphs 1 and 2 shall be governed by
the provisions of national law of the defendant Member State.

(e)

(f)

(g)

prevent the unauthorised processing of data from the VIS
(control of data processing);

ensure that persons authorised to access the VIS have access
only to the data covered by their access authorisation, by
means of
identities and
individual and unique user
confidential access modes only (data access control);

ensure that all authorities with a right of access to the VIS
create profiles describing the functions and responsibilities
of persons who are authorised to access and search the data
and make these profiles available to the national super-
visory authorities referred to in Article 8(5) without delay
upon their request (personnel profiles);

Article 11

Self-monitoring

Member States shall ensure that each authority entitled to access
VIS data takes the measures necessary to comply with this
Decision and cooperates, where necessary, with the national
body or bodies referred to in Article 8(5).

Article 12

Penalties

(h)

ensure that it is possible to verify and establish to which
bodies personal data may be transmitted using data
communication equipment (communication control);

Member States shall take the necessary measures to ensure that
any use of VIS data contrary to the provisions of this Decision is
punishable by penalties, including administrative and/or criminal
penalties, that are effective, proportionate and dissuasive.

13.8.2008

EN

Official Journal of the European Union

L 218/135

Article 13

Keeping of VIS data in national files

1. Data retrieved from the VIS may be kept in national files
only when necessary in an individual case in accordance with the
purposes set out in this Decision and in accordance with the
relevant
including those concerning data
protection and for no longer than necessary in the individual
case.

legal provisions

2.
Paragraph 1 shall not prejudice the provisions of national
law of a Member State concerning the entry by its designated
authorities in their national files of data which that Member State
entered in the VIS according to Regulation (EC) No 767/2008.

the
7. The individual concerned shall be informed about
follow-up given to the exercise of his rights of correction and
deletion as soon as possible and in any event not later than three
months from the date on which he applies for correction or
deletion or sooner if national law so provides.

8.
In each Member State any person shall have the right to
bring an action or a complaint before the competent authorities
or courts of that Member State which refused the right of access
to or the right of correction or deletion of data relating to him,
provided for in this Article.

Article 15

Costs

3. Any use of data which does not comply with paragraphs 1
and 2 shall be considered a misuse under the national law of each
Member State.

Each Member State and Europol shall set up and maintain, at
their expense, the technical infrastructure necessary to imple-
ment this Decision, and be responsible for bearing the costs
resulting from access to the VIS for the purposes of this Decision.

Article 14

Right of access, correction and deletion

Article 16

Keeping of records

1. The right of persons to have access to data relating to them
obtained from the VIS pursuant
to this Decision shall be
exercised in accordance with the law of the Member State in
which they invoke that right.

If national

2.
supervisory
authority shall decide whether information is to be commu-
nicated and by what procedures.

law so provides,

the national

1.
Each Member State and Europol shall ensure that all data
processing operations resulting from access to the VIS for
consultation pursuant to this Decision are recorded for the
purposes of checking whether the search is admissible or not, for
the purpose of monitoring the lawfulness of data processing, for
self-monitoring, ensuring the proper functioning of the system,
data integrity and security.

Those records shall show:

3. A Member State other than that which has entered the data
into the VIS according to Regulation (EC) No 767/2008 may
communicate information concerning such data only if it first
gives the Member State entering the data an opportunity to state
its position.

(a)

the exact purpose of the access for consultation referred to
in Article 5(1)(a), including the form of terrorist offence or
other serious criminal offence concerned, and for Europol,
the exact purpose of the access for consultation referred to
in Article 7(1);

4.
Information shall not be communicated to the data subject if
this is indispensable for the performance of a lawful task in
connection with the data or for the protection of the rights and
freedoms of third parties.

(b)

the respective national file reference;

(c)

the date and exact time of access;

5. Any person has the right to have factually inaccurate data
relating to him corrected or unlawfully stored data relating to
him deleted. If the designated authorities receive such a request
or if they have any other evidence to suggest that data processed
in the VIS is inaccurate they shall immediately inform the visa
authority of the Member State which has entered the data in the
VIS, which shall check the data concerned and,
if necessary,
to Article 24 of
correct or delete it immediately, pursuant
Regulation (EC) No 767/2008.

(d) where applicable that use has been made of the procedure

referred to in Article 4(2);

(e)

the data used for consultation;

(f)

the type of data consulted;

6. The individual concerned shall be informed as soon as
possible and in any event not later than 60 days from the date on
which he applies for access or sooner if national law so provides.

(g)

according to national rules or the rules of the Europol
Convention the identifying mark of the official who carried
out the search and of the official who ordered the search or
supply.

L 218/136

EN

Official Journal of the European Union

13.8.2008

2. Records containing personal data shall be used only for the
data protection monitoring of the legality of data processing as
well as to ensure data security. Only records containing data of a
non-personal nature may be used for the monitoring and
evaluation referred to in Article 17.

3. These records shall be protected by appropriate measures
against unauthorised access and abuse and deleted after a period
of one year after the retention period referred to in Article 23(1)
of Regulation (EC) No 767/2008 has expired, unless they are
required for monitoring procedures referred to in paragraph 2 of
this Article which have already begun.

Article 17

Monitoring and evaluation

1. The Management Authority referred to in Regulation (EC)
No 767/2008 shall ensure that systems are in place to monitor
the functioning of the VIS pursuant to this Decision against
objectives, in terms of output, cost-effectiveness, security and
quality of service.

For the purpose of technical maintenance, the Management
2.
Authority shall have access to the necessary information relating
to the processing operations performed in the VIS.

to the European Parliament,

3. Two years after the VIS is brought into operation and every
two years thereafter, the Management Authority shall submit a
report
the Council and the
Commission on the technical functioning of the VIS pursuant
to this Decision. That report shall include information on the
performance of the VIS against quantitative indicators predefined
by the Commission, and in particular on the need and use made
of Article 4(2).

4. Three years after the VIS is brought into operation and every
four years thereafter, the Commission shall produce an overall
evaluation of the VIS pursuant to this Decision. This evaluation
shall
include an examination of the results achieved against
objectives and an assessment of the continuing validity of the
underlying rationale behind this Decision, the application of this
Decision in respect of the VIS, the security of the VIS and any
future operations. The Commission shall
implications

for

transmit the evaluation reports to the European Parliament and
the Council.

5. The Member States and Europol shall provide to the
Management Authority and the Commission the information
necessary to draft the reports referred to in paragraph 3 and 4.
This information shall not jeopardise working methods nor
include information that reveals sources, staff members or
investigations of the designated authorities.

6. The Management Authority shall provide the Commission
with the information necessary to produce the overall evalua-
tions referred to in paragraph 4.

7. During the transitional period before the Management
Authority takes up its responsibilities, the Commission shall be
responsible for producing and submitting the reports referred to
in paragraph 3.

Article 18

Entry into force and date of application

1. This Decision shall enter into force on the 20th day
following its publication in the Official Journal of the European
Union.

2. This Decision shall take effect from a date to be determined
by the Council once the Commission has informed the Council
that Regulation (EC) No 767/2008 has entered into force and is
fully applicable.

The General Secretariat of the Council shall publish that date in
the Official Journal of the European Union.

Done at Luxembourg, 23 June 2008.

For the Council

The President

I. JARC