Source: EURLEX
Language: en
Format: md

**Council of the**
**European Union**

**Interinstitutional File:**

**2020/0312(NLE)**

**OUTCOME OF PROCEEDINGS**

From: General Secretariat of the Council

To: Delegations

No. prev. doc.: 14245/20

**Brussels, 25 January 2021**
**(OR. en)**

**5535/21**

**SCH-EVAL 12**
**DATAPROTECT 15**
**COMIX 43**

Subject: Council Implementing Decision setting out recommendations addressing
the deficiencies identified in the evaluation of **Cyprus** in view of fulfilling the
conditions necessary for the application of the Schengen acquis in the field
of **data protection**

Delegations will find enclosed the Council Implementing Decision setting out recommendations

addressing the deficiencies identified in the evaluation of Cyprus in view of fulfilling the conditions

necessary for the application of the Schengen acquis in the field of data protection, adopted by

written procedure on 21 January 2021.

In line with Article 15(3) of Council Regulation (EU) No 1053/2013 of 7 October 2013, this

Recommendation will be forwarded to the European Parliament and national Parliaments.

5535/21 EN/mdc 1

# JAI.B EN

Council Implementing Decision setting out

**RECOMMENDATIONS**

**addressing the deficiencies identified in the evaluation of Cyprus in view of fulfilling the**

**conditions necessary for the application of the Schengen acquis in the field of data protection**

THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Council Regulation (EU) No 1053/2013 of 7 October 2013 establishing an

evaluation and monitoring mechanism to verify the application of the Schengen acquis and

repealing the Decision of the Executive Committee of 16 September 1998 setting up a Standing

Committee on the evaluation and implementation of Schengen **[1]**, and in particular Article 15 thereof,

Having regard to the proposal from the European Commission,

Whereas:

(1) The purpose of this decision setting out a recommendation is to recommend to Cyprus

remedial actions to address the deficiencies identified during the Schengen evaluation of the

conditions necessary for the application of the Schengen acquis in the field of data

protection, carried out in 2019. Following the evaluation, a report covering the findings and

assessments, listing best practices and deficiencies identified during the evaluation was

adopted by Commission Implementing Decision C(2020)8150.

**1** OJ L 295, 6.11.2013, p. 27.

5535/21 EN/mdc 2

# JAI.B EN

(2) The on-site team very much welcomes the recent increase in human and financial resources

assigned to the Data Protection Authority (DPA). The engagement of the DPA in providing

general awareness-raising activities and the upload of presentations and speeches on the

DPA’s website are considered as best practice. The training program for police officers on

SIS II legislation and data protection put in place by the Cyprus Police is also seen as a good

practice.

(3) In light of the importance of complying with the Schengen acquis on data protection,

priority should be given to implementing recommendations 1, 3, 5, 6, 8, 9 and 11.

(4) This Decision should be transmitted to the European Parliament and to the parliaments of

the Member States. Within three months of its adoption, Cyprus should, pursuant to

Article 16 of Regulation (EU) No 1053/2013, establish an action plan listing all

recommendations to remedy any deficiencies identified in the evaluation report and provide

that action plan to the Commission and the Council,

RECOMMENDS:

that Cyprus should:

**Data Protection Authority (thereafter: DPA)**

1. provide evidence for steps undertaken to ensure that the DPA possesses sufficient human and

budgetary resources for the future monitoring and supervision of the processing of personal

data in the framework of the Schengen acquis;

2. implement, and provide a copy, of a Supervision Plan of the Cypriot SIS and VIS covering

the deployment and the implementation phase for the next three years including all planned

supervisory activities both during the implementation phase and when the systems become

operational;

5535/21 EN/mdc 3

# JAI.B EN

**Rights of data subjects**

3. ensure that information about the processing of personal data and the exercise of their rights

in SIS II and VIS on the websites of the Police and the MFA is also available at least in

English and easily accessible to the data subjects. In particular, specific standard forms/model

letters for data subjects’ requests in relation to SIS II and VIS should be made available on

their respective websites;

4. display a visible notice and provide data subjects with information leaflets on their rights and

on the processing of their data at the premises of the MFA and in all places where authorities

are processing personal data in N.VIS on behalf of the MFA, such as at the border control and

the kiosks;

**Visa Information System**

5. ensure that a national legislation on N.VIS is put in place as soon as possible;

6. take all the necessary measures to implement the new N.VIS and to ensure its compliance

with the VIS acquis and the data protection requirements;

7. ensure that the MFA implements a procedure for the collection and retention of logs aligned

with the requirements of the VIS Regulation;

8. take the necessary measures to ensure the stability of the position of the Data Protection

Officer at the MFA, and ensure his or her appropriate involvement during the design and

implementation phases of the new N.VIS;

**Schengen Information System**

9. ensure that the national legislation on N.SIS II is adopted as soon as possible;

10. ensure that all relevant issues in relation to the protection of personal data are properly

discussed by all stakeholders, and that a data protection impact assessment of the envisaged

processing operations on the protection of personal data is carried out before N.SIS II goes

live;

5535/21 EN/mdc 4

# JAI.B EN

11. ensure that all relevant measures are taken to preserve data quality throughout the information

life cycle;

12. carry out tests to ensure the proper integration of the N.SIS II with the Police legacy systems

and to finalise the process to replace obsolete computer equipment;

13. ensure that personnel profiles are created and documented in accordance with Article 10(1)(g)

SIS II Council Decision and Regulation;

14. submit a specific security plan in line with the legal requirements;

15. ensure the development of a comprehensive policy guaranteeing that self-auditing activities in

the sense of Article 10(1)(k) of the SIS II Council Decision and Regulation are in place before

N.SIS II goes live;

**Awareness raising**

16. provide information on the planning of activities for increasing the level of awareness of the

public on SIS and VIS;

**International Cooperation**

17. confirm that the DPA will participate regularly in the activities of the SIS II Supervision

Coordination Group and VIS Supervision Coordination Group set up in implementation of the

Schengen acquis as of 2020.

Done at Brussels,

_For the Council_

_The President_

_________________

5535/21 EN/mdc 5

# JAI.B EN