REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL on the implementation of Regulation (EC) No 767/2008 of the European Parliament and of the Council establishing the Visa Information System (VIS), the use of fingerprints at external borders and the use of biometrics in the visa application procedure/REFIT Evaluation
Date: 2016-10-14
Institutions: Directorate-General for Migration and Home Affairs, European Commission
Subjects: EU visa policy, biometrics, border control, data collection, data protection, data transmission, external border of the EU, information system, personal data, right of asylum

EN 

   EN 

   EUROPEAN COMMISSION  Brussels, 14.10.2016  COM(2016) 655 final   REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL on the implementation of Regulation (EC) No 767/2008 of the European Parliament and of the Council establishing the Visa Information System (VIS), the use of fingerprints at external borders and the use of biometrics in the visa application procedure/REFIT Evaluation {SWD(2016) 327 final} {SWD(2016) 328 final}  
 
 
REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND 
THE COUNCIL 

on the implementation of Regulation (EC) No 767/2008 of the European Parliament and 
of the Council establishing the Visa Information System (VIS), the use of fingerprints at 
external borders and the use of biometrics in the visa application procedure/REFIT 
Evaluation 

1. 

INTRODUCTION 

1.1. 

The VIS and its role in facilitating the exchange of data between Member States 

When progressively establishing an area of freedom, security and justice, the European Union 
must ensure the free movement of persons and a high level of security. In this context, priority 
was given to developing and establishing the Visa Information System (VIS) to exchange visa 
data between Member States1. 

A comprehensive legal framework was adopted to establish the VIS:  

  Council  Decision  2004/512/EC  of  8 June 2004  established  the  VIS  as  a  system  for 

exchanging visa data between Member States;  

  Regulation  (EC)  No  767/2008  of  9 July 2008  laid  down  the  VIS’s  purpose, 
functionalities and responsibilities and laid down the conditions and procedures for the 
exchange  of  visa  data  between  Member  States  to  facilitate  the  examination  of  visa 
applications and related decisions;  

  Regulation  (EC)  No  810/2009  of  13 July 2009  (the  Visa  Code)  set  out  the  rules  on 

the registration of biometric identifiers in the VIS. 

The VIS was also  entrusted with  the aim of contributing to internal  security and combating 
terrorism.  Council  Decision  2008/633/JHA  of  23 June 2008  consequently  laid  down  the 
conditions under which Member States’ designated authorities and Europol may obtain access 
to  consult  the  VIS  for  the  purposes  of  preventing,  detecting  and  investigating  terrorist 
offences and other serious criminal offences. 

The VIS is instrumental in order to:  

1)  improve  the  implementation  of  the  common  visa  policy,  consular  cooperation  and 
consultation between central authorities to prevent threats to internal security and ‘visa 
shopping’;  

2)  facilitate  the  fight  against  fraud  and  checks  at  external  border  crossing  points  and 

within the Member States’ territory;  

1   In this document, ‘Member States’ means Schengen Member States, i.e. EU Member States that are Schengen 

members, as well as the Schengen Associated countries. 

2 

 
 
                                                 
3)  assist in the identification and return of illegal immigrants;  

4)  facilitate the application of the Dublin Regulation2. 

The  VIS  specifically  contributes  to  safeguarding  the  Member  States’  internal  security  and 
combating  terrorism3  by  improving  how  visa  applications  are  assessed.  This  includes 
improving  consultation  between  central  authorities  and  improving  the  verification  and 
identification  of  applicants  at  consulates  and  border  crossing  points.  Safeguarding  Member 
States’  internal  security  and  combating  terrorism  constitutes  a  general  objective  and  basic 
criterion for the common visa policy. The VIS also helps to fight against illegal immigration4 
and benefits bona fide travellers by improving and facilitating the procedures for issuing visas 
and for checks. 

The VIS was gradually rolled out in all Member States' consulates around the world between 
October 2011 and February 2016.  

Around  16  million  Schengen  visas  are  issued  every  year  by  the  26  Member  States  and 
Schengen  associated  countries.  By  the  end  of  March  2016  data  on  close  to  23  million  visa 
applications and 18.8 million fingerprints had been entered in the VIS.  

The system has exceeded the threshold of 1 million operations per day and 100,000 operations 
per hour. It has a capacity of up to 450,000 operations per hour and can store and process 60 
million pieces of visa application data. 

1.2. 

Assessment and monitoring 

The  VIS  legal  framework  provided  for  an  evaluation  of  the  implementation  of  the  VIS 
Regulation5  and  of  the  VIS  founding  Decision6,  as  well  as  of  the  use  of  VIS  by  law 
enforcement authorities on the basis of the VIS Law Enforcement Access (LEA) Decision;7 
and the use of biometrics in the visa application procedure on the basis of the Visa Code8. 

On  this  basis,  and  considering  as  well  the  overall  principles  and  criteria  for  carrying  an 
evaluation  of  EU  policy  instruments  in  the  context  of  the  Regulatory  and  Fitness  (REFIT) 
programme,  the  Commission  launched  in  2015  the  first  evaluation  of  the  system  since  its 
entry into operation (2011) and looked in particular at :  

 

the performance of the VIS as a system;  

2  Regulation (EU) No 604/2013 replacing Regulation (EC) No 343/2003, OJ L 50 of 25.2.2003, p. 1. 
3  Cf. Council conclusions of 19.2.2004, point 1(g) of its Annex. 
4   Cf. Articles 5(1)(e) and 15 of the Schengen Convention. 
5   Regulation (EC) No 767/2008 of the European Parliament and of the Council of 9 July 2008 concerning the 
Visa  Information  System  (VIS)  and  the  exchange  of  data  between  Member  States  on  short-stay  visas  (VIS 
Regulation) OJUE L 218, 13.8.2008, p. 60. 

6   Council Decision No 512/2004 establishing the Visa Information System (VIS) OJUE L 213, 15.06.2004, p. 5. 
7   Council Decision 2008/633/JHA of 23 June 2008 concerning access for consultation of the Visa Information 
System (VIS) by designated authorities of Member States and by Europol for the purposes of the prevention, 
detection  and  investigation  of  terrorist  offences  and  of  other  serious  criminal  offences,  OJUE  L  218, 
13.08.2008, p. 129. 

8   Regulation (EC) No 810/2009 of the European Parliament and of the Council of 13 July 2009 establishing a 

Community Code on Visas, OJ L 243, 15.9.2009, p. 1. 

3 

 
 
 
                                                 
  how it has been implemented in practice;  

 

the extent to which it has reached its policy objectives;  

  whether  it  is  fit-for-purpose  in  terms  of:  effectiveness,  efficiency,  relevance, 

coherence and added value for the EU visa policy.  

The report (and the evaluation that underpins it) also:  

  assesses whether the system delivers on its objectives at reasonable cost;  

  examines the results achieved in the light of the objectives;  

  examines the Member States’ implementation of the legal framework. 

The  evaluation  was  performed  internally  by  the  Commission.  A  number  of  different  data 
collection  tools  were  used  to  gather  information  from  a  wide  range  of  stakeholders,  which 
included:  

  extensive documentary review;  

  an EU survey sent to the Member States, to which 19 Member States replied9, and to 
the European Agency for the operational management of large-scale IT systems in the 
area of freedom, security and justice (eu-LISA);  

 

feedback  from  eu-LISA  Management  Board  and  VIS  Advisory  Group  meetings,  the 
competent  working  groups  in  the  Council  (the  Visa  working  party,  Friends  of  VIS, 
VISION),  Schengen  evaluations  of  Member  States,  and  the  local  Schengen 
cooperation between Member States' consulates throughout the world.  

The  opinions  of  third-country  nationals  and  governments  of  countries  under  visa  obligation 
were taken into account both via Member States's and Commission's experience with rolling 
out and applying VIS worldwide.  

This  report  also  draws  on  a  study10  carried  out  by  the  Joint  Research  Centre  on  fingerprint 
recognition for children. 

While this evaluation was based on four years of functioning of the VIS, account was taken of 
the  fact  that  the  VIS  worldwide  rollout  was  gradual,  which  means,  for  example,  that  over 
50 % of VIS volume of transactions comes  from regions where VIS was deployed only 3-4 
months before the end of the evaluation, thus only limited data and monitoring was available 
from those regions at the time of carrying out the evaluation. Although this can be considered 
a limiting factor, the available data and the evidence collected allowed drawing a number of 
conclusions as regards key aspects of the VIS and the evaluation questions.  

In addition to presenting the main findings of the evaluation and the Commission’s views, this 
Report also presents a number of recommendations for next steps. 

9   Austria,  Belgium,  Czech  Republic,  Estonia,  France,  Germany,  Greece,  Iceland,  Latvia,  Lithuania, 

Luxembourg, Malta, the Netherlands, Norway, Poland, Portugal, Slovakia, Sweden, and Switzerland. 

10  JRC-IPSC ‘Fingerprint Recognition for Children’ (Report EUR 26193 EN). 

4 

 
 
                                                 
2. 

MAIN FINDINGS OF THE EVALUATION 

Overall, the findings of the evaluation point to the fact that the introduction of the VIS has led 
to  1)  a  simplification  and  facilitation  of  the  visa  application  process  by  ensuring  that  data 
gathered by all Member States are stored and exchanged via a common system, 2) a reduction 
in  the  administrative  burden  of  national  administrations  and  3)  clear,  smooth  and  effective 
procedures  when  dealing  with  processing  visa  applications,  performing  checks  at  external 
borders or in the territory, identifying third country nationals for migration or return purposes 
or examining asylum applications.  

This overall assessment is based on the analysis of the evaluation criteria below.  

Has the VIS been effective in reaching its objectives? 

2.1. 
A substantial majority of contributing Member States11 concurred that the introduction of the 
VIS  facilitated  the  visa  application  procedure  which  was  simplified  by  setting-up  a 
common  system  to  store  and  exchange  data  between  Member  States  on  applications  and 
related decisions. 

EU-LISA  statistics  show  that  the  average  time  to  complete  an  examination  procedure  from 
when  a  visa  application  was  admitted  to  when  a  visa  was  issued  was  four  days,  with  most 
Member States taking about five days to examine an application. This period is significantly 
lower than the legal limit of 15 working days. 

Most contributing Member States12 also agreed that the introduction of the VIS facilitated 
the fight against visa fraud, although the majority of them13 considered that it had no impact 
on  preventing  applicants  from  attempting  to  bypass  the  criteria  for  determining  which 
Member State was responsible for examining their visa application. 

Frontex’s ‘Annual Risk Analysis 2016’ shows that the introduction of VIS checks at borders 
in  October  2011  led  to  an  increase  in  detections  of  false  visas  at  borders  in  the  period 
immediately  following  (2012),  and,  in  the  longer  run,  constituted  a  deterrent  to  the  use  of 
false visas to enter the EU territory14. 

Most  responding  Member  States15  considered  that  the  introduction  of  the  VIS  facilitated 
checks at external border crossing points and within the Member States’ territory.  

According to eu-LISA reports based on data logs, showing that it currently takes an average 
of  1.36  seconds  to  perform  a  first  line  check  using  fingerprints  and  0.31  seconds  without 
fingerprints. A second line check takes an average of 13.78 seconds with fingerprints and 0.28 
without.  

The report on technical progress on the use of fingerprints at borders16 found that the overall 
impact  on  the  time  taken  to  collect  and  verify  fingerprints  is  on  average  26  seconds  at  air 

11  14 out of the 19 Member States which have contributed. 
12  17 Member States. 
13  12 Member States. 
14  For details see section 6.1.3 Facilitating the fight against fraud in the accompanying CSWD. 
15  14 Member States. 
16  Based on the input received from nine Member States. 

5 

 
 
                                                 
borders  and  44  seconds  at  sea  borders.  These  data  indicate  a  significant  progress  made  in 
shortening the time spent on checks at external borders, compared to a situation before when 
this  was  done  manually,  as  well  as  the  increased  reliability  of  these  checks,  thanks  to 
biometrics. 

A substantial majority of the responding Member States17 agreed that the introduction of the 
VIS helped them identify persons who do not, or no longer, fulfil the conditions for entry 
to,  stay  or  residence  on  the  territory  of  the  Member  States,  chiefly  due  to  the  ability  to 
compare biometrics. 

The  introduction  of  the  VIS  is  also  considered  by  many  responding  Member  States18  as 
having supported the application of the Dublin Regulation by helping to determine which 
Member State was responsible for examining an asylum application in cases where a visa had 
been  issued  by  a  Member  State  to  the  asylum  applicant.  Statistics  support  the  idea  that  the 
VIS  is  well  accepted  by  Member  States  as  an  instrument  of  proof  in  the  Dublin 
procedure: between October 2011 and November 2015, the VIS was used for Dublin-related 
purposes by 12 Schengen Member States in nearly 400 000 cases and by 15 Member States to 
examine nearly 1.38 million asylum cases. 

For almost half of the responding Member States the introduction of the VIS had a positive 
impact on the prevention of threats to the Member States’ internal security,  while only 
two  Member  States  consider  this  impact  as  limited.  This  perception  is  supported  by  the 
statistics which indicate a rather limited use of the VIS for internal security, partly due to the 
recent use of the VIS for this purpose19. The limited use can be both the cause as well as the 
effect of the perceived limited positive impact of the VIS on preventing threats to the internal 
security. 

2.2. 

Has the VIS achieved its objectives in an efficient way? 

The  cost  of  setting  up  the  VIS  was  nearly  EUR  151  million  over  six  years  (2005  to  2011). 
Additionally, Member States incurred costs ranging from EUR 1-2 million to EUR 30 million 
to  set  up  their  national  systems,  amounting  to  a  total  of  approximately  EUR 600  million20, 
including  maintenance  costs  for  the  first  years.  Member  States’  costs  depended  on  their 
consular  network  and  the  type  of  equipment  used.  Quantifying  the  costs  incurred  by  the 
Member States to set up national systems is a complex matter due mainly to the way in which 
systems are organised at national level. Most often the national systems were not built from 
zero, rather existing systems were upgraded and adapted to enable them to connect with the 
VIS.  Since  the  verification  and  identification  of  third-country  nationals  were  shifted  to  the 
Central VIS system, the VIS helped enforce synergies at European level and limited costs at 
national level. 

17  15 Member States. 
18  12 Member States. 
19  Decision  2008/633  became  applicable  only  in  September  2013  and  by  December  2015  most  of  the  16 
Member States that had used the VIS for law enforcement purposes, had been doing so for a few months. 
20  For details see Section 6.2 ‘Efficiency’ in the Commission staff working document and Section 3.5 of Annex 2. 

6 

 
 
 
                                                 
With  a  Schengen  visa  fee  set  at  EUR 60  per  application  and  nearly  23  million  applications 
currently  stored  in  the  VIS,  over  EUR  1 380  million  were  collected  by  Member  States  to 
process these applications. However, these revenues do not only cover the cost of setting up 
and running the VIS. Given the massive initial cost of the investment, the relatively low cost 
of  subsequent  maintenance,  and  even  considering  all  other  administrative  costs  incurred  by 
the Member States when processing visas, the initial cost of setting up the system appears to 
have been largely amortised. 

However, the main benefits of the system are of societal value and unquantifiable:  

 

 

 

it  contributes  to  the  enforcement  of  a  common  visa  policy  and  consular  cooperation 
and provides an easily available and secure means of consultation between central visa 
authorities;  

it makes it possible to identify any person who may not, or may no longer, fulfil the 
conditions for entry to, stay or residence on the territory of the Member States;  

it  facilitates  the  application  of  criteria  and  mechanisms  to  determine  which  Member 
State  is  responsible  for  examining  an  asylum  application  and  when  examining  the 
application for asylum itself;  

 

it contributes to preventing, detecting and investigating serious criminal offences.  

2.3. 

Has the VIS been relevant in view of its objectives? 

The evaluation showed that the VIS addresses the needs, problems and issues for which the 
system was first set up. 

This  makes  VIS  essential  for  the  good  functioning  of  the  common  visa  policy  and  in 
supporting  the  common  free  movement  area.  It  has  introduced  increased  transparency 
into  the  visa  process,  especially  by  linking  applications,  and  has  led  to  more  harmonised 
procedures  by  incentivising  Member  States  to  seek  out  common  practice  when  assessing 
applications. 

The  VIS  has  also  made  the  visa  process  and  its  end  result  more  predictable  for  visa 
applicants. 

Furthermore, the VIS has proven to be an essential tool in the detection of identity theft and 
visa  shopping  through  the  use  of  biometrics.  The  biometric  check  is  considered  the 
cornerstone of the common identification and verification procedure.  

While the evaluation identified areas for further improvement, these are mostly technical and 
do not imply reviewing the initial objectives of the VIS. 

7 

 
 
 
 
 
2.4. 

Is the VIS coherent with other pieces of relevant EU legislation? 

The  evaluation  showed  a  high  level  of  consistency  between  the  VIS  and  other  EU  policies, 
and that the consistency between the VIS and other EU home affairs policies is increasing. 

There are four policy areas in particular with which the VIS is very coherent: 

-  border  and  migration  policy  —  probably  the  most  significant  and  positive  impact. 
The VIS facilitated checks at external border crossing points and within the Member 
States’  territory  and  helped  identify  people  who  do  not,  or  no  longer,  fulfil  the 
conditions for entry to, stay or residence on the territory of the Member States; 

-  asylum  policy  —  the  VIS  supports  the  application  of  the  Dublin  Regulation  by 
providing a clear and irrefutable means of proof as regards the visa criterion, as well 
as useful information necessary in the process of examining an asylum application for 
a person previously detected in the VIS; 

-  return policy — although use of the VIS in the return procedure has so far been rather 
limited,  the  recent  trends  indicate  an  increased  need  to  use  this  instrument  which 
provides the indisputable proof of identity necessary in a return procedure; 

- 

security policy — for the time being, access to the VIS for law enforcement purposes 
on the basis of the VIS Decision remains quite fragmented across the Member States. 
However, the high level of satisfaction and real or expected benefits from such access 
suggest that the number of users and requests will increase in the future. 

The VIS is one of the three main centralised information systems developed by the EU in the 
area of home affairs, together with:  

 

 

the Schengen Information System (SIS), which provides a broad spectrum of alerts 
on persons and objects; and  

the  Eurodac  system,  which  contains  the  fingerprint  data  of  asylum  applicants  and 
third-country nationals who have crossed the external borders irregularly.  

These three systems are complementary in their tasks related to securing the external borders 
and supporting national authorities in fighting crime and terrorism. 

It  is  also  an  important  tool  that  helps  asylum  authorities  to  determine  the  Member  State 
responsible for examining an asylum application and subsequently in the actual examination 
of applications. 

The VIS is also coherent with the EU policies on trade and tourism as the evaluation did not 
find  any  significant impact  of  the introduction  of  the  VIS  on  these  fields,  nor  a  decrease in 
tourism or business travel to the Member States. 

2.5. 

Does the VIS generate EU added value? 

The  evaluation  has  showed  that  VIS  is  an  indispensable  tool  for  the  implementation  of  an 
effective and efficient common visa policy and is increasingly contributing to the security of 

8 

 
 
 
the EU external borders, to fight irregular migration and help in the fight against terrorism and 
other serious crimes, thereby generating further EU added value.  

The  role  of  the  VIS  in  the  current  framework  of  EU-wide  IT  instruments  for  borders  is 
increasing.  The  recent  proposal  by  the  Commission  on  an  Entry/Exit  System  (EES)21 
would also led to significant amendments to the VIS Regulation, notably by ensuring the 
interoperability between the two systems and changing the way in which checks against the 
VIS are performed at border crossing points. This would enable direct consultation between 
the two systems in both directions (EES to VIS and vice-versa) at border crossing points and 
in consulates. 

A  return  to  a  state  of  affairs  in  which  exclusively  national  systems  are  used  to  ensure  the 
security of the external borders, fight visa and identity fraud, thus irregular migration, or assist 
in the fight against terrorism and other serious crimes is not an option at this point in time.  

3. 

THE COMMISSION’S VIEWS ON THE FINDINGS OF THE EVALUATION 

In  the  context  of  this  evaluation  the  Commission  has  identified  a  number  of  key  areas  in 
which  any  existing  problem  will  need  to  be  addressed  in  order  to  ensure  that  the  VIS  can 
better deliver on its main objectives. 

3.1. 

Data quality 

Data  quality  is  at  the  top  of  the  list  of  priority  areas  identified  by  the  evaluation.  Problems 
with data quality mostly stem from sub-optimal application of the legal provisions, although 
in a few cases the law insufficiently responds to the quality needs required for an efficient use 
of the system. 

Quality  problems  have  been  found  for  both  alphanumeric  and  biometric  data.  Typical 
problems include:  

  confusing  the  various  grounds  for  exemption  from  the  obligation  to  provide 

fingerprints; 

  confusion  over  the  distinction  between  biometrics  not  being  compulsory  for  legal 
reasons (such as the applicant being a head of state or government or a child below the 
age of 12) and the physical impossibility to provide fingerprints.  

In the latter case, a further distinction should also be made between temporary and permanent 
impossibility. 

As  regards  alphanumeric  data,  although  the  Member  States  have  a  clear  legal  obligation  to 
insert all data from the visa application into the VIS, they are still not fully implementing this 
obligation. The introduction of the VIS Mail communication network and its organic link with 

21  Proposal for a Regulation of the European Parliament and of the Council establishing an Entry/Exit System 
(EES) to register entry and exit data and refusal of entry data of third country nationals crossing the external 
borders of the Member States of the European Union and determining the conditions for access to the EES for 
law enforcement purposes and amending Regulation (EC) No 767/2008 and Regulation (EU) No 1077/2011, 
COM(2016) 194 final. 

9 

 
 
                                                 
the  VIS  will  mean  that  in  future  consultations  through  VIS  Mail  will  not  be  possible  if  the 
available data has not been fully aligned with the requirements of any given consultation. 

The  importance  of  correctly  linking  the  applications  of  the  same  person  or  of  persons 
travelling in a group was repeatedly highlighted throughout the evaluation. An incorrect link 
could  have  serious  consequences  on  the  capacity  to  follow  the  history  of  a  person’s 
applications and thus undermines the purpose of registering the data in the VIS. It is therefore 
paramount  that  where  erroneous  links  are  found,  they  are  immediately  corrected.  In  future, 
Member States other than the one that created a link should be given the possibility to correct 
the mistake and alter an erroneous link. 

3.2. 

Reporting for monitoring and statistics 

Finding  informative  and  reliable  statistics  was  one  of  the  major  hurdles  encountered  while 
gathering information for the evaluation and in the other processes which fed into this report. 

Without hard quantitative evidence, the Commission would not be able to:  

  properly  monitor  how  the  Member  States  are  applying  EU  law  (whether  during  the 
evaluation of a policy or in targeted processes such as the Schengen evaluation);  

 

justify policy developments. 

The  current  VIS  Regulation  entrusts  the  task  of  producing  statistics  exclusively  to  the 
Member States. However, in a centralised system such as the VIS, having 26 different states 
produce  and  compile  data  in  a  disparate  manner  is  inefficient  and  creates  unnecessary 
administrative  burden.  In  practice,  most  of  these  data  are  easily  and  immediately  available 
from  the  VIS  and  can  be  easily  compiled  with  a  minimum  of  effort  and  anonymised  for 
various statistical or testing purposes. 

3.3. 

Use of the VIS when collecting the data 

While the evaluation found that the VIS significantly facilitated the fight against visa fraud, 
the  system  was  not  conceived  to  prevent  fraud  involving  false  documents/false  passports 
presented during a visa application. Given that the obligation to check travellers’ fingerprints 
makes  it  harder  for  fraudsters  to  cross  the  border  using  fraudulent  visa  stickers,  a  possible 
knock-on  effect  could  be  a  shift  from  the  use  of  fraudulent  visa  stickers  towards  the  use  of 
visas obtained under false pretences in consulates (at the time of applying for a visa). In turn 
this would lead to an increase in the likelihood of fraud involving other types of documents 
(e.g.  travel  documents).  To  prevent  this,  consulates  should  verify  the  applicant’s  identity 
before taking the fingerprints, making appropriate use of existing detection measures. 

The  Visa  Code  provides  that  for  59  months  following  the  recording  of  fingerprints  for  an 
application, those fingerprints should be copied when subsequent applications are made. This 
means  that  the  person  does  not  need  to  appear  in  person  again  or  give  fingerprints  again. 
However, the evaluation showed that this is rarely the case in practice. Member States often 
repeat  the  taking  of  fingerprints  at  each  application  either  due  to  doubts  over  the  person’s 

10 

 
 
 
 
identity, or because the person does not remember whether fingerprints have been previously 
taken or when this was done. 

3.4. 

Use of the VIS at external borders 

The  VIS  has  a  very  positive  impact  on  the  reinforcement  and  the  facilitation  of  controls  at 
external  borders.  In  particular,  the  checking  of  fingerprints  in  combination  with  the  visa 
number provides an important contribution to the fight against visa fraud. 

Although  verification  against  the  VIS  with  the  visa  number  in  combination  with  the 
fingerprints  has  been  mandatory  since  October  2011,  the  implementation  of  this  obligation 
remains unsatisfactory and varies greatly between Member States. 

It  may  be  expected  that  the  gradual  disappearance  of  visas  issued  without  collecting 
fingerprints (i.e. visas issued before the roll-out in a particular region) will lead to an increase 
in  the  checks  against  the  VIS  at  external  borders  and  especially  of  checks  that  use  a 
combination of the visa number and fingerprints. 

3.5. 

Use of the data for asylum purposes 

The  VIS  is  an  important  tool  for  determining  the  Member  State  responsible  for  examining 
asylum  applications.  It  provides  information  on  whether  the  asylum  applicant  has  been 
granted  a  visa  and  on  the  identity  of  the  asylum  applicant  in  a  fast  and  reliable  way.  It 
therefore provides evidence for determining the Member State responsible and facilitates the 
‘take charge’ based on the ‘visa’ criterion under the Dublin Regulation. 

As confirmed by Member States that made use of the VIS for asylum purposes, the VIS can 
be used not only to support the application of the Dublin Regulation, but also when examining 
asylum  applications,  in  particular  to  identify  applicants  and  determine  their  credibility. 
However,  the  evaluation  showed  that  only  few  Member  States  use  the  VIS  for  asylum 
purposes22. 

3.6. 

Use of the data for law enforcement purposes 

Access to VIS for law enforcement purposes was introduced very recently and therefore the 
results of the evaluation remain fragmentary and inconclusive. Only preliminary lessons can 
be  drawn  from  data  provided  by  the  Member  States.  There  is  potential  for  increased  use  of 
VIS in the law enforcement context given that the VIS is clearly seen overall as an effective 
and  useful  instrument  supporting  the  prevention,  detection  and  investigation  of  terrorist 
offences and other serious criminal offences. VIS may provide valuable information that can 
help identify suspects or victims and facilitate criminal investigations. 

22  The  VIS  was  used  for  asylum  purposes  for  the  Dublin  procedure  by  12  Schengen  Member  States  and  for 
examining an asylum application by 15 Member States, though the vast majority of the searches were carried 
out by four Member States only. For further details see Section 6.1.6 of the SWD and Section 1.6 of Annex 2 
of the SWD. 

11 

 
 
 
 
 
                                                 
However  the  use  of  VIS  in  law  enforcement  is  still  very  fragmented  across  the  Member 
States. In particular, the possibility for fingerprint searches is not yet used. The evaluation did 
not  identify  specific  reasons  for  the  low  use  of  the  access  to  VIS  for  law  enforcement 
purposes. However, the current shortcomings may be explained by the relative novelty of the 
system, lack of awareness among potential users and technical and administrative difficulties. 

3.7. 

Data protection in the VIS 

The  rights  of  data  subjects  are  an  important  part  of  data  protection  law.  Ensuring  that  data 
subjects can access, rectify and erase data held about them increases the transparency of data 
processing  for  them,  helps  to  uncover  unlawful  processing  and  increases  data  quality  for 
lawful  processing.  These  considerations  are  all  the  more  relevant  in  a  field  such  as  visa 
applications,  where  compliance  with  the  legal  framework  is  especially  important  given  the 
adverse consequences unlawful processing might have here. 

A notable phenomenon identified by the evaluation was the absence, or very low number, of 
requests by data subjects to exercise their rights to access, correct or delete their personal data 
stored in the VIS. The finding could be explained by Member States’ good performance on 
the protection of personal data. However, it could also in part be due to data subjects being 
unaware of their data protection rights and not knowing how to exercise them (e.g. to whom 
data subjects should address their requests). 

Inspections on the spot by the European data Protection Supervisor to monitor the lawfulness 
of the processing of personal data and security audits of the VIS central system have not led to 
identify  data  protection  issues.  In  its  almost  three  years  of  operation,  eu-LISA  has  not 
received any complaint related to data protection. 

4. 

NEXT STEPS 

4.1. 

Short-/medium-term measures 

Quality issues 

In order to improve data quality at an early stage of the visa application procedure, indicators 
on  data  quality  defects  could  be  introduced  and  used  to  check  applications  when  they  are 
submitted.  For  instance,  a  short  list  of  indicators  could  be  established  for  each  application 
highlighting  the  field  deficiency  (e.g.  a  date,  a  name,  a  wrong  data,  etc.),  alerting  any 
future user to the fact that a potential quality defect is present. 

Appropriate measures should also be considered to ensure that prior consultations are not put 
at  risk  because  of  missing  information  in  the  VIS.  To  solve  this  issue,  the  VIS  could  be 
programmed  to  refuse  to  launch  a  request  for  prior  consultation  until  all  appropriate 
information required in Article 9 of the VIS Regulation is properly filled in the system. 
Additionally,  the  system  should  allow  a  quick  and  unambiguous  identification  of  persons 
whose  fingerprints  are  missing  from  the  system  and  the  reason  thereof  in  order  to  avoid 
prolonged searches at border crossing points. 

12 

 
 
 
As regards fingerprints, the system needs to be technically adjusted so that it can better 
distinguish  between  cases  where  fingerprints  are  not  required  for  legal  reasons  and 
cases  where  there  is  a  factual  reason  why  they  cannot  be  provided.  This  will  make  the 
system better able to provide unambiguous data that can be used to check that consulates are 
properly  applying  the  obligations  on  fingerprints  and identify  cases  in  which  a  person  was 
refused a visa because there was a factual reason why he or she could not provide fingerprints. 

To  address  reported  hindrances  in  collecting  biometrics,  in  particular  those  affecting  the 
quality  of  facial  images,  and  to  allow  in  the  future  combined  searches  using  facial  image, 
alternative  standards  could  be  put  in  place,  such  as  taking  photographs  directly  when 
applying for a visa. 

Centralised  monitoring  of  the  data  quality  and  the  identification  and  implementation  of 
common  solutions  thereto  would  ensure  a  more  efficient  response  to  these  issues.  For  this 
reason, in the future, eu-LISA should be entrusted a role in this respect, including the task of 
producing data quality reports. 

Centralised technical solutions for prior consultation and representation 

A centralised technical solution to be applied uniformly by all Member States concerned by a 
prior consultation could be envisaged, possibly in the form of a  matrix of identification of 
the recipient Member States. It would create synergies and make it easier for Member States 
to maintain the IT systems concerned, as well as ensure that the relevant data are stored in the 
VIS prior to launching a consultation.  

A centralised technical solution to identify recipient Member States concerned by an ex 
post notification could also be considered. In this way the relevant data would be  stored in 
the system before a notification is sent. 

Finally,  a  centralised  technical  solution  in  the  VIS  could  also  be  considered  for  the 
matrix of Member States’ consular representation. This would benefit Member States by 
removing  the  need  to  include  technical  definitions  in  the  representation  agreements  and  by 
making  it  overall  easier  to  conclude  new  agreements.  It  would  also  be  beneficial  for 
applicants because it would remove the uncertainty over the way the procedure is conducted 
in the case of representation. 

Integration of VIS Mail into the VIS 

In  order  to  make  exchanges  between  the  central  system  and  the  national  systems  more 
coherent,  the  VIS  Mail  mechanism  for  consultations  should  be  integrated  into  the  VIS 
infrastructure. Such a measure would also make it easier for the Member States to perform 
their tasks, because there would be fewer systems to manage and maintain at national level. 
the  necessary 
This  measure 

accompanied  by 

examination  of 

could  be 

an 

13 

 
 
messages/notifications  (e.g.  consular  cooperation,  VLTV23  issue  notifications)  to  be  run 
through the VIS Mail. 

Multiple fingerprint collection within 59 months 

A  possible  solution  to  address  the  current  issue  with  the  59-month  rule  on  copying 
fingerprints could be to have each consulate issue a  receipt certifying that it collected the 
fingerprints of a particular applicant on a particular date. The person concerned would be 
instructed to present this receipt when applying for a visa again within the next 59 months. 

Access to the VIS for law enforcement purposes 

Given the recent introduction of access to the VIS for the purposes of preventing, detecting 
and  investigating  terrorist  offences  and  other  serious  criminal  offences,  further  information 
and evidence are necessary to identify why the system has so far been consulted infrequently 
for this purpose.    

In future, law enforcement authorities could be given the possibility to search the VIS using 
latent  fingerprints  and  photographs.  This  would  make  such  searches  more  useful  and 
efficient. 

Use of the VIS on a systematic basis at borders 

Member  State  authorities  should  be  encouraged  to  comply  with  the  existing  obligation  to 
perform  mandatory  checks  against  the  VIS  using  the  visa  number  in  combination  with 
the  visa  holder’s  fingerprints.  Practical  information  on  visa  checks  at  external  borders  is 
available in  the Practical Handbook for border  guards and was updated in line with the full 
roll-out  of  the  system.  In  addition,  the  planned  increased  interoperability  between  the 
information  systems  available  at  the  external  borders  may  facilitate  and  speed  up  the 
required checks. Since delays in border crossings are one of the main obstacles to systematic 
checks  against  the  VIS,  this  increased  operability  and  the  development  of  the  entry-exit 
system should have a positive impact. 

Use of the VIS to identify people apprehended in connection with the irregular crossing of an 
external border or found to be illegally staying in a Member State 

Member  States  should  consider  introducing  systematic  checks  of  irregular  migrants 
without valid travel documents  within the territory so that they can be identified for the 
purpose of return. Although third countries often do not consider data collected from the VIS 
as sufficient evidence for issuing travel documents for the purpose of return, the system can 
still be useful for establishing the nationality and in subsequent investigations. Furthermore, 
most recent EU readmission agreements qualify the results of searches in the VIS as proof of 
nationality. 

The VIS is currently used for return purposes only to a very limited extent. However, the VIS 
could play a much more significant role if given the possibility to store a scanned data page 

23  Visas with limited territorial validity. 

14 

 
 
                                                 
of  the  visa  applicant’s  passport.  Providing  Member  States  with  the  possibility  to  access  a 
copy of the passport of an irregular migrant could improve the chances of effective return and 
accelerate the procedure. This would also enable more returns to be carried out on the basis of 
the EU travel document for return purposes24 combined with a copy of the passport. 

Systematic use of the VIS for asylum applications 

The potential of the VIS for asylum purposes should be exploited by all Member States in a 
more  systematic  manner.  All  Member  States  should  be  encouraged  to  use  the  VIS  for 
asylum purposes to:  

  determine the Member State responsible for examining an asylum application in order 

to ensure a more effective and uniform practice; and 

  when examining the substance of the asylum application in order to help establish the 

applicant’s identity and credibility. 

As  regards  the  Dublin  procedure,  the  proposal  for  a  recast  of  the  Dublin  III  Regulation25 
provides  for  an  obligation  for  Member  States  to  search  in  the  VIS.  In  future,  asylum 
authorities should be allowed access to check the purpose of travel, as part of the credibility 
assessment. 

Data protection 

National  data  protection  authorities  should  be  invited  to  carry  out  quality  controls  on  the 
information  provided  to  data  subjects  by  diplomatic  missions,  consular  posts  and  external 
service  providers,  and  to  carry  out  more  systematic  checks,  including  audits  of  the  national 
VIS.   

Increased search efficiency to combat fraud 

The VIS has significantly improved the fight against identity fraud in the visa procedure and 
at borders, essentially by using biometrics. The scope of second line searches at borders for 
travellers  for  whom  it  is  physically  impossible  to  check  with  fingerprints  (or  for  whom 
fingerprinting  was  physically  impossible  at  the  time  of  applying  for  a  visa)  could  be 
broadened to  allow inexact results. Such results would  provide more information  to border 
guards, enabling them to establish whether any suspicion of fraud exists. 

Statistics based on VIS data 

On the production of statistics, entrusting eu-LISA with the task of generating reports on 
behalf  of  Member  States  seems  the  appropriate  step  forward.  Similar  to  what  has  been 
proposed for the EES, eu-LISA could be required to establish a central repository of data and 
make  it  available  on  a  regular  basis  to  the  Commission,  Member  States,  and  EU  agencies 
(such  as  Frontex  or  Europol).  For  this  purpose,  eu-LISA  should  be  entrusted  with  keeping 

24 Proposal for a Regulation of the European Parliament and of the Council on a European travel document for 

the return of illegally staying third-country nationals, COM(2015) 668 final, 15.12.2015. 

25  COM(2016) 270 final. 

15 

 
 
                                                 
also  the  records  of  data  processing  operations  carried  out  in  the  application  of  Decision 
2008/633/JHA.  In  the  longer  run  it  should  be  made  possible  for  these  data  to  be  combined 
with those of other databases (e.g. EES) in order to generate strategic reporting on migration 
trends. Member States could then have access to: 

- 

- 

technical statistics (creation of visa application files, searches, border authentications 
per hour, day, month, year etc.); 

figures  about  the  VIS  performance  against  the  objectives  (both  overall  data  and  per 
Member State); 

-  business intelligence and analytics on the VIS data (possibility of a separate repository 
similar  to  the  one  in  EES),  considering  all  Member  States’  visa  activity.  In  this 
respect, the task of producing visa statistics could be transferred from the Commission 
(task allocated to it in the Visa Code) to eu-LISA. 

In addition, the report on the technical functioning of the VIS currently produced by eu-
LISA  every  two  years  could  be  made  annual.  This  would  improve  the  monitoring  of  the 
system and align the relevant provisions with those of similar instruments (SIS, Eurodac). 

A  revised  VIS  Regulation  should  enable  the  Commission  to  request  that  eu-LISA  provide 
statistics  on  specific  aspects  of  the  system’s  implementation  or  on  Member  States’ 
implementation  of  various  VIS-related  policy  aspects,  in  particular  data  necessary  for  the 
Schengen evaluations of the Member States. 

4.2. 

Other possible future developments of the VIS 

In  addition  to  learning  the  lessons  from  the  past  application  of  the  VIS  legal  framework, 
attention  must  also  be  directed  towards  VIS’s  potential  future  uses.  In  a  world  ever  more 
interconnected and with the complex inter-linkages of the various policy areas, the VIS offers 
multiple unquantifiable benefits in border security. These include potential easy and low cost 
interconnectivity with:  

  existing EU systems (SIS, Eurodac); 

  upcoming EU systems (EES); 

  databases (Stolen and Lost Travel Documents). 

Following the Communication on Stronger and Smarter Information Systems for Borders and 
Security26 (‘Smart Borders’ Communication) adopted on 6 April 2016, the Commission set up 
a  High  Level  Expert  Group  on  Information  Systems  and  Interoperability,  tasked  with 
addressing  the  legal,  technical  and  operational  aspects  of  the  different  options  to  achieve 
interoperability  of  the  SIS,  VIS  and  Eurodac.  A  final  report  with  recommendations  is 
expected by mid-2017, which may result in legal amendments to the VIS in order to achieve 
interoperability with other systems. 

26  COM(2016) 205 final. 

16 

 
 
 
                                                 
legislative  proposal 

Furthermore,  a 
to  establish  an  EU  Travel  Information  and 
Authorisation System (ETIAS) will be presented before the end of the year, along with new 
tasks for eu-LISA, including developing a central monitoring capacity for data quality for all 
systems. 

In  progressing  and  implementing  further  technical  and  operational  interoperability  and  new 
functions the fundamental right to protection of personal data as recognised in Article 8 of the 
Charter  of  Fundamental  Rights,  and  in  particular  the  purpose  limitation  principle  deriving 
from that right27 must be taken into account.    

In  exploring interoperability of large scale systems special  consideration should  be given to 
data protection by design - requirements as mentioned in Article 25 of the new General Data 
Protection  Regulation  2016/679  and  Article  20  of  the  Data  Protection  Police  Directive 
2016/680. 

Additionally, the eu-LISA evaluation conducted in 201528 found that to ensure full coherence 
of  the  operational  management  of  the  VIS,  Commission's  responsibilities  regarding  the 
communication infrastructure should be transferred to eu-LISA. Some of these initiatives and 
findings will require amendments to the VIS legal instruments and other legal acts. 

The evaluation highlighted some interest from Member States in also having information on 
national long-stay visas, including biometrics registered in the VIS. 

The  possibility  to  adapt  the  configuration  of  the  central  system  to  better  respond  to  the 
need to rapidly and efficiently adapt to availability needs in periods of disruption should also 
be analysed. 

In order to allow eu-LISA to test the various VIS functions more realistic testing solutions in 
line with the applicable data protection framework should be facilitated for eu-LISA. 

Finally, as indicated by the study on the reliability of fingerprinting of children below the age 
of  1229,  and  taking  into  account  the  2016  Commission  Report  on  human  trafficking30,  the 

27  Article  4  (1)  b)  of  Regulation  (EC)  No  45/2001  of  the  European  Parliament  and  of  the  Council  of  18 
December2000  on  the  protection  of  individuals  with  regard  to  the  processing  of  personal  data  by  the 
Community institutions and bodies and on the free movement of such data. 
Article 6 (1) b) of the Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 
on the protection of individuals with regard to the processing of personal data and on the free movement of 
such data, later replaced by Article 5 (1) b) of Regulation (EU) 2016/679 of the European Parliament and of 
the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal 
data  and  on  the  free  movement  of  such  data,  and  repealing  Directive  95/46/EC  (General  Data  Protection 
Regulation), OJ L 119, 4.5.2016, p. 1–88. 
Article  3  of  the  Council  Framework  Decision  2008/977/JHA  of  27  November  2008  on  the  protection  of 
personal data processed in the framework of police and judicial cooperation in criminal matters, later replaced 
by  Article  4 (1) b) of Directive  (EU) 2016/680  of  the  European  Parliament  and of  the  Council  of 27  April 
2016  on  the  protection  of  natural  persons  with  regard  to  the  processing  of  personal  data  by  competent 
authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or 
the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework 
Decision 2008/977/JHA, OJ L 119, 4.5.2016, p. 89–131. 

28 "Independent external evaluation of the European Agency for the operational management of large-scale IT 
systems  in  the  area  of  freedom,  security  and  justice  -  eu-LISA",  ISBN:  978-92-79-58236-3,  Catalogue 
number, DR-01-16-464-EN-N. 

29  See Report EUR 26193 EN, ‘Fingerprint Recognition for Children’, carried out by the JRC. 

17 

 
 
                                                 
possibility to reduce the age limit for collecting fingerprints of children to 6 years of age 
should  be  further  explored,  taking  into  account  the  best  interests  of  the  child  and  in 
order to assess in particular its potential to assist in identifying victims of trafficking in human 
beings and detecting traffickers. 

4.3. 

Possible legislative revisions 

Some of the shortcomings identified in the evaluation of the VIS legal framework and some 
of the recommendations for improvement can only be addressed through a revision of the VIS 
legal base. This would include, for example:  

 

 

 

transferring the responsibility for producing statistics to eu-LISA;  

interconnectivity with other systems;  

improved data quality rules and the production of data quality reports;  

  scrapping  obsolete  provisions  of  the  current  law  (e.g.  on  the  roll-out,  the  setup  and 

transition to VIS Mail or various transition periods). 

Where a legislative revision is envisaged and where appropriate, the Commission will conduct 
an  impact  assessment  that  will  analyse  and  assess  the  likely  impacts  of  the  different  policy 
options for such a proposal. 

30  Commission  staff  working  document  accompanying  the  document  Report  from  the  Commission  to  the 
European Parliament and the Council on the progress made in the fight against trafficking in human beings, 
SWD(2016) 159 final. 

18