Changes from plenary report to adopted text

RemovedChapter V – title: PROCEDURE FOR COMPARISON OF DATA FOR APPLICANTS FOR INTERNATIONAL PROTECTION, RESETTLED THIRD-COUNTRY NATIONALS AND STATELESS PERSONS AND THIRD-COUNTRY NATIONALS APPREHENDED CROSSING THE BORDER IRREGULARLY OR ILLEGALLY STAYING IN THE TERRITORY OF A MEMBER STATE

RemovedArticle 15 – paragraph 1: 1. Biometric data transmitted by any Member State, with the exception of those transmitted in accordance with Article 11(b) and (c), shall be compared automatically with the fingerprint data transmitted by other Member States and already stored in the Central System in accordance with Articles 10(1), 12a, 13(1) and 14(1).

RemovedArticle 15 – paragraph 3: 3. The Central System shall automatically transmit the hit or the negative result of the comparison to the Member State of origin following the procedures set out in Article 26(4). Where there is a hit, it shall transmit for all data sets corresponding to the hit the data referred to in Articles 12, 12b, 13(2) and 14(2) along with, where appropriate, the mark referred to in Article 19(1) and (4). Where a negative hit result is received, the data referred to in Articles 12, 12b, 13(2) and 14(2) shall not be transmitted.

RemovedArticle 16 – title: Comparison of facial image data only

RemovedArticle 16 – paragraph 2: (2) Facial image data and data relating to the sex of the data-subject may be compared automatically with the facial image data and personal data relating to the sex of the data-subject transmitted by other Member States and already stored in the Central System in accordance with Articles 10(1), 12a, 13(1) and 14(1) with the exception of those transmitted in accordance with Article 11(b) and (c).

RemovedArticle 16 – paragraph 4: (4) The Central System shall automatically transmit the hit or the negative result of the comparison to the Member State of origin following the procedures set out in Article 26(4). Where there is a hit, it shall transmit for all data sets corresponding to the hit the data referred to in Articles 12, 12b, 13(2) and 14(2) along with, where appropriate, the mark referred to in Article 19(1) and (4). Where a negative hit result is received, the data referred to in Articles 12, 12b, 13(2) and 14(2) shall not be transmitted.

RemovedArticle 17 – paragraph 1: 1. For the purposes laid down in Article 10(1), each set of data relating to an applicant for international protection , as referred to in Article 12, shall be stored in the Central System for five years from the date on which the fingerprints were first taken.

RemovedArticle 17 – paragraph 1 a (new): 1a. For the purposes laid down in Article 12a, each set of data relating to a resettled third-country national or stateless person shall be kept in the Central System for five years from the date on which the fingerprints were taken.

RemovedArticle 17 – paragraph 2: 2. For the purposes laid down in Article 13(1), each set of data relating to a third-country national or stateless person as referred to in Article 13(2) shall be stored in the Central System for a period limited to the duration of a measure taken upon the third-country national or stateless person which shall not be more than five years from the date on which his or her fingerprints were first taken.

RemovedArticle 17 – paragraph 3: 3. For the purposes laid down in Article 14(1), each set of data relating to a third-country national or stateless person as referred to in Article 14(2) shall be stored in the Central System for a period limited to the duration of a measure taken upon the third-country national or stateless person which shall not be more than five years from the date on which his or her fingerprints were first taken.

RemovedArticle 18 – paragraph 1: 1. Data relating to a person who has acquired citizenship of any Member State before expiry of the period referred to in Article 17(1) , (2) or (3) shall be erased from the Central System in accordance with Article 28(4). The Member State of origin shall be informed immediately if the person concerned has acquired such citizenship in order to erase the data.

RemovedArticle 18 – paragraph 2: 2. The Central System shall, as soon as possible and no later than after 72 hours, inform all Member States of origin of the erasure of data in accordance with paragraph 1 by another Member State of origin having produced a hit with data which they transmitted relating to persons referred to in Articles 10(1), 12a, 13(1) or 14(1).

RemovedArticle 19 – paragraph 1: 1. For the purposes laid down in Article 1(1)(a), the Member State of origin which granted international protection to an applicant for international protection whose data were previously recorded in the Central System pursuant to Article 12 shall mark the relevant data in conformity with the requirements for electronic communication with the Central System established by eu-LISA . That mark shall be stored in the Central System in accordance with Article 17(1) for the purpose of transmission under Articles 15 and 16. The Central System shall, as soon as possible and no later than 72 hours, inform all Member States of origin of the marking of data by another Member State of origin having produced a hit with data which they transmitted relating to persons referred to in Article 10(1), 13(1) or 14(1). Those Member States of origin shall also mark the corresponding data sets.

RemovedArticle 19 – paragraph 2 – subparagraph 1: The data of beneficiaries of international protection stored in the Central System and marked pursuant to paragraph 1 of this Article shall be made available for comparison for the purposes laid down in Article 1(1)(c) until such data are automatically erased from the Central System in accordance with Article 17(4).

RemovedArticle 20 – title: Procedure for comparison of biometric or alphanumeric data with Eurodac data

RemovedArticle 20 – paragraph 1: 1. For the purposes laid down in Article 1(1)(c), the designated authorities referred to in Articles 6(1) may submit a reasoned electronic request as provided for in Article 21(1) together with the reference number used by them, to the verifying authority for the transmission for comparison of biometric or alphanumeric data to the Central System, via the National Access Point. Upon receipt of such a request, the verifying authority shall verify whether all the conditions for requesting a comparison referred to in Articles 21 or 22, as appropriate, are fulfilled.

RemovedArticle 20 – paragraph 2: 2. Where all the conditions for requesting a comparison referred to in Articles 21 or 22 are fulfilled, the verifying authority shall transmit the request for comparison to the National Access Point which will process it to the Central System in accordance with Articles 15 and 16 for the purpose of comparison with the biometric or alphanumeric data transmitted to the Central System pursuant to Articles 10(1), 12a, 13 (1) and 14(1).

RemovedArticle 20 – paragraph 2 a (new): 2a. For the purposes laid down in Article 1(1)(c), Europol's designated authority may submit a reasoned electronic request as provided for in Article 22(1) for the comparison of biometric data or alphanumeric data to the Europol access point referred to in Article 8(2). Upon receipt of such a request, the Europol access point shall verify whether all the conditions for requesting a comparison referred to in Article 22 are fulfilled. Where all the conditions referred to in Article 22 are fulfilled, the duly authorised staff of the Europol access point shall process the request. The Eurodac data requested shall be transmitted to the operating unit referred to in Article 8(1) in such a way as to ensure the security of the data.

RemovedArticle 20 – paragraph 4: 4. In exceptional cases of urgency where there is a need to prevent an imminent danger associated with a terrorist offence or other serious criminal offence, the verifying authority may transmit the biometric or alphanumeric data to the National Access Point for comparison immediately upon receipt of a request by a designated authority and only verify ex-post whether all the conditions for requesting a comparison referred to in Article 21 or Article 22 are fulfilled, including whether an exceptional case of urgency actually existed. The ex-post verification shall take place without undue delay after the processing of the request.

RemovedArticle 21 – paragraph 1 – introductory part: 1. For the purposes laid down in Article 1(1)(c), designated authorities may submit a reasoned electronic request for the comparison of biometric or alphanumeric data with the data stored in the Central System within the scope of their powers only if prior check has been conducted in:

RemovedArticle 21 – paragraph 1 – indent 2: - the automated fingerprinting identification systems of all other Member States under Decision 2008/615/JHA ; and

RemovedArticle 21 – paragraph 2: 2. Requests for comparison with Eurodac data shall be limited to searching with biometric or alphanumeric data.

RemovedArticle 22 – paragraph 2: 2. Requests for comparison with Eurodac data shall be limited to comparisons of biometric or alphanumeric data

RemovedArticle 22 – paragraph 3 a (new): 3a. Europol may request further information from the Member State concerned in accordance with Regulation (EU) 2016/794.

RemovedArticle 22 – paragraph 3 b (new): 3b. The processing of personal data as a result of the access referred to in paragraph 1 shall be carried out in compliance with the data protection safeguards provided for in Regulation (EU) 2016/794. Europol shall keep records of all searches and access to the Central System and shall make that documentation available, upon request, to the Data Protection Officer appointed pursuant to Regulation (EU) 2016/794 and to the European Data Protection Supervisor for the purpose of verifying the lawfulness of the data processing.

RemovedArticle 22 – paragraph 3 c (new): 3 c. Personal data obtained as a result of a search in the Central System shall not be transferred or made available to any third country, international organisation or private entity established in or outside the Union unless such a transfer is strictly necessary and proportionate in cases falling within Europol's mandate. Any such transfer shall be carried out in accordance with Chapter V of Regulation (EU) 2016/794 and subject to the consent of the Member State of origin.

RemovedArticle 24 – paragraph 1 – point b: (b) fingerprint data and the other data referred to in Article 12, Article 12b, Article 13(2) and Article 14(2) are lawfully transmitted to the Central System;

RemovedArticle 25 – paragraph 2: 2. Member States shall transmit the data referred to in Article 12, Article 12b, Article 13(2) and Article 14(2) electronically. The data referred to in Article 12, Article 12b, Article 13(2) and Article 14(2) shall be automatically recorded in the Central System. As far as necessary for the efficient operation of the Central System, eu-LISA shall establish the technical requirements to ensure that data can be properly electronically transmitted from the Member States to the Central System and vice versa.

RemovedArticle 25 – paragraph 3: 3. The reference number referred to in Articles 12(i), 12b(i), 13(2)(i), 14 (2)(i) and 20(1) shall make it possible to relate data unambiguously to one particular person and to the Member State which is transmitting the data. In addition, it shall make it possible to tell whether such data relate to a person referred to in Articles 10(1), 12a, 13(1) or 14(1).

RemovedArticle 25 – paragraph 4: 4. The reference number shall begin with the identification letter or letters by which the Member State transmitting the data is identified. The identification letter or letters shall be followed by the identification of the category of person or request. "1” refers to data relating to persons referred to in Article 10(1), "2" to persons referred to in Article 13(1), "3” to persons referred to in Article 14(1), "4" to requests referred to in Article 21, "5" to requests referred to in Article 22 ,"9" to requests referred to in Article 30, and “6” to requests referred to in Article 12a.

RemovedArticle 26 – paragraph 4: 4. The result of the comparison of fingerprints and facial image carried out pursuant to Article 15 shall be immediately checked in the receiving Member State by a fingerprint and facial identification expert as defined in accordance with its national rules, specifically trained in the types of fingerprint and facial image comparisons provided for in this Regulation. For the purposes laid down in Article 1(1)(a), (aa) and (b) of this Regulation, final identification shall be made by the Member State of origin in cooperation with the other Member States concerned.

RemovedArticle 26 – paragraph 5 – subparagraph 1: The result of the comparison of facial image data carried out pursuant to Article 16 shall be immediately checked and verified in the receiving Member State, where necessary by a specially trained expert and in accordance with its national rules. For the purposes laid down in Article 1(1)(a), (aa) and (b) of this Regulation, final identification shall be made by the Member State of origin in cooperation with the other Member States concerned.

RemovedArticle 28 – paragraph 2: 2. The authorities of Member States which, pursuant to paragraph 1 of this Article, have access to data recorded in the Central System shall be those designated by each Member State for the purposes laid down in Article 1(1)(a), (aa) and (b). That designation shall specify the exact unit responsible for carrying out tasks related to the application of this Regulation. Each Member State shall without delay communicate to the Commission and eu-LISA a list of those units and any amendments thereto. eu-LISA shall publish the consolidated list in the Official Journal of the European Union. Where there are amendments thereto, eu-LISA shall publish once a year an updated consolidated list online.

RemovedArticle 29 – paragraph 3: 3. For the purposes laid down in Article 1(1)(a), (aa) and (b), each Member State shall take the necessary measures in order to achieve the objectives set out in paragraphs 1 and 2 of this Article in relation to its national system. In addition, each Member State shall keep records of the staff duly authorised to enter or retrieve the data.

RemovedArticle 30 – paragraph 1 – introductory part: 1. A person covered by Articles 10(1), 12a, Article 13(1) or Article 14(1) shall be informed by the Member State of origin in writing, and where necessary, orally, in a language that he or she understands or is reasonably supposed to understand in a concise, transparent, intelligible and easily accessible form, using clear and plain language , of the following:

RemovedArticle 30 – paragraph 1 – point b: (b) the purpose for which his or her data will be processed in Eurodac, including a description of the aims of Regulation (EU) No […/…] , in accordance with Article 6 thereof and, where applicable, of the aims of Regulation (EU) XXX/XXX, and an explanation in intelligible form of the fact that Eurodac may be accessed by the Member States and Europol for law enforcement purposes;

RemovedArticle 30 – paragraph 1 – point c: (c) the recipients of the data;

RemovedArticle 30 – paragraph 1 – point d: (d) in relation to a person covered by Articles 10(1), 12a, 13(1) or 14(1) , the obligation to have his or her fingerprints taken;

RemovedArticle 30 – paragraph 1 – point f: (f) the existence of the right to object to the processing of personal data, to request from the controller access to data relating to him or her, and the right to request that inaccurate data relating to him or her be rectified and the completion of incomplete personal data or that unlawfully processed personal data concerning him or her be erased or restricted, as well as the right to receive information on the procedures for exercising those rights including the contact details of the controller and the supervisory authorities referred to in Article 32(1);

RemovedArticle 30 – paragraph 2 – subparagraph 1: In relation to a person covered by Articles 10(1), 12a, 13(1) and 14(1) , the information referred to in paragraph 1 of this Article shall be provided at the time when his or her fingerprints are taken.

RemovedArticle 30 – paragraph 2 – subparagraph 2: Where a person covered by Article 10(1), Article 12a, Article 13(1) and Article 14(1) is a minor, Member States shall ensure that that person understands the procedure by providing the information in an age-appropriate manner, both orally and in writing, using leaflets, infographics, demonstrations, or a combination of all three, which are specifically designed to explain the fingerprinting and facial image procedure to minors..

RemovedArticle 30 – paragraph 3 – subparagraph 3: The leaflet shall be established in such a manner as to enable Member States to complete it with additional Member State-specific information. This Member State-specific information shall include at least the possible administrative sanctions under national law to which a person may be subject in case of non-compliance with the fingerprinting process or the process for capturing facial images, the rights of the data subject, the possibility of information and assistance by the national supervisory authorities, as well as the contact details of the office of the controller and of the data protection officer, and the national supervisory authorities.

RemovedArticle 31 – paragraph 1: 1. For the purposes laid down in Article 1(1)(a), (aa) and (b) of this Regulation, the data subject's rights of access, rectification and erasure shall be exercised in accordance ,with Chapter III of Regulation (EU) No. […/2016] and applied as set out in this Article.

RemovedArticle 31 – paragraph 2: 2. The right of access of the data subject in each Member State shall include the right to obtain communication of the data relating to him or her recorded in the Central System and of the Member State which transmitted them to the Central System. Such access to data may be granted only by a Member State. For the purposes laid down in Article 1(1), in each Member State, any person may request that data which are factually inaccurate be corrected or that data recorded unlawfully be erased. The Member State that transmitted such data shall correct or erase it without excessive delay, in accordance with national law and practice.

RemovedArticle 32 – paragraph 1: 1. Each Member State shall provide that The supervisory authority or authorities of each Member State designated pursuant to Article 41 of Directive referred to in Article [46(1)] of Regulation (EU) […/2016] shall monitor the lawfulness of the processing of personal data by the Member State in question for the purposes laid out in Article 1(1)(a), (aa) and (b), including their transmission to the Central System.

RemovedArticle 34 – paragraph 4: 4. For the purpose laid down in paragraph 3, the national supervisory authorities and the European Data Protection Supervisor shall meet at least twice a year. The costs and servicing of these meetings shall be for the account of the European Data Protection Supervisor. Rules of procedure shall be adopted at the first meeting. Further working methods shall be developed jointly as necessary. A joint report of activities, assessing the application of the data protection provisions of this Regulation, as well as the necessity and proportionality of access to Eurodac for law enforcement purposes, shall be sent to the European Parliament, the Council, the Commission and eu-LISA every years.

RemovedArticle 36 – paragraph 3: 3. Member States shall inform eu-LISA of security incidents detected on their systems without prejudice to the notification and communication of a personal data breach pursuant to [Articles 33 and 34] of Regulation (EU) 679/2016. In particular, data subjects shall be notified by eu-LISA without undue delay when a security incident is likely to result in a high risk to their rights and freedoms. eu-LISA shall inform the Member States, Europol and the European Data Protection Supervisor in case of security incidents. The Member States concerned, eu-LISA and Europol shall collaborate during a security incident.

RemovedArticle 37 – paragraph 1: 1. Personal data obtained by a Member State or Europol pursuant to this Regulation from the Central System shall not be transferred or made available to any third country, international organisation or private entity established in or outside the Union. This prohibition shall also apply if those data are further processed at national level or between Member States within the meaning of Regulation (EU) 679/2016 and [Article [...]2(b) of Directive [ (EU) 2016/680].

RemovedArticle 37 – paragraph 2: 2. Personal data which originated in a Member State and are exchanged between Member States following a hit obtained for the purposes laid down in Article 1(1)(c) shall not be transferred to third countries, including if there is a real risk that as a result of such transfer the data subject may be subjected to torture, inhuman and degrading treatment or punishment or any other violation of his or her fundamental rights.

RemovedArticle 37 – paragraph 3: 3. No information regarding the fact that an application for international protection has been made in a Member State shall be disclosed to any third-country for persons related to Article 10(1) or Article 12a, particularly where that country is also the applicant's country of origin.

RemovedArticle 38 – paragraph 1 – introductory part: 1. By way of derogation from Article 37 of this Regulation, only the necessary personal data relating to persons referred to in Articles 10(1), 13(2), 14(1) obtained by a Member State following a hit for the purposes laid down in Article 1(1)(a) or (b) may be transferred or made available to a third-country in accordance with Chapter V of Regulation (EU) 2016/679, if necessary in order to prove the identity of third-country nationals or stateless persons for the purpose of return, only where the following conditions are satisfied:

RemovedArticle 38 – paragraph 1 – point c: (c) the Member State of origin which entered the data in the Central System has given its consent and the individual concerned has been informed that his or her personal information will be shared with the authorities of that third-country.

RemovedArticle 38 – paragraph 1 a (new): 1a. Personal data which originated in a Member State and are exchanged between Member States following a hit obtained for the purposes laid down in Article 1(1)(a) and (b) shall not be transferred to third countries if there is a real risk that, as a result of such transfer, the data subject may be subjected to torture, inhuman and degrading treatment or punishment or any other violation of his or her fundamental rights.

RemovedArticle 38 – paragraph 2: 2. No information regarding the fact that an application for international protection has been made in a Member State shall be disclosed to any third-country for persons related to Article 10(1).

RemovedArticle 40 – paragraph 2 a (new): 2a. Ultimate responsibility for the processing of personal data shall lie with the Member States, which are considered to be ‘controllers’ within the meaning of Regulation (EU) 2016/679.

RemovedArticle 40 – paragraph 3: 3. Claims for compensation against a Member State for the damage referred to in paragraphs 1 and 2 shall be governed by the provisions of national law of the defendant Member State in accordance with Chapter VIII of Regulation (EU) 2016/679 and Chapter VIII of Directive (EU) 2016/680 concerning remedies, liabilities and penalties.

RemovedArticle 40 a (new): Article 40a / Operational management of DubliNet and related tasks / 1. Eu-LISA shall operate and manage a separate secure electronic transmission channel between the authorities of Member States known as the 'DubliNet' communication network established by Article 18 of Commission Regulation (EC) No 1560/20031a for the purposes set out in Articles 32, 33 and 46 of Regulation (EU) No ...[Dublin IV]. / 2. The operational management of DubliNet shall consist of all the tasks necessary to ensure its availability five days a week during normal business hours. / 3. Eu-LISA shall be responsible for the following tasks relating to DubliNet: / (a) providing technical support to Member States by way of a helpdesk, five days a week during normal business hours, including in relation to problems concerning communication, email encryption and decryption, and problems arising from the signature of forms; / (b) providing IT security services; / (c) managing, registering and renewing digital certificates used for encrypting and signing DubliNet e-mail messages; / (d) the technical evolution of DubliNet; / (e) contractual matters. / 4. Eu-LISA shall ensure, in cooperation with the Member States, that at all times the best available and most secure technology and techniques, subject to a cost-benefit analysis, are used for DubliNet. / 1a Commission Regulation (EC) No 1560/2003 of 2 September 2003 laying down detailed rules for the application of Council Regulation (EC) No 343/2003 establishing…

RemovedChapter VIII a (new): CHAPTER VIIIa / AMENDMENTS TO REGULATION (EU) NO 1077/2011

RemovedArticle 40 b (new): Article 40 b / Regulation (EU) No 1077/2011 is amended as follows: / (1) In Article 1(2), the following subparagraph is added: / "The Agency shall also be responsible for the operational management of a separate secure electronic transmission channel between the authorities of Member States, known as the 'DubliNet' communication network, established by Article 18 of Commission Regulation (EC) No 1560/2003, for the exchange of information under Regulation (EU) No... *[Dublin IV]. / * Commission Regulation (EC) No 1560/2003 of 2 September 2003 laying down detailed rules for the application of Council Regulation (EC) No 343/2003 establishing the criteria and mechanisms for determining the Member State responsible for examining an asylum application lodged in one of the Member States by a third-country national (OJ L 222, 5.9.2003, p. 3).”. / (2) The following Article is inserted: / "Article 5a / Tasks relating to DubliNet / 1. In relation to DubliNet, the Agency shall perform: / (a) the tasks conferred on it by Article [...] of Regulation (EU).../...[Eurodac]; / (b) tasks relating to training on the technical use of DubliNet.".

RemovedArticle 41 – paragraph 1: 1. The costs incurred in connection with the establishment and operation of the Central System and the Communication Infrastructure shall be borne by the general budget of the European Union, in accordance with the principles of sound financial management.