COMMISSION STAFF WORKING DOCUMENT DETAILED EXPLANATION OF THE PROPOSAL BY CHAPTERS AND ARTICLES Accompanying the document Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL establishing an Entry/Exit System (EES) to register entry and exit data and refusal of entry data of third country nationals crossing the external borders of the Member States of the European Union and determining the conditions for access to the EES for law enforcement purposes and amending Regulation (EC) No 767/2008, and amending Regulation (EU) No 1077/2011
Date: 2016-04-06
Institutions: Directorate-General for Migration and Home Affairs, European Commission
Subjects: EU visa policy, Schengen Agreement, biometrics, border control, data processing, exchange of information, external border of the EU, foreign national, information system

EN 

   EN 

   EUROPEAN COMMISSION  Brussels, 6.4.2016  SWD(2016) 114 final   COMMISSION STAFF WORKING DOCUMENT DETAILED EXPLANATION OF THE PROPOSAL BY CHAPTERS AND ARTICLES Accompanying the document Proposal for a   REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL establishing an Entry/Exit System (EES) to register entry and exit data and refusal of entry data of third country nationals crossing the external borders of the Member States of the European Union and determining the conditions for access to the EES for law enforcement purposes   and   amending Regulation (EC) No 767/2008,   and amending Regulation (EU) No 1077/2011 {COM(2016) 194 final}  
 
  Detailed explanation of the proposal by Chapters and Articles 

Chapter  One  lays  down  the  subject  matter  of  the  Regulation,  the  scope,  the  definitions 
relevant  for  the  purpose  of  the  Regulation,  the  set-up  and  the  purpose  of  the  EES,  the 
technical architecture of the EES, the interoperability with the VIS, the access to the EES for 
entering,  amending,  deleting  and  consulting  data,  the  general  principles,  the  automated 
calculator and obligation to inform third country nationals on the remaining authorised stay, 
the  information  mechanism  to  identify  records  for  which  the  maximum  authorised  stay  has 
been exceeded and the web service. 

Chapter Two details the procedures for entering the data in the EES, the personal data for visa 
holders, visa exempt and third country nationals who have been refused entry, the data to be 
added where an authorisation to stay is revoked, annulled or extended and in case of rebuttal 
of the presumption that the person does not fulfil the conditions of duration of stay, the fall-
back  procedures  in  case  of  technical  impossibility  to  enter  data  or  failure  of  the  EES,  the 
provisions  concerning  the  transitional  period  and  the  use  of  data  for  verification  at  the 
external borders.  

Chapter  Three  is  dedicated  to  the  entry  and  use  of  the  EES  data  by  other  authorities  for 
examining and deciding on visa applications, for examining applications for access to national 
facilitation programmes, for verification within the territory and for identification. 

Chapter Four lays down the procedure and conditions for access to data stored in the EES for 
law enforcement purposes. 

Chapter Five lays down the rules for the retention, amendment and advance data deletion of 
the data stored in the EES. 

Chapter Six specifies the implementing measures to be adopted by the Commission prior to 
development and  the rules concerning the development and operational  management  by eu-
LISA. It also lays down the responsibilities of Member States and the responsibilities for the 
use  of the data and data security, including rules on the keeping  of records and for keeping 
data  in  national  systems,  for  communication  of  data  to  third  countries,  international 
organisations and private parties, liability, self-monitoring and penalties. 

Chapter  Seven  concerns  rights  and  supervision  on  data  protection.  Whereas  Directive 
95/46/EC and Regulation (EC) No 45/2001 fully apply for this Regulation, the provisions of 
this  chapter  clarify  certain  points  related  to  right  of  information,  the  information  campaign 
accompanying the start of operations of the EES, the safeguard of the rights of data subjects to 
access,  correction  and  deletion  and  the  remedies,  the  roles  of  the  national  supervisory 
authorities  and  the  European  Data  Protection  Supervisor  including  the  cooperation  between 
national  supervisory  authorities  and  the  European  Data  Protection  Supervisor  and  the 
protection  of  personal  data  for  law  enforcement  purposes  including  rules  on  logging  and 
documentation. 

Chapter  Eight  contains  the  amendments  to  other  Union  instruments,  more  specifically  the 
amendments  to  the  Convention  implementing  the  Schengen  Agreement,  to  Regulation  (EC) 
No  767/2008  concerning  the  Visa  Information  System  and  the  exchange  of  data  between 
Member  States  (VIS  Regulation)  and  to  Regulation  (EU)  No  1077/2011  establishing  a 
European  Agency  for  the  operational  management  of  large-scale  IT  systems  in  the  area  of 
freedom, security and justice.  

Chapter  Nine  covers  the  final  provisions,  which  includes  the  use  of  data  for  reporting  and 
statistics, the costs of the EES, the start of operations, the set-up of a Committee to assist the 
Commission  when  adopting  implementing  measures,  the  set-up  of  an  Advisory  group,  the 

EN 

2 

   EN 

necessary trainings, the monitoring and evaluation of the EES, the production of statistics, and 
the entry into force and the applicability of this Regulation. 

Chapter I: General provisions 

Article 1 establishes the subject matter of the Regulation, which includes (1) the establishment 
of an 'Entry/Exit System' (EES) for addressing border check delays and improving quality of 
border checks for third country nationals and ensuring systematic and reliable identification of 
‘overstayers’ and (2) the conditions under which Member States' designated law enforcement 
authorities and the European Police Office (Europol) may obtain access for consultation of the 
EES for the purposes of the prevention, detection and investigation of terrorist offences or of 
other serious criminal offences. 

Article 2 establishes the scope of the EES and lists the categories of third country nationals to 
whom the EES does not apply. 

Article 3 contains the relevant definitions for the purpose of the EES Regulation.  

Article 4 contains the set-up of the EES and entrusts eu-LISA with the development and the 
management of the EES, including the functionalities for processing biometric data.  

Article  5  defines  the  purpose  of  the  EES  (i.e.  improving  the  management  of  the  external 
borders  and  the  fight  against  irregular  immigration  and  contributing  to  the  prevention, 
detection  and  investigation  of  terrorist  offences  or  of  other  serious  criminal  offences.)  and 
lists the specific objectives pursued by the EES.  

Article 6 sets out the technical architecture of the EES.  

Article  7  paragraph  1  defines  the  interoperability  between  the  EES  and  the  VIS  in  order  to 
ensure more efficiency and rapidity of border checks and establishes a Secure Communication 
Channel between the EES Central System and the VIS Central System. Paragraph 2 lists the 
cases  under which  interoperability enables the direct consultation of the VIS from  the EES. 
Paragraph 3 lists the cases under which interoperability enables the direct consultation of the 
EES from the VIS. 

Article  8  lays  down  the  rules  for  access  to  the  EES  for  entering,  amending,  deleting  and 
consulting  data  by  Member  States'  duly  authorised  authorities.  These  authorities,  including 
border,  visa  and  immigration  authorities,  should  be  designated  by  the  Member  States.  Each 
Member  State  should  communicate  to  eu-LISA  without  delay  a  list  of  these  authorities. 
Access  to  the  EES  for  those  authorities  must  be  limited  to  the  extent  needed  for  the 
performance of the tasks in accordance with this purpose, and proportionate to the objectives 
pursued. 

Article 9 provides that the use of the EES by each competent authority having access to the 
EES must be necessary, appropriate and proportionate to the performance of the tasks of the 
competent authorities. Competent authorities should ensure that the use of the EES does not 
lead to discrimination against third country nationals on any grounds and particular attention 
should  be  given  to  children,  the  elderly  and  persons  with  disability  against  third  country 
nationals. 

Article 10 describes the automated calculator that should be integrated in the EES to inform 
the competent authorities of the maximum duration of stay authorised on border entry in each 
case and of whether the number of authorised entries of the single or double entry visas have 
been  previously  used  as  well  as  identify  third  country  nationals  upon  exit  who  have 
overstayed. The calculator shall not apply to third country nationals who are family members 
of a Union citizen to whom Directive 2004/38/EC applies or of a national of a third country 
enjoying the right of free movement under Union law and who do not hold a residence card 

EN 

3 

   EN 

referred to under Directive 2004/38/EC. Border authorities have the obligation to inform third 
country nationals of the maximum number of days of authorised stay, taking into account both 
the number of entries and the length of stay authorised by the visa {or the touring visa}. For 
the purpose of calculating the duration of authorised stay, stays in Members States which are 
not yet fully applying the Schengen acquis should not be taken into account. 

Article 11 defines the information mechanism by which alerts of overstaying are signalled in 
the  system.  The  EES  should  also  automatically  generate  a  list  with  the  data  of  identified 
overstayers. 

Article  12  defines  the  web  service  available  for  third  country  nationals  and  offering  at  any 
moment  the  possibility  to  verify  whether  they  dispose  or  not  of  the  remaining  authorised 
length of stay to cover their intended stay in the territory of a Member State. The web service 
will allow third country nationals to provide the data required pursuant to Article 14(1) (b) in 
combination  with  the  anticipated  entry  and  exit  dates  and  they  will  receive  an  answer 
indicating whether the third country national intended stay is authorised ("OK") or not ("NOT 
OK").  The  web  service  will  also  enable  carriers  to  verify  whether  third  country  nationals 
holding a single or double entry visa have used or not used the visa already. For this purpose 
they will also receive an OK/NOT OK answer from the web service. 

Chapter II: Entry and use of data by border authorities  

Article 13 lays down the procedures for entering data in the EES by the border authorities at 
the border crossing points both in case a previous individual file has already been created in 
the EES for the third country national and in case there is no previous registration. 

Article 14 paragraph 1 refers to the creation of the individual file and lists the personal data to 
be  entered  for  visa  holders,  while  paragraphs  2  and  3  list  the  data  that  should  be  entered 
respectively  on  entry  and  exit  and  linked  to  an  already  existing  individual  file.  Paragraph  4 
refers to the obligation for the system to identify by means of a mark or flag by the system of 
those visa holders that have not left the territory of the Member States following the date of 
expiry  of  the  authorised  length  of  stay.  Paragraph  5  provides  the  possibility  to  retrieve  the 
relevant personal data directly from the VIS. 

Article 15 paragraph 1 refers the creation of the individual file and lists the personal data to be 
entered for visa exempt third country nationals and the additional biometric data required for 
this category. Four fingerprints must be enrolled on first entry into the Entry/Exit System, if 
physically possible. Paragraphs 2, 3 and 4 list the exceptions to the enrolment of fingerprints 
requirement, for instance when physically impossible or in the case of children under the age 
of 12. In those cases the specific data field is marked as 'not applicable' in the EES individual 
file. 

Article 16 refers to the personal data for third country nationals who have been refused entry 
and lists the specific additional data to be entered in the EES in such cases: the date and time 
of refusal of entry, the border crossing point and the authority that refused the entry and the 
letter(s) corresponding to the reason(s) for refusing the entry. 

Article  17  paragraph  1  refers  to  the  data  to  be  added  to  the  entry/exit  record  where  an 
authorisation to  stay is revoked, annulled or  extended. As regards  visa holders, paragraph 2 
refers  to  the  obligation  for  the  visa  authorities  who  have  taken  the  decision  to  retrieve  and 
export the necessary data from the VIS directly into the EES. Paragraphs 3 and 4 foresee that 
the  entry/exit  record  shall  indicate  the  grounds  on  which  the  person  is  being  expelled,  any 
other  decision  taken  by  the  competent  authorities  of  the  Member  State  resulting  in  the 
removal or departure of the third country national who does not fulfil or no longer fulfils the 
conditions for the entry to or stay in the territory of the Member States and the grounds for 

EN 

4 

   EN 

extending  the  duration  of  authorised  stay.  Paragraph  5  provides  that  when  a  person  has 
departed or been removed from the territories of the Member States pursuant to a decision, the 
competent authority shall enter the data in the entry/exit record of that specific entry. 

Article 18 paragraph 1 refers to the presumption that, where a third country national present in 
the territory of a Member State is not registered in the EES or the entry/exit record does not 
contain  an  exit  date  following  the  date  of  expiry  of  the  authorised  length  of  stay,  the 
competent authorities may presume that the third country national does not fulfil or no longer 
fulfils  the  conditions  relating  to  duration  of  stay  in  the  territory  of  the  Member  States. 
Paragraph 2 refers to the creation of an individual file for a person in the EES or the necessary 
update of the file in case of rebuttal of such presumption. 

Article 19 lists the fall-back procedures in case of technical impossibility to enter data or in 
case of failure of the EES. 

Article 20 paragraph 1 refers to the period of six months after the EES has started operations 
during  which,  in  order  to  verify  at  entry  that  the  person  has  not  exceeded  the  number  of 
entries  authorised  by  the  single  or  double  entry  visa  and  to  verify  at  entry  and  at  exit  that 
persons  entering  for  a  short  stay  have  not  exceeded  the  length  of  the  maximum  authorised 
stay, the competent border authorities shall take into account the stays in the territories of the 
Member States during the 180 days preceding the entry or the exit by checking the stamps in 
the  travel  documents  in  addition  to  the  entry/exit  data  recorded  in  the  EES.  Paragraph  2 
specifies that where a person has entered the territory of the Member States and has not yet 
exited it before the entry into operations of the EES, the date of that entry as stamped in the 
passport shall be entered in the entry/exit record when the person exits. This rule is not limited 
to  the  six  months  after  the  EES  has  started  operations.  In  case  of  discrepancy  between  this 
entry stamp and the data recorded in the EES, the concerned stamp shall prevail. 

Article 21  lays down the rules  on the use of the data stored in the EES, and in case of visa 
exempt  travellers,  where  relevant,  in  the  VIS,  by  border  authorities  for  verification  and 
performance of border control purposes at the external borders. In this context, first, a search 
with  specific  alphanumeric  data  should  be  launched  against  the  EES.  In  addition,  for  third 
country  nationals  who  are  subject  to  a  visa  requirement  to  cross  the  external  borders,  the 
border  authorities  may  launch  a  search  in  the  VIS  directly  from  the  EES  using  the  same 
alphanumeric data for the purposes of carrying out the consultation of the VIS for verification 
at external borders. If the search in EES with these data indicates that data on the person are 
recorded  in  the  EES,  the  border  authorities  shall  compare  the  live  facial  image  of  the  third 
country national with the facial image referred to in Article 16(1)f). Where the technology is 
not  available  for  the  use  of  live  facial  image,  the  competent  authorities  should  carry  out  a 
verification  of  fingerprints  of  visa  exempt  nationals  against  the  EES  and  of  visa  subject 
nationals  against  the  VIS.  Where  the  search  with  these  data  indicates  that  data  on  the  third 
country national are not recorded in the EES, where a verification of the third country national 
fails  or  where  there  are  doubts  as  to  the  identity  of  the  third  country  national,  the  border 
authorities shall have access to data for identification purposes. In addition, for third-country 
nationals who are subject to a visa requirement to cross the external borders, if the search in 
the VIS indicates that the person is recorded in the VIS, a verification of fingerprints against 
the  VIS  shall  be  carried  out.  For  third-country  nationals  who  are  not  subject  to  a  visa 
requirement  to  cross  the  external  borders  and  who  are  not  found  in  the  EES  further  to 
identification, the VIS shall be consulted for the purpose of checking whether the person has 
been previously registered in the VIS. 

EN 

5 

   EN 

 
 
Chapter III: Entry of data and use of the EES by other authorities 

Article  22  Paragraph  1  ensures  that  competent  visa  authorities  consult  the  EES  prior  to  any 
decision  on  visa  applications  and  on  decisions  to  annul,  revoke  or  extend  the  period  of 
validity of an issued visa. Paragraph 2 specifies that, for this purpose, the visa authority shall 
be given access to search the EES directly from the VIS with specific data. Paragraph 3 lays 
down the rules on the consultation of existing files. 

Article  23  lays  down  the  rules  on  the  use  of  the  data  stored  in  the  EES  by  the  competent 
authorities  for  the  purposes  of  examining  applications  for  access  to  national  facilitation 
programmes and the adoption of decisions relating to those applications. 

Article 24 lays down the rules on the access and use of the data stored in the EES, and in case 
of  visa  exempt  travellers,  where  relevant,  in  the  VIS,  by  border  authorities  for  verification 
purposes within the territory of the Member State. First, a search of the EES is launched using 
specific alphanumeric data. If the search with these data indicates that data on the person are 
recorded in the EES, the competent authorities shall compare the live facial image of the third 
country national against the facial image registered in the EES. Where the technology is not 
available  for  the  use  of  live  facial  image,  the  competent  authorities  should  carry  out  a 
verification  of  fingerprints  of  visa  exempt  nationals  against  the  EES  and  of  visa  subject 
nationals  against  the  VIS.  If  the  search  for  the  data  indicates  that  data  on  the  third  country 
national is recorded in the EES, the competent authority shall be given access to consult the 
data of the individual  file  of that person and the entry/exit  record(s). Where the data on the 
third country national are not recorded in the EES, where a verification of the third country 
national  fails  or  where  there  are  doubts  as  to  the  identity  of  the  third  country  national,  the 
border authorities shall have access to data for identification. 

Article 25 refers to the access to the EES for the purpose of identification of any third country 
national  who  may  have  been  registered  previously  in  the  EES  or  who  may  not  or  may  no 
longer  fulfil  the  conditions  for  entry  to,  stay  or  residence  on  the  territory  of  the  Member 
States.  In  this  context,  the  authorities  competent  for  carrying  out  checks  at  external  border 
crossing points or within the territory are granted access to search with the facial image and 
the fingerprints of that person. Where the search with the biometric data indicates that the data 
on  the  person  are  not  recorded  in  the  EES  access  to  data  for  identification  must  be  carried 
against  the  VIS.  If  the  search  shows  that  data  on  the  person  is  recorded  in  the  EES,  the 
competent  authority  will  be  granted access to  consult  the  data  of  the  individual  file  and  the 
linked entry/exit records. 

CHAPTER  IV:  Procedure  and  conditions  for  access  to  the  EES  for  law  enforcement 
purpose 

Article 26 lays down the rules for the designation by Member States of their law enforcement 
authorities which are entitled to consult the data stored in the EES in order to prevent, detect 
and investigate terrorist offences or other serious criminal offences.  

Article 27 provides that Europol should designate an authority which is authorised to request 
access to data contained in the EES through a designated central access point. The designated 
authority shall be an operating unit of Europol. The central access point shall verify that the 
conditions for access to the EES are fulfilled and shall act independently when performing its 
tasks as regards the outcome of the verification. 

Article 28 paragraph 1 lays down the procedure for access to data stored in the EES for law 
enforcement purposes. Paragraph 2 refers to the simplified procedure to be followed only in 
exceptional cases where there is an urgent need to prevent an imminent danger associated to a 

EN 

6 

   EN 

terrorist or other serious criminal offence. Paragraph 3 refers to the procedure to be followed 
in case an ex-post verification determines that the access to the EES data was not justified. 

Article  29  paragraph  1  lays  down  the  cumulative  conditions  for  access  to  the  EES  for 
consultation by the designated authorities. Paragraph 2 lays down the conditions to be met in 
addition to  those  listed under paragraph 1 for access to the EES as  a criminal  identification 
tool  for  the  purpose  of  identification  of  an  unknown  suspect.  Paragraph  3  specifies  that  for 
access to the EES as a criminal intelligence tool to consult the travel history or the periods of 
stay  in  the  Schengen  area  of  a  third  country  national,  in  addition  to  the  conditions  of 
paragraph  1,  there  should  be  a  duly  justified  need  to  consult  the  entry  exit  records  of  the 
person concerned. Paragraph 4 indicates that the consultation of the EES for identification is 
limited  to  searching  with  the  following  EES  data:  fingerprints  of  visa  exempt  nationals  and 
facial image, whereas paragraph 5 lists the data to be used for the search of the EES data in 
case of consultation of the EES for the travel history of a person. 

Article  30  lays  down  the  specific  procedure  and  conditions  for  access  to  the  EES  for 
consultation by Europol. Paragraph 1 lists the cumulative conditions for access to EES data by 
Europol:  the  consultation  must  be  necessary  in  order  to  support  and  strengthen  action  by 
Member  States  in  preventing,  detecting  or  investigating  terrorist  offences  or  other  serious 
criminal  offences  falling  under  Europol's  mandate,  the  consulation  must  be  necessary  in  a 
specific  case  and  there  must  be  reasonable  grounds  to  consider  that  the  consultation  will 
substantially  contribute  to  the  prevention,  detection  or  investigation  of  any  of  the  criminal 
offences in question.  Processing of information  obtained by Europol from consultation with 
EES data shall be subject to the authorisation of the Member State of origin. 

CHAPTER V: Retention and amendment of the data  

Article  31  paragraph  1  sets  the  retention  period  of  entry/exit  records  and  refusal  of  entry 
records at 5 years following the date of the exit record or of the refusal of the entry record in 
order  to  take  into  account  both  border  crossing  facilitation  aspects  for  the  traveller  and 
operational aspects for the border guards. This is in line with the issuance of a multiple-entry 
visa for travellers (maximum period five years) whose data is kept in the VIS for five years. 
Paragraph  2  sets  a  specific  rule  for  the  data  retention  period  for  the  individual  file  and  the 
linked entry/exit or refusal of entry records at five years and one day from the last exit record 
for  the  case  where  there  is  no  entry  record  within  five  years  from  that  last  exit  record  or 
refusal  of  entry  record.  Paragraph 3  provides  that  data  shall  be  kept  for  five  years  from  the 
date of expiry of the authorised period of stay in the case of overstay and that the EES shall 
automatically  inform  Member  States  three  months  in  advance  of  the  scheduled  deletion. 
Paragraph 4 specifies that the entry/exit record(s) generated by third country nationals in their 
condition of family members of a Union citizen to whom Directive 2004/38/EC applies or of 
a national of a third country enjoying the right of free movement under Union law and who do 
not hold a residence card referred to under Directive 2004/38/EC, shall be stored in the EES 
for a maximum of 181 days after  the  last exit record. Paragraph 5 lays down the obligation 
that  the  Central  System  shall  automatically  erase  such  data  upon  expiration  of  the  retention 
period. 

Article 32 paragraph 1 enunciates the right of the competent authorities of the Member States 
to  amend  the  data  in  the  EES.  Paragraphs  2  and  3  list  the  conditions  under  which  the  data 
stored in the EES should be amended where the Member State responsible or a Member State 
other than the Member State responsible has evidence to suggest that data recorded in the EES 
are  factually  inaccurate  or  that  such  data  were  processed  in  the  EES  contrary  to  the  EES 
Regulation.  Paragraph  4  concerns  the  specific  case  of  amendment  of  visa  related  data. 
Paragraph  5  introduces  the  obligation  of  these  authorities  to  delete  the  information  on 

EN 

7 

   EN 

overstayers referred to in Article 13 in case the person concerned proves that he or she was 
forced to exceed the duration of stay due to an unforeseeable and serious event, that he or she 
has  acquired  a  legal  right  to  stay  or  in  case  of  errors..  Paragraph  6  stipulates  that  all  data 
should  be  deleted  from  the  EES  and  from  the  list  of  overstayers  in  the  event  that  this 
Regulation should no longer be applicable to the person because of changes in his/her status. 
Paragraph  7  provides  the  obligation  for  the  Central  System  to  inform  immediately  the 
Member States of the erasure of data from the EES and the list of overstayers. 

CHAPTER VI: Development, Operation and Responsibilities 

Article 33 establishes the measures that the Commission shall adopt before the development 
and technical implementation of the Central System, the National Uniform Interfaces and the 
Communication Infrastructure. Those implementing measures shall be adopted in  comitology 
in accordance with the examination procedure. For the adoption of the measures set down for 
the establishment and the high level design of the interoperability the VIS Committee shall be 
consulted. 

Article 34 paragraph 1 defines the tasks entrusted to eu-LISA as regards the development of 
the  Central  EES,  the  National  Uniform  Interfaces,  the  Communication  Infrastructure,  the 
Secure  Communication  Channel  between  the  EES  Central  System  and  the  VIS  Central 
System and the web service for travellers and carriers Paragraph 2 establishes a Programme 
Management  Board  to  adequately  manage  the  design  and  development  phase  of  the  EES. 
Paragraph  3  defines  the  tasks  entrusted  to  eu-LISA  for  the  operational  management  of  the 
above  components  and  of  the  web  service.  Paragraph  4  provides  for  the  application  by  eu-
LISA of appropriate rules of professional secrecy.  

Article  35  defines  the  responsibilities  of  Member  States.  Paragraphs  1  to  3  define  the 
obligation for each Member State to connect its existing national border infrastructure to the 
National  Uniform  Interface,  to  designate  a  national  authority  to  provide  the  access  for  the 
competent  authorities  to  the  EES  (including  the  designation  of  the  competent  national 
authorities  and  of  the  competent  authority  of  Europol  that  should  be  granted  access  for  the 
purposes of law enforcement)  and to observe automated procedures for processing the data. 
Paragraph  4  emphasises  the  need  for  training  of  staff  before  they  are  authorised  to  process 
data  stored  in  the  EES  about  data  security  and  data  protection  rules  in  particular  and  on 
relevant fundamental rights.  

Article 36 sets out in paragraph 1 that each Member State shall designate the authority which 
is  to  be  considered  as  controller  and  shall  ensure  that  the  data  recorded  in  the  EES  is 
processed lawfully. Paragraph 2 creates obligations for eu-LISA with regard to security and 
with regard to confidentiality. Paragraph 3 indicates that eu-LISA shall inform the European 
Parliament, the Council, the Commission and the European Data Protection Supervisor of the 
measures regarding security and confidentiality for the start of operations of the EES. 

Article 37 provides that alphanumeric data stored in the EES can be kept in a Member State's 
national files (or national entry exit system) in accordance with the purposes of the EES and 
the legal provisions applicable to this system in full respect of Union law and for no longer 
than they are kept in the EES and lists the specific conditions. 

Article 38 paragraph 1 provides that personal data stored in the EES cannot be communicated 
to  third  countries,  international  organisations  or  private  parties.  Paragraph  2  provides  an 
exception  to  the  above  rule  under  which  communication  to  third  countries  or  to  an 
international organisation could be possible in individual cases and only for identification for 
the purpose of return under specific conditions, including the legal provisions relevant to data 
security  and  data  protection.  Paragraph  3  provides  that  transfers  of  personal  data  to  third 

EN 

8 

   EN 

countries shall or international organisations should not prejudice the rights of applicants for 
and beneficiaries of international protection. Paragraph 4 forbids transfer to third countries or 
international organisations of personal data obtained from the Central System by a  Member 
State or Europol for law enforcement purposes. 

Article 39 deals with data security, indicating the obligations of the Member States as well as 
the obligations of eu-LISA in this regard. 

Article 40 sets out the applicable rules on liability of Member States for damages. 

Article 41 creates the obligation for the Member States and eu-LISA to keep complete records 
of  data  processing  operations  within  the  EES  (and  for  the  operations  listed  under  Article  7 
also within the VIS in accordance with the relevant provision of the VIS Regulation), which 
may solely be used for the purposes of data protection monitoring of the admissibility of data 
processing and of ensuring data security. 

Article  42  obliges  Member  States'  authorities  entitled  to  access  EES  to  carry  out  self-
monitoring and to cooperate, where necessary, with the Supervisory Authority. 

Article 43 creates the obligation for each Member State to ensure the proper processing and 
use  of  data  by  applying  the  appropriate  penalties,  as  an  essential  complement  to  the  data 
protection  and  security  arrangements.  The  penalties  can  have  an  administrative  and/or 
criminal  nature  in  accordance  to  the  Member  States'  national  law  and  must  be  effective, 
proportionate and dissuasive. 

CHAPTER VII: Rights and supervision on data protection 

The EES should be applied in full compliance with the relevant EU legislation on protection 
of  personal  data  (i.e.  Directive  95/46/EC  and  Regulation  (EC)  45/2001).  The  provisions  in 
this  chapter  clarify  certain  points  with  respect  to  safeguarding  the  rights  of  the  persons 
concerned and to the supervision of data protection.  

Article 44 covers the right of information of third country nationals whose data shall be stored 
in  the  EES  pursuant  to  Article  3.  Paragraph  1  contains  in  conformity  with  Article  10  of 
Directive 95/46/EC a list of items the person concerned has to be informed about in writing 
including  the  right  of  access,  correction  and  deletion  of  data.  Paragraph  2  specifies  that  the 
information shall be provided when the individual file is created. Paragraph 3 provides that a 
common leaflet and a website containing at least the information listed in paragraph 1 must be 
set up in a clear and simple way.  

Article  45  provides  that  the  Commission,  together  with  the  national  supervisory  authorities 
and the European Data Protection Supervisor, should accompany the EES start of operations 
of the EES with an information campaign informing the public about the objectives, the data 
stored, the authorities having access to the data and the rights of the third country nationals. 

Article  46  paragraphs  1  and  2  provide  the  rights  of  access,  correction  and  deletion  of  data 
relating  to  any  person  and  stored  in  the  EES  which  are  inaccurate  or  recorded  unlawfully. 
Paragraphs 3, 4 and 5 clarify that the related request may also be lodged with a Member State 
which  is  not  the  Member  State  which  entered  the  data  in  the  EES  and  establishes  the  rules 
applicable in that case including as regards visa related data which should be checked against 
the  VIS  and  if  necessary  amended  in  the  EES.  Paragraph  6  specifies  the  obligation  for 
Member States to inform the data subject on his right to bring an action or a complaint before 
the competent authorities or courts in case of a negative decision. Paragraph 7 provides that 
any  request  for  access,  correction  or  deletion  of  data  stored  in  the  EES  must  contain  the 
necessary  information  to  identify  the  person  concerned,  including  fingerprints.  Paragraph  8 
stipulates that Member States must keep track of the data requests received. 

EN 

9 

   EN 

Article  47  lays  down  an  obligation  for  the  competent  authorities  to  ensure  the  proper 
enforcement of the rights laid down in Article 46 and an obligation to the national supervisory 
authority  to  provide  assistance  upon  request  and  advice  to  the  persons  wishing  to  exercise 
their right to correct or delete their personal data stored in the EES. It also provides that the 
relevant supervisory authorities shall cooperate to that effect. 

Article 48 clarifies, pursuant to Article 22 of Directive 95/46/EC, the right of any person to 
remedies  before  the  courts  of  each  Member  State  if  the  rights  of  access  to  or  correction  or 
deletion of data relating to him/her are refused. The assistance of the supervisory authorities 
shall remain available throughout the proceedings. 

Article  49  clarifies  the  competence  of  the  national  supervisory  authorities  to  review  the 
lawfulness  of  all  the  processing  operations  carried  out  by  the  Member  States.  It  lays  down 
rules  on audit and  obliges  Member  States  to  designate a controller which shall  have central 
responsibility  for  the  processing  of  data  by  this  Member  State.  Furthermore,  it  specifies  the 
obligation  to  Member  States  to  supply  any  information  requested  by  national  supervisory 
authorities.  

Article  50  paragraph  1  sets  that  the  European  Data  Protection  Supervisor  shall  monitor  the 
activities  of  eu-LISA  related  to  the  processing  of  personal  data  in  the  EES.  Paragraph  2 
specifies that the European Data Protection Supervisor's role includes ensuring that an audit 
of eu-LISA's personal data processing activities is carried out at least every four years and the 
report of such audit sent to the European Parliament, the Council, eu-LISA, the Commission 
and  the  national  supervisory  authorities.  Paragraph  3  creates  obligations  for  eu-LISA    to 
supply information requested by the European Data Protection Supervisor, give him access to 
all documents and to its records and allow him  access to all its premises  at any time. 

Article  51  creates  obligations  for  the  Supervisory  Authorities  and  the  European  Data 
Protection  Supervisor  to  co-operate.  They  shall  meet  at  least  twice  a  year  and  send  a  joint 
report of activities to the European Parliament, the Council, the Commission and the Agency 
every two years. 

Article 52 clarifies that the provisions adopted under national law implementing Framework 
Decision 2008/977/JHA are also applicable to the processing of personal data for the purpose 
of the prevention, detection and investigation of terrorist offences or of other serious criminal 
offences. The monitoring of the lawfulness of the processing of the above mentioned personal 
data  shall  be  carried  out  by  the  national  supervisory  authorities  designated  pursuant  to 
Framework Decision 2008/977/JHA. Furthermore, the processing of personal data by Europol 
shall  be  in  accordance  with  Decision  2009/371/JHA  and  shall  be  supervised  by  an 
independent external data protection supervisor. In order to allow the national data protection 
authorities  and  the  European  Data  Protection  Supervisor  to  monitor  the  compliance  of  data 
processing with EU data protection rules, the Central System, the designated authorities, the 
central  access  points  and  Europol  shall  keep  records  of  the  searches  carried  out  for  the 
purpose  of  prevention,  detection  and  investigation  of  terrorist  or  of  other  serious  criminal 
offences. 

Article 53 paragraph 1 lays down the obligation for Member States and Europol to ensure that 
data  processing  operations  resulting  from  requests  to  access  to  EES  data  are  logged  or 
documented  for  the  purposes  of  checking  the  admissibility  of  the  request,  monitoring  the 
lawfulness  of  the  data  processing  and  data  integrity  and  security,  and  self-monitoring. 
Paragraph 2 lists the information that the log or documentation must contain.  

EN 

10 

   EN 

 
 
CHAPTER VIII: Amendments to other Union instruments 

Article  54  lays  down  the  amendments  to  the  Convention  implementing  the  Schengen 
Agreement. 

In order to align the Convention to the EES, Article 20(2) is replaced and now provides the 
possibility that the contracting parties extend beyond 90 days an alien's stay in its territory in 
exceptional circumstances.  

Article 55 lays down the amendments to Regulation (EU) No 767/2008 concerning the Visa 
Information System (VIS). 

Article 13 Data to be added for a visa annulled or revoked 

–  The new paragraph 3 provides that the visa authority which has taken a decision to annul 
or revoke a visa shall immediately retrieve and export from the VIS into the EES the data 
listed under paragraph 1 of Article 17 of the EES Regulation in order to update the data of 
the  person  concerned  registered  in  the  EES  and  where  necessary  to  signal  them  as 
overstayers. 

Article 14 Data to be added for a visa extended 

–  The new paragraph 3 provides that the visa authority which has taken a decision to extend 
a  visa  shall  immediately  retrieve  and  export  from  the  VIS  into  the  EES  the  data  listed 
under paragraph 1 of Article 17 of the EES Regulation  in order to update the data of the 
person concerned registered in the EES and prevent, where applicable, that such persons be 
signalled  as overstayers. 

Article 15 Use of VIS for examining applications 

–  The  existing  text  is  adapted  to  the  establishment  of  the  EES  and  the  interoperability 
between that system and the VIS. In  paragraphs (2)(b) and (2)(c) the data to  be used for 
launching  a  search  in  the  VIS  for  the  purpose  of  examining  and  deciding  on  visa 
applications is modified in order to match the data used in the EES. 

–  The  new  paragraph  4  introduces  the  possibility  to  search  the  EES  directly  from  the  VIS 
using  fingerprints  and/or  several  alphanumeric  data  including  the  number  of  the  travel 
document for the purposes of carrying out the consultation of the EES for examining and 
deciding on visa applications. 

–  The  new  paragraph  5  lays  down  that,  where  the  search  with  alphanumeric  data  indicates 
that data on the third country national are not recorded in the VIS or where there are doubts 
as to the identity of the third country national, the visa authorities shall have access to data 
stored in the EES for identification.  

Article 17a Interoperability with the EES 

–  New Article 17a establishes the interoperability between the VIS and the EES in order to 
ensure  more  efficiency  and  rapidity  of  border  checks.  It  foresees  the  establishment  of  a 
Secure  Communication  Channel  by  eu-LISA  between  the  two  systems  to  enable  the 
interoperability.  Paragraph  2  lists  the  cases  under  which  interoperability  enables  the  visa 
authorities  using  the  VIS  to  consult  the  EES  from  the  VIS.  Paragraph  3  lists  the  cases 
under  which  interoperability  shall  enable  the  border  authorities  using  the  EES  to  consult 
the VIS from the EES. Pursuant paragraph 4, the Commission shall adopt the measures for 
the  establishment  and  the  high  level  design  of  the  interoperability.  For  this  specific 
purpose, the VIS Committee will be involved in the preparation of the relevant measures. 
The Management Authority shall develop the required evolutions and/or adaptations of the 
Central  Visa  Information  System,  the  National  Interface  in  each  Member  State,  and  the 

EN 

11 

   EN 

communication infrastructure as regards the Secure Communication Channel between the 
Central Visa Information System and the National Interfaces. The national infrastructures 
shall be adapted and/or developed by the Member States. 

Article 18 Access to data for verification at external border crossing points 

–  The  existing  text  is  adapted  to  the  establishment  of  the  EES.  Indeed,  because  of  the 
interoperability  between  the  EES  and  the  VIS  and  the  possibility  to  use  self-service 
systems  at  external  borders,  it  should  be  possible  to  consult  at  external  borders  the  VIS 
using the travel document (and not only using the visa sticker). For the same reasons, the 
VIS should provide information to the border guards not only on the authenticity but also 
on the territorial and temporal validity and on the status of the visa (or the touring visa) via 
a hit/no hit answer. In addition, this article reflects the fact that the identity of visa holders 
will  not  be  systematically  verified  against  the  VIS.  In  certain  cases,  the  identity  of  visa 
holders will be verified against the EES, using their facial image. 

–  Paragraph 1 refers to the alphanumeric data to be used for launching a search in the VIS for 
the  purpose  of  verification  at  external  border  crossing  points.  The  data  under  paragraph 
(1)(a) match the data used in the EES for verification at external border crossing points and 
therefore  enable  the  interoperability  between  the  systems.  In  particular,  the  VIS  may  be 
searched  using  the  travel  document  number  and  other  data  contained  in  the  travel 
document. 

–  The new paragraph 2 provides that the competent border authority may launch a search in 

the VIS directly from the EES using alphanumeric data laid down in paragraph 1. 

–  The  new  paragraph  3  provides  that  if  the  search  with  the  data  listed  in  paragraph 1 
indicates  that  the  VIS  stores  data  on  one  or  more  issued  or  extended  visa(s)),  which  are 
under their validity period and are territorially valid for the border crossing, the competent 
border  control  authority  shall  be  given  access  to  consult  the  data  related  to  the  status 
information  and  the  data  taken  from  the  application  form,  the  photographs  and  the  data 
entered in respect of the visa(s) issued, annulled, revoked or whose validity is extended of 
the concerned application file as well as of linked application file(s). 

–  The  new  paragraph  4  provides  that  if  the  search  with  the  data  listed  in  paragraph 1 
indicates that one or more visa(s) are recorded in the VIS but that the visa(s) recorded are 
not valid, the competent border authority shall be given access to consult the data related to 
the status information and the data taken from the application form, the photographs and 
the  data  entered  in  respect  of  the  visa(s)  issued,  annulled,  revoked  or  whose  validity  is 
extended of the concerned application file as well as of linked application file(s). 

–  The new paragraph 5 provides that, in addition to a search in the VIS using alphanumeric 
data, the competent border authority shall verify the identity of a person against the VIS if 
two cumulative conditions are met (i.e. if the search indicates that data on the  person are 
recorded in the VIS, and if the identity of the person cannot be verified against the EES). 
For  this  purpose,  the  border  authorities  shall  verify  the  fingerprints  of  the  visa  holder 
against the fingerprints recorded in the VIS.  

–  The new paragraph 6 provides that for the purpose of verifying the fingerprints against the 
VIS, the competent authority may launch a search from the EES to the VIS. In particular, 
this may be the case when a visa holder enters the territory of the Member States for the 
first time: the data of the visa holder will be recorded already in the VIS but not yet in the 
EES.  

–  The new paragraph 7 provides that where the verification of the visa holder or of the visa 
fails or where there are doubts as to the identity of the visa holder, the authenticity of the 

EN 

12 

   EN 

visa and/or the travel document, the competent authorities will have access to perform an 
identification against the VIS. 

Article 18a Retrieve and import of VIS data for creating or updating the individual file of a 
visa holder into the EES 

–  Paragraph  1  explains  that  for  the  purpose  of  creating  or  updating  the  individual  file  of  a 
visa  holder  in  the  EES  the  competent  border  control  authority  shall  be  given  access  to 
retrieve and import the required data stored in the VIS.  

Article  19a  Use  of  the  VIS  before  creating  in  the  EES  the  individual  files  of  third  country 
nationals exempt from the visa obligation 

–  New  Article  19a  explains  that  for  the  purpose  of  checking  whether  a  person  has  been 
previously registered in the VIS, the authorities in charge of carrying out checks at external 
border crossing points shall consult the VIS before creating the individual file in the EES 
of a third country national exempted from the visa obligation. This provision only applies 
when a third country national exempted from the visa obligation is not found in the EES 
further  to  an  identification  carried  out  against  that  system.  In  this  case,  the  competent 
border authority shall have access to search the VIS using a set of alphanumeric data. The 
competent  border  control  authority  may  launch  such  search  from  the  EES.  If  the  search 
with the alphanumeric data indicates that data on the person are recorded in the VIS, the 
competent  border  authority  shall  verify  the  fingerprints  of  the  person  against  the 
fingerprints recorded in the VIS. The competent border control authority may launch such 
verification of fingerprints from the EES. If the verification fails or where there are doubts 
as  to  the  identity  of  the  person  or  the  authenticity  of  the  travel  document,  the  border 
authorities shall have access to perform an identification against the VIS. The competent 
border authority may launch from the EES the identification against the VIS. 

Article 20 Access to data for identification 

–  Paragraph 1 is modified, now access to data for identification of any person who may not, 
or may no longer, fulfil the conditions for the entry to, stay or residence on the territory of 
the  Member  States  is  extended  to  include  any  person  who  may  have  been  registered 
previously in the VIS. 

Article 26 Operational management 

–  New  paragraph  3a  provides  that  six  months  after  the  entry  into  force  of  the  EES 
Regulation, the  Management  Authority  shall  become  responsible  for  the  tasks  relating  to 
the implementation of the budget,  acquisition and renewal  and contractual matters of the 
Communication  Infrastructure  between  the  central  VIS  and  the  national  interfaces,  in 
particular. Those tasks are currently entrusted to the Commission. 

Article 34 Keeping of records 

–  Paragraph 1 is amended to extend the type of data used for interrogation in order to include 

the data foreseen in Articles 18(5), 19b(2) and 19b(4). 

–  New  paragraph  1a  provides  that,  for  the  operations  carried  out  in  the  framework  of  the 
interoperability between the EES and the VIS, a record of each data processing operation 
carried out within the VIS and the EES shall be kept in accordance with Article 34 of the 
VIS Regulation and Article 41 of the EES Regulation. 

Article  56  lays  down  the  amendments  to  Regulation  (EU)  No  1077/2011  establishing  a 
European  Agency  for  the  operational  management  of  large-scale  IT  systems  in  the  area  of 
freedom, security and justice (eu-LISA). 

EN 

13 

   EN 

The eu-LISA Regulation is amended in light of the EES proposal. 

Article  1(2)  is  amended  in  order  to  include  eu-LISA's  responsibility  for  the  operational 
management of the EES. 

A  new  Article  5a)  Tasks  relating  to  the  EES  is  added.  This  article  lays  down  the  tasks 
entrusted to eu-LISA in relation to the EES. 

Article 7(5) is amended to extend the prohibition of access  by the network provider to EES 
operational  data  and  Article  7(6)  is  amended  to  include  a  reference  to  contracts  on  the 
network of the EES. 

Article 8(1) is amended to include the obligation of eu-LISA to monitor the developments in 
research for the operational management of EES. 

Article  12(1)  is  amended  to  insert  the  obligation  for  eu-LISA  to  adopt  a  report  on  the 
development  of  the  EES  and  a  report  on  the  technical  functioning  of  the  EES,  to  make 
comments on the European Data Protection Supervisor’s reports on the audits pursuant to the 
EES  Regulation  (Regulation  XX  of  XX)  and  to  publish  statistics  on  the  EES  and  a  list  of 
competent authorities. 

Article  15(4)  is  amended  to  introduce  the  possibility  that  Europol  attend  to  meetings  of  the 
Management  Board  as  observers  when  a  question  concerning  the  EES  in  relation  to  the 
application of the EES Regulation (Regulation XX of XX) is on the agenda. 

Article 17(5) is amended in order to include the confidentiality requirements of Article 34(4) 
of the EES. 

Article 19 is amended to include the EES Advisory Group and to foresee the possibility of an 
appointment by Europol of a representative for the EES Advisory Group. 

CHAPTER IX: Final provisions 

Article 57 paragraph 1 lists the anonymised data that might be consulted for the purposes of 
reporting and statistics by the competent authorities of Member States, the Commission, eu-
LISA  and  Frontex.  Paragraph  2  specifies  that  eu-LISA  is  responsible  for  establishing  and 
implementing a central repository enabling the authorised staff set out in paragraph 1 to use 
the data enumerated at the same paragraph to produce statistics. Paragraph 3 specifies that the 
procedures  to  monitor  the  development  and  functioning  of  the  EES  shall  include  the 
possibility to produce regular statistics for that purpose. Paragraphs 4, 5 and 6 lay down the 
specific obligations of eu-LISA for the use of data for reporting and statistics. 

Article  58  lays  down  the  costs  of  the  implementation  of  the  EES  and  specifies  who  bears 
which costs (i.e. the general budget of the Union, Member States and Europol). 

Article 59 paragraphs 1, 2 and 3 specify that Member States shall notify the Commission of 
the authority which is to be considered as controller and of its designated authorities and of its 
central access points and shall notify eu-LISA of the competent authorities which have access 
to enter, amend, delete, consult or search data. Paragraph 4 specifies that Europol shall notify 
the Commission of its designated authority and its central access point. Paragraph 5 specifies 
that  eu-LISA  shall  notify  the  Commission  of  the  successful  completion  of  a  comprehensive 
test  of  the  EES.  Paragraph  6  provides  that  the  Commission  shall  make  the  information 
notified available to the Member States and the public by a constantly updated public website. 

Article  60  provides  that  the  Commission  shall  determine  the  date  from  which  the  EES  will 
start operations subject to the notification of each Member State to the Commission that it has 
made  the  necessary  technical  and  legal  arrangements  for  the  transmission  of  data  to  the 
central  repository,  that  eu-LISA  has  made  necessary  technical  arrangements  and  that  the 

EN 

14 

   EN 

Member States have completed the notifications to the Commission referred to in Article 59. 
The  Member  States  and  Europol  shall  start  using  the  EES  from  the  date  determined  by  the 
Commission. 

Article  61  establishes  a  Committee  to  assist  the  Commission  with  its  responsibilities  under 
Article 33. 

Article 62 establishes an Advisory Group to assist the Commission with the expertise related 
to the system. 

Article 63 refers to the obligation for eu-LISA to perform tasks related to the technical use of 
the EES.  

Article 64 creates the obligation for eu-LISA to ensure that procedures are in place to monitor 
the development of the EES and its functioning against objectives. It lays down an obligation 
for  eu-LISA  to  submit  a  report  to  the  European  Parliament  and  the  Council  on  the  state  of 
play of development six months after the entry into force of the Regulation.  It also lays down 
the  obligation  for  eu-LISA  to  submit  to  the  European  Parliament,  the  Council  and  the 
Commission a report on the technical functioning of the EES two years after the start of the 
EES  and  every  two  years  thereafter..  Furthermore,  it  creates  the  obligation  for  the 
Commission to produce an overall evaluation of the EES, the first two years after the EES is 
brought into operation and every four years thereafter  This overall evaluation shall include an 
examination of results achieved against objectives and the impact on fundamental rights, and 
assessing the continuing validity of the underlying rationale, the application of the Regulation, 
the  security  of  the  EES  and  any  implications  on  future  operations,  and  shall  make  any 
necessary recommendations. Paragraphs 6 and 7 oblige Member States, Europol and eu-LISA 
to  provide  the  information  necessary  to  produce  the  above  mentioned  monitoring  and 
evaluation.  Paragraph  8  provides  that  each  Member  State  and  Europol  shall  prepare  annual 
reports  on  the  effectiveness  of  access  to  EES  data  for  law  enforcement  purposes.  Member 
States’ and Europol’s annual reports shall be transmitted to the Commission by 30 June of the 
subsequent year. 

Article  65  concerns  the  entry  into  force  and  applicability.  This  Regulation  shall  enter  into 
force  on  the  twentieth  day  following  that  of  its  publication  in  the  Official  Journal  of  the 
European Union. This Regulation shall be binding in its entirety and directly applicable in the 
Member States in accordance with the Treaties. 

EN 

15 

   EN