COMMISSION STAFF WORKING DOCUMENT DETAILED EXPLANATION OF THE PROPOSAL BY CHAPTERS AND ARTICLES Accompanying the document Proposal for a Regulation of the European Parliament and of the Council
Date: 2013-02-28
Institutions: European Commission
Subjects: Schengen Information System, border control, data collection, exchange of information, external border of the EU, foreign national, traveller

EUROPEAN 
COMMISSION 

Brussels, 28.2.2013  
SWD(2013) 49 final 

COMMISSION STAFF WORKING DOCUMENT 

DETAILED EXPLANATION OF THE PROPOSAL BY CHAPTERS AND ARTICLES

Accompanying the document 

Proposal for a Regulation of the European Parliament and of the Council 

{COM(2013) 95} 
{SWD(2013) 47} 
{SWD(2013) 48}

EN 

   EN 

 
 
 
 
 
  
 
COMMISSION STAFF WORKING DOCUMENT 

DETAILED EXPLANATION OF THE PROPOSAL BY CHAPTERS AND ARTICLES 

Accompanying the document 

Proposal for a Regulation of the European Parliament and of the Council 

•  Detailed explanation of the proposal by Chapters and Articles 

Chapter  One  lays  down  the  subject  matter  of  the  Regulation,  the  purpose  and  scope  of  the 
EES,  the  principles  as  regards  the  data  to  be  recorded,  the  access  to  the  data,  the  alert 
mechanism and the definitions. 

Chapter  Two  details  the  procedures  for  entering  the  data  and  the  use  of  data  by  border 
authorities.  

Chapter  Three  is  dedicated  to  the  access  to  the  data  by  other  authorities,  whereas  Chapter 
Four lays down the rules for the retention and amendment of the data.  

Chapter  Five  specifies  the  rules  on  the  operational  management  and  defines  the  technical 
architecture.  It  also  lays  down  the  responsibilities  for  the  use  of  the  data  and  data  security, 
including rules on the keeping of records and penalties. 

Chapter Six concerns data protection rights and supervision. Whereas Directive 95/46/EC and 
Regulation  (EC)  No  45/2001  fully  apply  for  this  Regulation,  the  provisions  of  this  chapter 
clarify certain points related to the safeguard of the rights of data subjects and the roles of the 
national supervisory authorities and the European Data Protection Supervisor. 

Chapter  Seven  covers  the  start  of  transmission  and  operation,  the  set  up  of  a  Committee  to 
assist the Commission when adopting implementing measures, the monitoring and evaluation, 
the entry into force and the applicability of this Regulation. 

Chapter I: General provisions 

Article 1 establishes the objective of the Regulation and the core functions of the EES.  

Article 2 entrusts the Agency with the tasks of development and operational management of 
the EES.  

Article 3 establishes the scope of the EES and list the exceptions to its applicability. 

Article  4  defines  the  purpose  and  specific  objectives  of  the  EES  and  how  the  system  will 
assist authorities in the Member States in pursuing such objectives. The purpose is limited to 
border and migration management, thus excluding the fight against serious crime. 

The definitions in Article 5 refer to the EU legislation and correspond to the definitions used 
in  the  Regulation  of  the  European  Parliament  and  of  the  Council  (EC)  No  562/2006 
establishing  a  Community  Code  on  the  rules  governing  the  movement  of  persons  across 
borders  (Schengen  Borders  Code),  the  Regulation  of  the  European  Parliament  and  of  the 
Council (EC) No 767/2008 concerning the Visa Information System (VIS) and the exchange 
of  data  between  Member  States  on  short-stay  visas  (VIS  Regulation),  the  Regulation  of  the 
European Parliament and of the Council (EC) No 810/2009 establishing a Community Code 
on  Visas  and  the  Regulation  of  the  European  Parliament  and  of  the  Council  (EC)  No 
1077/2011 establishing a European Agency for the operational management of large-scale IT 
systems in the area of freedom, security and justice. 

EN 

2 

   EN 

 
Article 6 sets out the architecture of the EES.  

Article  7  lays  down  the  rules  for  entering,  amending,  deleting  and  consulting  data  by  the 
authorities in Member States. These authorities should be designated by the Member states in 
accordance  with  national  law.  As  concerns  authorities  responsible  for  carrying  out  border 
checks and checks whithin the territory, this will be the police and/or border guard authorities 
of  the  Member  States.  These  authorities  must  however  respect  the  purpose  limitation  as 
defined in Article 2 when accessing the data in the EES. 

Article  8  enunciates  the  general  principles  with  regard  to  data  protection  and  non 
discrimination. 

Article 9 describes the automated calculator that should be integrated in the EES to indicate 
the duration of stay authorised in each case. 

Article  10  defines  the  mechanism  by  which  alerts  of  overstaying  are  addressed  to  national 
authorities. 

Chapter II: Entry and use of data by border authorities  

Article 11 paragraph 1 refers to the creation of the individual file and lists the personal data to 
be entered for visa holders while paragraphs 2 and 3  list the  data that  should be entered on 
entry and exit and linked to an individual file already created. 

Article  12  refers  to  the  additional  biometric  data  that  should  be  entered  for  third  country 
nationals exempted from the visa obligation and the specific cases where fingerprints would 
not  be  required.  The  number  of  fingerprints to be enrolled on first entry into the Entry/Exit 
System  should  be  ten,  if  physically  possible.  As  is  the  case  with  VIS,  enrolling  ten 
fingerprints  would  allow  for  more  accurate  verifications  and  identifications,  due  to  the 
expected  size  of  the  EES.  The  storage  of  fingerprints  data  for  ten  fingers  guarantees  that 
sufficient  data  is  available  in  every  circumstance,  while  keeping  the  amount  of  data  to  a 
reasonable level. Storing less fingerprints might cause problems for the travellers and border 
authorities  at  the  external  borders  as  fingerprints  may  be  smudged,  distorted  or  fragmented. 
Paragraph  5  clarifies  that  only  alphanumeric  data  should  be  recorded  during  the  first  three 
years after the EES starts operation. 

Article 13 establishes the procedure for entering the data at the border crossing points.  

Article  14  sets  out  the  obligation  of  authorites  to  update  the  information  in  the  entry/exit 
records in case there are changes in the authorisation to stay. Article 15 lays down the rules on 
the access and use of the data by border authorites for border control purposes.  

Chapter III: Access to data by other authorities 

Article  16  ensures  that  competent  visa  authorities  consult  the  EES  prior  to  any  decision  on 
visa applications, including the decisions to annul, revoke or extend the period of validity of 
an issued visa. Paragraph 2 identifies the search keys that can be used by visa authorities and 
paragraph 3 lays down the rules on the consultation of existing files. 

Similar  rules  on  the  use  of  the  data  by  the  competent  authorities  in  charge  of  examining 
applications for the access to the RTP are enshrined in Article 17. 

Article 18 deals with the access to the EES for the purpose of verifying whether third-country 
nationals found whithin the territory of the Member States fulfill the conditions for the entry 
or  stay  on  that  territory  while  Article  19  refers  to  the  access  to  the  EES  for  the  purpose  of 
identification  of  any  third  country  national  who  may  not  or  may  no  longer  fulfill  such 
conditions.  

EN 

3 

   EN 

 
CHAPTER IV: Retention and amendment of the data  

Article  20  paragraph  1  covers  the  retention  period  for  data  storage  which  is  the  minimum 
period  taking  into  account  the  purposes  of  the  EES,  allowing  for  calculating  all  short  stays 
during a period of 180 days and verifying if the maximum of 90 days is respected.  

Paragraph 2 deals with the need to extend such period in the case of overstayers. If a person is 
signalled  as  not  having  left  the  Schengen  after  six  months,  the  data  needs  to  be  kept,  in 
principle,  until  the  person  does  so,  has  been  detected  within  the  territory,  or  has  obtained  a 
legal reason to stay. Nevertheless, it is considered proportionate to delete the data after five 
years even if none of the above events have occurred.  

Paragraph  1  of  Article  21  enunciates  the  right  of  the  competent  authorites  of  the  Member 
States to amend the data in the EES. Paragraph 2 introduces the obligation of these authorities 
to delete the information on overstayers referred to in Article 10 in case the person concerned 
proves that such situation was unavoidable.  

Article 22 stipulates that all records should be deleted in the event that this Regulation should 
no longer be applicable to the person because of changes in his/her status. 

CHAPTER V: Development, Operation and Responsibilities 

Article  23  paragraph  1  establishes  the  measures  that  the  Commission  shall  adopt  before 
entrusting  the  development  of  the  EES  to  the  Agency.  Paragraph  2  defines  the  role  of  the 
Agency – the development and operational management of the Central EES and the Uniform 
Interfaces. Paragraph 3 clarifies that the Commission shall adopt the technical specifications 
prepared by the Agency as implementing measures with comitology. 

Artcile 24 lists the specific responsibilities of the Agency.  

Article 25 creates in paragraphs 1 to 3 the obligation for each Member State to connect to the 
EES via the Network Entry Point, to designate a national authority to provide the access for 
the  competent  authorities  and  to  observe  automated  procedures  for  processing  the  data. 
Paragraph  4  emphasises  the  need  for  training  of  staff  before  they  are  authorised  to  process 
data  stored  in  the  EES.  Paragraph  5  clarifies  the  burden  for  the  related  costs,  including  the 
competence for the development of the National System and/or its adaptation to the EES.  

Article 26 sets out in paragraph 1 the responsibilities of the Member States for the use of the 
data, acting as a controller at the moment of collection, transmission and reception of personal 
data. Paragraph 2 creates obligations for the Agency with regard to security and with regard to 
confidentiality, the latter pursuant to Articles 16 and 17 of Directive 95/46/EC and Articles 21 
and  22  of  Regulation  (EC)  No  45/2001.  Paragraph  3  provides  for  information  of  the 
Parliament and the Council. 

Article  27  provides  that  personal  data  stored  in  the  EES  cannot  be  communicated  to  third 
countries, international organisations or private parties. Communication to third countries or 
to an international organisation listed in the Annex would only be possible in individual cases 
for  identification  purposes  and  under  specific  conditions,  including  data  protection 
requirements. 

Article 28 deals with data security, indicating the obligations of the Member States as well as 
of the Agency in this regard 

Article 29 sets out the applicable rules on liability of Member States for damages. 

Article  30  creates  the  obligation  for  the  Member  States  and  the  Agency  to  keep  complete 
records of data processing operations for one year after expiry of the retention period, which 

EN 

4 

   EN 

 
may  solely  be  used  for  the  purposes  of  the  monitoring  of  data  protection  and  of  the 
monitoring of data security. 

Article  31  obliges  Member  States'  authorities  entitled  to  access  EES  to  carry  out  self-
monitoring and to co-operate, where necessary, with the Supervisory Authority. 

Article 32 creates the obligation for each Member State to enforce the proper processing and 
use  of  data  by  appropriate  penalties,  as  an  essential  complement  to  the  data  protection  and 
security arrangements. 

CHAPTER VI: Rights and supervision on data protection 

For the protection of personal data, the relevant Community’s legislation, Directive 95/46/EC 
and Regulation (EC) 45/2001, fully apply for this instrument. The provisions in this chapter 
clarify certain points in respect of safeguarding the rights of the persons concerned and of the 
supervision on data protection.  

Article 33 covers the right of information of third-country nationals whose data shall be stored 
in  the  EES  pursuant  to  Article  3.  Paragraph  1  contains  in  conformity  with  Article  10  of 
Directive 95/46/EC a list of items the person concerned has to be informed about. Paragraph 2 
specifies  that  the  information  shall  be  provided  in  writing.  Paragraph  3  refers  to  the  form 
mentioned in Article 9(4).  

Article 34 in paragraphs 1 and 2 provides any person with the rights of access, correction and 
deletion of data relating to him which are inaccurate or recorded unlawfully, and clarifies in 
paragraph 3 that the related request may be lodged in any Member State. Paragraphs 4 to 6 
specify the requirements according to Article 12 of Directive 95/46/EC. 

Article  35  lays  down  an  obligation  for  the  competent  authorities  to  ensure  the  proper 
operation  of  the  mechanism  laid  down  in  Article  33  and  the  assistance  and  advice  by  the 
national supervisory authority, specifying the obligations laid down in Article 28(4) and (6) of 
Directive 95/46/EC.  

Article  36  clarifies  pursuant  to  Article  22  of  Directive  95/46/EC  the  right  of  any  person  to 
remedies  before  the  courts  of  each  Member  State  if  the  rights  of  access  to  or  correction  or 
deletion of data relating to him/her is refused. 

Article  37  clarifies  the  competence  of  the  national  supervisory  authorities  to  review  the 
lawfulness  of  all  the  processing  operations  carried  out  by  the  Member  States.  It  lays  down 
rules on audit and obliges Member States to designate a controller. Furthermore, it specifies 
the information which shall be supplied to national supervisory authorities.  

Article 38 provides that the European Data Protection Supervisor established by Article 41(1) 
of  Regulation  (EC)  No  45/2001  shall  monitor  the  activities  of  the  Agency  related  to  the 
processing  of  personal  data  covered  by  this  Regulation.  Paragraph  2  specifies  the  European 
Data  Protection  Supervisor's  role  on  the  Agency's  audit  which  shall  be  carried  out  at  least 
every four years. Paragraph 3 creates obligations to support this audit and monitoring. 

Article  39  creates  obligations  for  the  Supervisory  Authorities  and  the  European  Data 
Protection  Supervisor  to  co-operate.  They  shall  meet  at  least  twice  a  year  and  send  a  joint 
report of activities to the European Parliament, the Council, the Commission and the Agency 
every two years. 

CHAPTER VII: Final provisions 

Article 40 lists the anonymised data that might be consulted for the purposes of reporting and 
statistics.  

EN 

5 

   EN 

 
Article 41 connects the start of transmission of data to the notification of each Member State 
to  the  Commission  that  it  has  made  the  necessary  technical  and  legal  arrangements  for  the 
transmission  of  data  to  the  central  repository  and  that  the  Agency  has  made  necessary 
technical arrangements.  

Article  42  establishes  a  Committee  to  assist  the  Commission  with  its  responsibilities  under 
Article 23.  

Article 43 details the information which Member States and the Agency shall make available 
to the Commission. 

Article 44 establishes an Advisory Group to assist the Commission with the expertise related 
to the system. 

Article 45 tasks the Agency with the training referred to in Article 25(4).  

Article 46 creates the obligation for the Agency to monitor and evaluate the operation of the 
EES  and  produce  monitoring  and  evaluation  reports,  to  be  submitted  to  the  European 
Parliament,  the  Council  and  the  Commission.  Furthermore,  it  creates  the  obligation  for  the 
Commission to produce an overall evaluation of the EES, the first after two years of operation 
specially  dedicated  to  examining  the  possible  access  to  law  enforcement  authorities  and  the 
retention  period.  Paragraphs  6  and  7  oblige  Member  States  and  the  Agency  to  provide  the 
information necessary to produce the evaluation.  

Article 47 concerns the entry into force and applicability. Due to the technical requirements 
involved in establishing the EES, it is not possible to provide for simultaneous entry into force 
and applicability of the Regulation.  

EN 

6 

   EN