Changes from plenary report to adopted text

RemovedRecital 2: (2) That objective requires that law enforcement authorities exchange data, in an efficient and timely manner, in order to effectively prevent, detect and investigate criminal offences.

RemovedRecital 3: (3) The objective of this Regulation is therefore to improve, streamline and facilitate the exchange of criminal information and vehicle registration data between Member States’ competent law enforcement authorities for the purposes of preventing, detecting and investigating criminal offences, but also with the European Union Agency for Law Enforcement Cooperation established by Regulation (EU) No 2016/794 of the European Parliament and of the Council30 (Europol), in full compliance with fundamental rights and data protection rules.

RemovedRecital 4: (4) Council Decisions 2008/615/JHA31 and 2008/616/JHA32 laying down rules for the exchange of information between authorities responsible for the prevention and investigation of criminal offences by providing for the automated transfer of DNA profiles, dactyloscopic data and certain vehicle registration data, have proven important for tackling terrorism and cross-border crime, thereby protecting the internal security of the Union and the safety of its citizens.

RemovedRecital 5: (5) This Regulation should lay down the conditions and procedures for the automated search and exchange of DNA profiles, dactyloscopic data, certain vehicle registration data, facial images and police records, in the context of a criminal investigation. This should be without prejudice to the processing of any of these data in the Schengen Information System (SIS) or the exchange of supplementary information related to them via the SIRENE bureaux pursuant to Regulation (EU) 2018/1862 of the European Parliament and of the Council1a or to the rights of individuals whose data is processed. / 1a Regulation (EU) 2018/1862 of the European Parliament and of the Council of 28 November 2018 on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation and judicial cooperation in criminal matters, amending and repealing Council Decision 2007/533/JHA, and repealing Regulation(EC) No 1986/2006 of the European Parliament and of the Council and Commission Decision 2010/261/EU (OJ L 312, 7.12.2018, p. 56).

RemovedRecital 6: (6) Any processing of personal data and the exchange of personal data for the purposes of this Regulation should be carried out in compliance with Chapter 6 of this Regulation and, as applicable, Directive (EU) 2016/680 of the European Parliament and the Council1a, Regulation (EU) 2018/1725 of the European Parliament and the Council1b or Regulation (EU) 2016/794. The processing and exchange of personal data for the purposes of this Regulation should not result in discrimination against persons on any grounds. It should fully respect human dignity and integrity and other fundamental rights, including the right to respect for one's private life and to the protection of personal data, in accordance with the Charter of Fundamental Rights of the European Union. / 1a Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89). / 1b Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing …

RemovedRecital 7: (7) By providing for the automated search or comparison of DNA profiles, dactyloscopic data, certain vehicle registration data, facial images and police records, the purpose of this Regulation is also to allow for the search of missing persons and the identification of unidentified human remains in the context of a criminal investigation. This should be without prejudice to the entry of SIS alerts on missing persons and the exchange of supplementary information on such alerts under Regulation (EU) 2018/1862 of the European Parliament and of the Council.33

RemovedRecital 8: (8) The Directive (EU) …/… [on information exchange between law enforcement authorities of Member States] provides a coherent Union legal framework to ensure that competent law enforcement authorities have equivalent access to information held by other Member States when they need it to fight crime and terrorism. To enhance information exchange, that Directive formalises and clarifies the rules and procedures for information sharing between Member States’ competent law enforcement authorities, in particular for investigative purposes, including the role of the ‘Single Point of Contact’ for such exchanges, and making full use of Europol’s information exchange channel SIENA. Any exchange of information between competent law enforcement authorities beyond what is provided for in this Regulation is regulated by Directive (EU) …/… [on information exchange between law enforcement authorities of Member States].

RemovedRecital 8 a (new): (8a) Member States should designate one or more national contact points for the exchanges under this Regulation, depending on their national organisation structures. However, in order to streamline those exchanges, Member States should seek to have only one national contact point, if at all possible.

RemovedRecital 9: (9) For the automated searching of certain vehicle registration data, Member States and Europol should use the European Vehicle and Driving Licence Information System (Eucaris) set up by the Treaty concerning a European Vehicle and Driving Licence Information System (EUCARIS) designed for this purpose which connects all participating Member States in a network. There is no central component needed for the communication to be established as each Member State communicates directly to the other connected Member States, and Europol communicates directly with the connected databases. The automated search and exchange of driving licence data is excluded from the scope of this Regulation.

RemovedRecital 10: (10) The identification of a criminal is essential for a successful criminal investigation and prosecution. The automated searching of facial images of persons convicted or suspected of having committed a criminal offence collected in accordance with national law should provide for additional information for successfully identifying criminals and fighting crime. Given the sensitivity of the data concerned, it should only be possible to conduct automated searches for the purpose of preventing, detecting or investigating a serious criminal offence. In addition, a human review of the list of candidates by two forensic experts should be ensured in order to determine the existence of a confirmed match.

RemovedRecital 11: (11) The automated search or comparison of biometric data between authorities responsible for the prevention, detection and investigation of criminal offences under this Regulation should only concern data contained in Union’s or Member States’ databases established for the prevention, detection and investigation of criminal offences, in accordance with this Regulation.

RemovedRecital 12: (12) Participation in the automated search and exchange of police record indexes should remain voluntary. Where Member States decide to participate, in the spirit of reciprocity, it should not be possible for them to query other Member States’ databases if they do not make their own data available for queries by other Member States. Given the sensitivity of the data concerned, exchanges of police record indexes under this Regulation should only concern data of persons convicted or suspected of having committed a serious criminal offence. In addition, it should only be possible to conduct automated searches for the purpose of investigating a serious criminal offence.

RemovedRecital 12 a (new): (12a) Member States should ensure that data included in their national police record indexes are accurate, complete and up to date and should implement safeguards, in particular pseudonymisation, to protect queried personal data.

RemovedRecital 12 b (new): (12b) The exchange of police record indexes under this Regulation is without prejudice to the exchange of criminal records through the existing European Criminal Records Information System (ECRIS) framework.

RemovedRecital 13: (13) In recent years, Europol has received a large amount of biometric data of suspects and persons convicted for terrorism and criminal offences from several third-country authorities in accordance with Regulation(EU) 2016/794, in particular battlefield information from war zones. It has often not been possible to make full use of such data because they are not always available to the competent law enforcement authorities of the Member States. Including third country-sourced data stored at Europol in the Prüm framework and thus making this data available to competent law enforcement authorities in line with Europol’s role as the Union central criminal information hub is necessary for better prevention and investigation of serious criminal offences. It also contributes to building synergies between different law enforcement tools, and ensures that data is used in the most efficient manner.

RemovedRecital 14: (14) Europol should be able to search Member States’ databases under the Prüm framework with data received from third-country authorities, in full respect of the rules and conditions provided for in Regulation (EU) 2016/794, in order to establish cross-border links between criminal cases in respect of which Europol is competent. Being able to use Prüm data, next to other databases available to Europol, should enable a more complete and informed analysis to be carried out, thereby allowing Europol to provide better support to Member States’ competent law enforcement authorities when conducting criminal investigations. In case of a confirmed match between data used for the search and data held in Member States’ databases, Member States may supply Europol with the information necessary for it to fulfil its tasks.

RemovedRecital 15: (15) Decisions 2008/615/JHA and 2008/616/JHA provide for a network of bilateral connections between the national databases of Member States. As a consequence of this technical architecture, each Member State had to establish at least 26 connections, that means a connection with each Member State participating in the exchanges, per data category. The router and the European Police Records Index System (EPRIS) established by this Regulation will simplify the technical architecture of the Prüm framework and serve as connecting points between all Member States. The router should require a single connection per Member State in relation to biometric data and EPRIS should require a single connection per participating Member State in relation to police records.

RemovedRecital 16: (16) The router should be connected to the European Search Portal established by Article 6 of Regulation (EU) 2019/817 of the European Parliament and of the Council34 and Article 6 of Regulation (EU) 2019/818 of the European Parliament and of the Council35 to allow Member States’ competent law enforcement authorities and Europol to launch queries to national databases under this Regulation simultaneously to queries to the Common Identity Repository established by Article 17 of Regulation (EU) 2019/817 and Article 17 of Regulation (EU) 2019/818 for law enforcement purposes in accordance with Regulation (EU) 2019/817 and Regulation (EU) 2019/818. Those two Regulations should therefore be amended accordingly. Moreover, Regulation (EU) 2019/818 should be amended with a view to enabling the storage of reports and statistics of the router in the Common Repository for Reporting and Statistics.

RemovedRecital 17: (17) In case of a match between the data used for the search or comparison and data held in the national database of the requested Member State(s), and upon human confirmation of this match by qualified staff of the requesting Member State, the requested Member State should return a limited set of core data, to the extent that such core date are available, via the router within 24 hours. Where the requested Member State needs to obtain a judicial authorisation prior to the transmission of the core data, the 24-hour deadline should not apply and, instead, the Member State should ensure that the core data are returned within 72 hours. The deadline will ensure fast communication exchange between Member States’ competent law enforcement authorities. Member States should retain control over the release of this limited set of core data. In exceptional circumstances it might be objectively justified for Member States to refuse sharing the set of core data. Such refusal and its justification should be provided promptly to the requesting Member State within time limits established under this Regulation. Human intervention should be maintained at key points in the process, including for the decision to launch a query, the decision to confirm a match, the decision to launch a request to receive core data following a confirmed match and the decision to release personal data to the requesting Member State, in order to ensure that there would be no automated exchange of core data.

RemovedRecital 18: deleted

RemovedRecital 19: (19) The universal message format (UMF) standard should be used in the development of the router and EPRIS. Any automated exchange of data in accordance with this Regulation should use the UMF standard. Member States’ competent law enforcement authorities and Europol are encouraged to use the UMF standard also in relation to any further exchange of data between them in the context of the Prüm II framework. The UMF standard should serve as a standard for structured, cross-border information exchange between information systems, authorities or organisations in the field of Justice and Home Affairs.

RemovedRecital 21: (21) Certain aspects of the Prüm II framework cannot be covered exhaustively by this Regulation given their technical, highly detailed and frequently changing nature. Those aspects include, for example, technical arrangements and specifications for automated searching procedures, the standards for data exchange, including minimum quality standards, and the data elements to be exchanged. In order to ensure uniform conditions for the implementation of this Regulation implementing powers should be conferred on the Commission. Those powers should be exercised in accordance with Regulation (EU) No 182/2011 of the European Parliament and of the Council.36

RemovedRecital 21 a (new): (21a) Data quality in the context of automated comparison is an essential prerequisite to ensure the efficiency of this Regulation and reduce the risk of false matches. Adequate standards for data exchanged in the framework of this Regulation should be determined at Union level by means of implementing acts.

RemovedRecital 21 b (new): (21b) Given the scale and sensitivity of the personal data exchanged for the purposes of this Regulation, and the existence of different national rules for storing information on individuals in national databases, it is important to ensure that the databases used for the automated searching of DNA profiles, dactyloscopic data, facial images, police records and certain vehicle registration data are established in accordance with national law and, as applicable, Directive (EU) 2016/680, Regulation (EU) 2018/1725 and Regulation (EU) 2016/794. Therefore, prior to connecting their national databases to the router, EPRIS or Eucaris, Member States should conduct a data protection impact assessment as referred to in Directive (EU) 2016/680 and consult the supervisory authority as referred to in that Directive, in order to ensure that data in the national databases has been stored in accordance with the applicable law.

RemovedRecital 21 c (new): (21c) Member States and Europol should ensure that data exchanged in the framework of this Regulation are accurate and up-to-date. In accordance with the principles of data protection, Member States and Europol should make sure that any data transmitted that are found to be incorrect, inaccurate or outdated are corrected or deleted, as appropriate, and that any correction or deletion is communicated to all recipients without delay.

RemovedRecital 21 d (new): (21d) Strong monitoring of the implementation of this Regulation is of utmost importance. In particular, compliance with rules for processing personal data should be subject to effective safeguards, and regular monitoring and audits by data controllers, supervisory authorities and the European Data Protection Supervisor should be ensured. Provisions allowing for a regular checking of the admissibility of queries and the lawfulness of data processing should also be in place. Member States and Europol should ensure adequate human, technical and financial resources for those purposes.

RemovedRecital 21 e (new): (21e) Supervisory authorities and the European Data Protection Supervisor should ensure coordinated supervision of the application of this Regulation within the framework of their responsibilities, in particular where they find major discrepancies between Member State’s practices, potentially unlawful transfers or potential politically-motivated requests.

RemovedRecital 21 f (new): (21f) When implementing this Regulation, it is crucial that Member States and Europol take note of the developing case law from the European Court of Justice in relation to the use of biometric databases.

RemovedRecital 21 g (new): (21g) Member States and third countries who are permitted access to the Prüm II framework should be full members of the Council of Europe with full rights of representation therein and signatories to the European Convention for the Protection of Human Rights and Fundamental Freedoms and, thus, subject to the jurisdiction of the European Court of Human Rights.

RemovedRecital 21 h (new): (21h) Two years following the start of operations of the router and EPRIS, and every four years thereafter, the European Commission should produce an evaluation report that includes an assessment of the application of this Regulation by the Member States and Europol, in particular of their compliance with the relevant data protection safeguards, paying due attention to any Member State subject to a procedure referred to in Article 7 of the Treaty of the European Union. The report should also include an examination of the results achieved against the objectives of this Regulation and its impact on fundamental rights, while also evaluating its impact, performance, effectiveness, efficiency, security and working practices.

RemovedRecital 23: (23) As the router should be developed and managed by the European Union Agency for the Operational Management of Large-Scale Information Systems in the Area of Freedom, Security and Justice established by Regulation (EU) 2018/1726 of the European Parliament and of the Council37 (eu-LISA), it is necessary to amend Regulation (EU) 2018/1726 by adding that to the tasks of eu-LISA.

RemovedRecital 23 a (new): (23a) Since the objectives of this Regulation, namely to step up cross-border police cooperation and to allow Member States’ competent law enforcement authorities to search for missing persons and identify unidentified human remains, cannot be sufficiently achieved by the Member States but can rather, by reason of the scale and effects of the action, be better achieved at Union level, the Union may adopt measures, in accordance with the principle of subsidiarity as set out in Article 5 of the Treaty on European Union. In accordance with the principle of proportionality, as set out in that Article, this Regulation does not go beyond what is necessary in order to achieve those objectives.

RemovedRecital 26: (26) The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 of the European Parliament and of the Council38 and delivered an opinion on 2 March 202239 . / 39 OJ C 225, 9.6.2022, p.6.

RemovedArticle 1 – paragraph 1: This Regulation establishes a framework for the exchange of information between Member States’ competent law enforcement authorities (Prüm II).

RemovedArticle 1 – paragraph 2: This Regulation lays down the conditions and procedures for the automated searching of DNA profiles, dactyloscopic data, facial images, police records and certain vehicle registration data and the rules regarding the exchange of core data following a confirmed match.

RemovedArticle 2 – paragraph 1: The purpose of Prüm II shall be to step up cross-border cooperation in matters covered by Part III, Title V, Chapter 5 of the Treaty on the Functioning of the European Union, particularly by facilitating the exchange of information between Member States’ competent law enforcement authorities, in full respect for the fundamental rights of natural persons, including the right to respect for one’s private life, and for the protection of personal data, in accordance with the Charter of Fundamental Rights of the European Union.

RemovedArticle 2 – paragraph 2: The purpose of Prüm II shall also be to allow for the search for missing persons and the identification of unidentified human remains by Member States’ competent law enforcement authorities in the context of a criminal investigation, provided that those authorities are empowered to conduct such searches and to carry out such identification under national law.

RemovedArticle 3 – paragraph 1: This Regulation applies to the databases, established in accordance with national law and in compliance with, as applicable, Directive (EU) 2016/680, Regulation (EU) 2018/1725 or Regulation (EU) 2016/794, used for the automated transfer of the categories of DNA profiles, dactyloscopic data, facial images, police records and certain vehicle registration data.

RemovedArticle 4 – paragraph 1 – point 1: (1) ‘loci’ means DNA locations which contain identification characteristics of an analysed human DNA sample;

RemovedArticle 4 – paragraph 1 – point 2: (2) ‘DNA profile’ means a letter or number code which represents a set of loci, or the particular molecular structure at the various loci;

RemovedArticle 4 – paragraph 1 – point 3: deleted

RemovedArticle 4 – paragraph 1 – point 5: (5) ‘identified DNA profile’ means the DNA profile of an identified person;

RemovedArticle 4 – paragraph 1 – point 8 a (new): (8a) ‘unidentified dactyloscopic data’ means the dactyloscopic data obtained from traces collected during the investigation of a criminal offence which belong to a person not yet identified;

RemovedArticle 4 – paragraph 1 – point 10 a (new): (10a) ‘facial image reference data’ means a facial image and its reference number referred to in Article 23;

RemovedArticle 4 – paragraph 1 – point 10 b (new): (10b) ‘unidentified facial image’ means a facial image collected during the investigation of a criminal offence which belongs to a person not yet identified;

RemovedArticle 4 – paragraph 1 – point 11 a (new): (11a) ‘alphanumeric data’ means data represented by letters, digits, special characters, spaces and punctuation marks;

RemovedArticle 4 – paragraph 1 – point 12: (12) ‘match’ means the existence of a correspondence as a result of an automated comparison between personal data held by the requesting Member State and personal data recorded in a database of the requested Member State;

RemovedArticle 4 – paragraph 1 – point 15: (15) ‘requested Member State’ means the Member State in whose databases the search is conducted through Prüm II by the requesting Member State;

RemovedArticle 4 – paragraph 1 – point 16: (16) ‘police records’ means biographical information regarding persons convicted or suspected of having committed a serious criminal offence available in the national databases established for the prevention, detection and investigation of criminal offences;

RemovedArticle 4 – paragraph 1 – point 17: (17) ‘pseudonymisation’ means pseudonymisation as defined in Article 3, point (5), of Directive (EU) 2016/680;

RemovedArticle 4 – paragraph 1 – point 17 a (new): (17a) ‘suspect’ means a person referred to in Article 6, point (a), of Directive (EU) 2016/680;

RemovedArticle 4 – paragraph 1 – point 17 b (new): (17b) ‘serious criminal offence’ means an offence referred to in Article 2(2) of Council Framework Decision 2002/584/JHA1a or in Article 3 of Regulation (EU) 2016/794, which is punishable in the requesting Member State by a custodial sentence or a detention order for a maximum period of at least three years; / 1a Council Framework Decision 2002/584/JHA of 13 June 2002 on the European arrest warrant and the surrender procedures between Member States (OJ L 190, 18.7.2002, p. 1).

RemovedArticle 4 – paragraph 1 – point 17 c (new): (17c) ‘victim of serious crime or terrorism’ means a person that is adversely affected by an offence which corresponds or is equivalent to one of the offences referred to in Article 2(2) of Framework Decision 2002/584/JHA, if that offence is punishable under national law by a custodial sentence or a detention order for a maximum period of at least three years or an offence under national law which corresponds or is equivalent to one of the offences referred to in Directive (EU) 2017/541 of the European Parliament and of the Council1a; / 1a Directive (EU) 2017/541 of the European Parliament and of the Council of 15 March 2017 on combating terrorism and replacing Council Framework Decision 2002/475/JHA and amending Council Decision 2005/671/JHA (OJ L 88, 31.3.2017, p. 6).

RemovedArticle 4 – paragraph 1 – point 17 d (new): (17d) ‘personal data’ means personal data as defined in Article 3, point (1), of Directive (EU) 2016/680;

RemovedArticle 4 – paragraph 1 – point 17 e (new): (17e) ‘designated authorities’ means designated authorities as defined in Article 3(1), point (26), of Regulation (EU) 2017/2226 of the European Parliament and of the Council1a, Article 2(1), point (e), of Council Decision 2008/633/JHA1b, or Article 3(1), point (21), of Regulation (EU) 2018/1240 of the European Parliament and of the Council1c; / 1a Regulation (EU) 2017/2226 of the European Parliament and of the Council of 30 November 2017 establishing an Entry/Exit System (EES) to register entry and exit data and refusal of entry data of third-country nationals crossing the external borders of the Member States and determining the conditions for access to the EES for law enforcement purposes, and amending the Convention implementing the Schengen Agreement and Regulations (EC) No 767/2008 and (EU) No 1077/2011 (OJ L 327, 9.12.2017, p. 20). / 1b Council Decision 2008/633/JHA of 23 June 2008 concerning access for consultation of the Visa Information System (VIS) by designated authorities of Member States and by Europol for the purposes of the prevention, detection and investigation of terrorist offences and of other serious criminal offences (OJ L 218, 13.8.2008, p. 129). / 1c Regulation (EU) 2018/1240 of the European Parliament and of the Council of 12 September 2018 establishing a European Travel Information and Authorisation System (ETIAS) and amending Regulations (EU) No 1077/2011, (EU) No 515/2014, (EU) 2016/399, (EU) 2016/1624 and (EU) 2017/2226 (OJ L 236, 19.9.2018, p. 1)…

RemovedArticle 4 – paragraph 1 – point 18: (18) ‘Europol data’ means any operational personal data processed by Europol in accordance with Regulation (EU) 2016/794;

RemovedArticle 4 – paragraph 1 – point 18 a (new): (18a) 'competent law enforcement authority' means any police, customs or other authority of the Member States competent under national law to exercise authority and to take coercive measures for the purpose of preventing, detecting or investigating criminal offences;

RemovedArticle 4 – paragraph 1 – point 20: (20) ‘SIENA’ means the secure information exchange network application, managed by Europol in accordance with Regulation (EU) 2016/794, aimed at facilitating the exchange and ensuring the secure transmission of operational and strategic crime-related information between Member States and Europol;

RemovedArticle 4 – paragraph 1 – point 21: (21) ‘significant incident’ means significant incident as defined in Article 3, point (7), of Regulation (EU) .../... of the European Parliament and of the Council1a [2022/0085(COD)]; / 1a Regulation (EU) .../... of the European Parliament and of the Council laying down measures for a high common level of cybersecurity at the institutions, bodies, offices and agencies of the Union (OJ...).

RemovedArticle 4 – paragraph 1 – point 22: (22) ‘significant cyber threat’ means significant cyber threat as defined in Article 3, point (11), of Regulation (EU) .../... [2022/0085(COD];

RemovedArticle 4 – paragraph 1 – point 23: (23) ‘significant vulnerability’ means significant vulnerability as defined in Article 3, point (13) of Regulation (EU) .../... [2022/0085(COD];

RemovedArticle 5 – title: Establishment of national DNA databases

RemovedArticle 5 – paragraph 1 – subparagraph 1: 1. Member States shall open and keep national DNA databases for the investigation of criminal offences.

RemovedArticle 5 – paragraph 1 – subparagraph 2: Processing of data kept in those databases, under this Regulation, shall be carried out in accordance with this Regulation and in compliance with the national law of the Member States applicable to the processing of those data.

RemovedArticle 5 – paragraph 2 – subparagraph 1: 2. Member States shall ensure the availability of DNA reference data from their national DNA databases as referred to in paragraph 1 for the purposes of automated searches by other Member States pursuant to this Regulation.

RemovedArticle 5 – paragraph 2 – subparagraph 2: DNA reference data shall not contain any additional data from which an individual can be directly identified.

RemovedArticle 5 – paragraph 2 – subparagraph 3: Unidentified DNA profiles shall be recognisable as such.

RemovedArticle 5 – paragraph 2a (new): The Commission shall adopt an implementing act to specify the identification characteristics of a DNA profile which is to be exchanged and the minimum requirements for a match, taking into account international and European standards. That implementing act shall be adopted in accordance with the procedure referred to in Article 75(2).

RemovedArticle 6 – paragraph 1 – subparagraph 1: For the investigation of criminal offences, Member States shall allow national contact points of other Member States and Europol access to the DNA reference data in their DNA databases established for that purpose in order to conduct automated searches of the DNA profiles in those databases and to compare those DNA profiles with their DNA profiles.

RemovedArticle 6 – paragraph 1 – subparagraph 2: Searches shall only be conducted in individual cases, where they are proportionate and necessary for the investigation of a criminal offence, and in compliance with the national law of the requesting Member State.

RemovedArticle 6 – paragraph 2 – subparagraph 1: Should an automated search show that a supplied DNA profile matches DNA profiles stored in the requested Member State's searched database or databases, the national contact point of the requesting Member State shall receive in an automated way the DNA reference data with which a match has been found.

RemovedArticle 6 – paragraph 2 – subparagraph 2: deleted

RemovedArticle 6 – paragraph 3: 3. The national contact point of the requesting Member State shall ensure that a human review by a forensic expert is conducted in order to confirm a match of DNA profile data with DNA reference data held by the requested Member State following the automated supply of the DNA reference data required for confirming a match.

RemovedArticle 7 – paragraph 1: 1. Member States may, via their national contact points, compare the DNA profiles of their unidentified DNA profiles with all DNA profiles from other national DNA databases for the investigation of criminal offences. Profiles shall be supplied and compared in an automated manner.

RemovedArticle 7 – paragraph 2: 2. Should a requested Member State, as a result of the comparison referred to in paragraph 1, find that any DNA profiles supplied match any of those in its DNA databases, it shall, without delay, supply the national contact point of the requesting Member State with the DNA reference data with which a match has been found.

RemovedArticle 7 – paragraph 3: 3. A human review by a forensic expert to confirm a match of DNA profiles with DNA reference data held by the requested Member State shall be carried out by the national contact point of the requesting Member State following the automated supply of the DNA reference data required for confirming a match.

RemovedArticle 8 – paragraph 1: deleted / (deleted) / (deleted)

RemovedArticle 9 – paragraph 1 – point a: (a) a reference number allowing Member States, in case of a match, to retrieve further data and other information in their databases referred to in Article 5 in order to supply it to one, several or all of the other Member States in accordance with Article 47 or to Europol in accordance with Article 50(6);

RemovedArticle 9 – paragraph 1 – point a a (new): (aa) a reference number allowing Europol, in case of a match, to retrieve further data and other information for the purposes of Article 49(1) of this Regulation in order to supply them or it to one, several or all Member States in accordance with Regulation (EU) 2016/794;

RemovedArticle 9 – paragraph 1 – point c: (c) a code to indicate the type of DNA profile (identified DNA profiles or unidentified DNA profiles).

RemovedArticle 10 – paragraph 1: 1. Member States and, where applicable, Europol shall take all appropriate measures to ensure confidentiality and integrity for DNA reference data being sent to other Member States or Europol, including their encryption.

RemovedArticle 10 – paragraph 2: 2. Member States and Europol shall take the necessary measures to guarantee the integrity and minimum quality standards of the DNA profiles made available or sent for comparison to the other Member States and to ensure that those measures comply with the relevant European or international standards for DNA data exchange.

RemovedArticle 10 – paragraph 3: 3. The Commission shall adopt implementing acts specifying the relevant European or international standards that are to be used by Member States and Europol for DNA reference data exchange, including the minimum quality standard to be met by DNA profiles. Those implementing acts shall be adopted in accordance with the procedure referred to in Article 75(2).

RemovedArticle 11 – paragraph 1 – point d: (d) the types of DNA profiles transmitted (unidentified DNA profiles or identified DNA profiles).

RemovedArticle 11 – paragraph 2 – point f: (f) the type of DNA profiles transmitted (unidentified DNA profiles or identified DNA profiles);

RemovedArticle 11 – paragraph 3: 3. Automated notification of a match shall only be provided if the automated search or comparison has resulted in a match of a minimum number of loci. The Commission, after consulting the European Data Protection Board in accordance with Article 42(2) of Regulation (EU) 2018/1725, shall adopt implementing acts to specify this minimum number of loci, in accordance with the procedure referred to in Article 75(2) of this Regulation.

RemovedArticle 11 – paragraph 5: 5. Member States shall ensure that requests are consistent with notifications sent pursuant to Article 72(2a). Those notifications shall be reproduced in the practical handbook referred to in Article 77.

RemovedArticle 12 – paragraph 1: 1. Member States shall ensure the availability of dactyloscopic reference data from their national database or databases established for the prevention, detection and investigation of criminal offences.

RemovedArticle 12 – paragraph 2: 2. Dactyloscopic reference data shall not contain any additional data from which an individual can be directly identified.

RemovedArticle 12 – paragraph 3: 3. Unidentified dactyloscopic data shall be recognisable as such

RemovedArticle 13 – paragraph 1 – subparagraph 1: For the prevention, detection and investigation of criminal offences, Member States shall allow national contact points of other Member States and Europol access to the dactyloscopic reference data in their national databases established for that purpose, to conduct automated searches by comparing dactyloscopic reference data.

RemovedArticle 13 – paragraph 1 – subparagraph 2: Searches shall only be conducted in individual cases, where they are proportionate and necessary for the purposes of preventing, detecting or investigating a criminal offence, and in compliance with the national law of the requesting Member State.

RemovedArticle 13 – paragraph 2: 2. The national contact point of the requesting Member State shall ensure that a human review by a forensic expert is conducted in order to confirm a match of dactyloscopic data with dactyloscopic reference data held by the requested Member State following the automated supply of the dactyloscopic reference data required for confirming a match.

RemovedArticle 14 – paragraph 1 – point a: (a) a reference number allowing Member States, in the case of a match, to retrieve further data and other information in their databases referred to in Article 12 in order to supply it to one, several or all of the other Member States in accordance with Article 47 or to Europol in accordance with Article 50(6);

RemovedArticle 14 – paragraph 1 – point a a (new): (aa) a reference number allowing Europol, in case of a match, to retrieve further data and other information for the purposes of Article 49(1) of this Regulation in order to supply them or it to one, several or all Member States in accordance with Regulation (EU) 2016/794;

RemovedArticle 15 – paragraph 1: 1. The digitalisation of dactyloscopic data and their transmission to the other Member States or Europol shall be carried out in accordance with a uniform data format. The Commission shall adopt implementing acts to specify the uniform data format in accordance with the procedure referred to in Article 75(2).

RemovedArticle 15 – paragraph 2: 2. Each Member State and Europol shall ensure that the dactyloscopic data it transmits are of sufficient quality for automated comparison.

RemovedArticle 15 – paragraph 3: 3. Member States and Europol shall take all appropriate measures to ensure the confidentiality and integrity of dactyloscopic data being sent to other Member States, including their encryption.

RemovedArticle 15 – paragraph 4: 4. The Commission shall adopt implementing acts specifying the relevant existing European or international standards for dactyloscopic data exchange that are to be used by Member States, including the minimum quality standard for the automated comparison of dactyloscopic data. Those implementing acts shall be adopted in accordance with the procedure referred to in Article 75(2).

RemovedArticle 16 – paragraph 1 – subparagraph 1: Member States and Europol shall ensure that their search requests do not exceed the search capacities specified by the requested Member State.

RemovedArticle 16 – paragraph 1 – subparagraph 2: Member States shall inform other Member States, Europol, the Commission and eu-LISA about their maximum search capacities per day for dactyloscopic data of identified persons and for dactyloscopic data of persons not yet identified. Member States may raise those maximum search capacities. Where a Member State raises those maximum search capacities, it shall notify the other Member States, Europol, the Commission and eu-LISA of the new maximum search capacities.

RemovedArticle 18 – paragraph 1 – point a: (a) data relating to owners or keepers;

RemovedArticle 18 – paragraph 3 a (new): 3a. The data referred to in paragraph 1, points (a) and (b), of this Article shall not go beyond the data elements specified in the implementing act adopted pursuant to Article 19(3).

RemovedArticle 19 – paragraph 3: 3. The Commission shall adopt implementing acts to specify the data elements of the vehicle registration data which may be exchanged. Those implementing acts shall be adopted in accordance with the procedure referred to in Article 75(2).

RemovedArticle 20 – paragraph 1 – subparagraph 1: Each Member State shall keep logs of queries that the staff of its competent law enforcement authorities duly authorised to exchange vehicle registration data make as well as logs of queries requested by other Member States. Europol shall keep logs of queries that its duly authorised staff make.

RemovedArticle 20 – paragraph 2 – subparagraph 2: Those logs shall be protected by all appropriate measures against unauthorised access and erased three years after their creation. If, however, they are required for monitoring procedures that have already begun, they shall be erased once the monitoring procedures no longer require the logs.

RemovedArticle 21 – paragraph 1 – subparagraph 1: Member States shall ensure the availability of facial images of persons convicted or suspected of having committed a criminal offence collected in accordance with their national law from their national databases established for the prevention, detection and investigation of criminal offences. Those data shall only include facial images and the reference number referred to in Article 23, and shall indicate whether the facial images are attributed to an individual or not.

RemovedArticle 21 – paragraph 1 – subparagraph 2: Member States shall not make available in this context any additional data from which an individual can be directly identified.

RemovedArticle 21 – paragraph 2: 2. Unidentified facial images must be recognisable as such.

RemovedArticle 22 – paragraph 1 – subparagraph 1: 1. For the prevention, detection and investigation of criminal offences, Member States shall allow national contact points of other Member States and Europol access to the facial images stored in their national databases referred to in Article 21(1), to conduct automated searches.

RemovedArticle 22 – paragraph 1 – subparagraph 2: Searches shall only be conducted in individual cases, where they are proportionate and necessary for the purpose of preventing, detecting or investigating a serious criminal offence, and in compliance with the national law of the requesting Member State. Searches for the purpose of profiling shall be prohibited.

RemovedArticle 22 – paragraph 2: 2. The requesting Member State shall receive a list composed of matches concerning likely candidates. That Member State shall ensure that a human review of the list is conducted by two forensic experts in order to determine the existence of a confirmed match.

RemovedArticle 22 – paragraph 3: deleted

RemovedArticle 23 – paragraph 1 – point a: (a) a reference number allowing Member States, in case of a match, to retrieve further data and other information in their databases referred to in Article 21 in order to supply it to one, several or all of the other Member States in accordance with Article 47 or Europol in accordance with Article 50(6);

RemovedArticle 23 a (new): Article 23a / Principles for the exchange of facial images / 1. Each Member State and Europol shall ensure that the facial images in their databases are of sufficient quality for the purpose of this Regulation, in particular for automated comparison. / 2. Member States shall take appropriate measures to ensure the confidentiality and integrity of facial images being sent to other Member States, and Europol of facial images being sent to Member States, including the encryption of such facial images. / 3. The Commission shall adopt implementing acts specifying the relevant European or international standards for facial image exchange that are to be used by Member States and Europol, including the minimum quality standard for the automated comparison of facial images. Those implementing acts shall be adopted in accordance with the procedure referred to in Article 75(2).

RemovedArticle 25 – title: National Police records indexes

RemovedArticle 25 – paragraph 1 – introductory part: 1. Member States may decide to participate in the automated exchange of police records indexes. For the purposes of such exchanges, participating Member States shall ensure the availability of national police records indexes which contain sets of biographical data of persons convicted or suspected of having committed a serious criminal offence from their national databases established for the investigation of criminal offences. Those sets of data shall, if applicable and to the extent that they are available, contain only the following data:

RemovedArticle 25 – paragraph 1 – point c: (c) alias(es) and previously used name or names;

RemovedArticle 25 – paragraph 1 a (new): 1a. Member States shall, in accordance with Article 7(2) of Directive (EU) 2016/680, ensure that the data included in the national police records indexes as listed in paragraph 1 of this Article are accurate, complete and up to date.

RemovedArticle 26 – title: Automated searching of police records indexes

RemovedArticle 26 – paragraph 1 – subparagraph 1: 1. For the investigation of criminal offences, Member States participating in the automated exchange of police records indexes shall allow national contact points of other Member States participating in such exchanges and Europol access to data in their national police records indexes, to conduct automated searches.

RemovedArticle 26 – paragraph 1 – subparagraph 2: Searches shall only be conducted in individual cases, where they are proportionate and necessary for the investigation of a serious criminal offence, and in compliance with the national law of the requesting Member State.

RemovedArticle 26 – paragraph 2: deleted / (deleted)

RemovedArticle 27 – paragraph 1 – point a: (a) a reference number allowing Member States, in the case of a match, to retrieve personal data and other information in their national police records indexes referred to in Article 25 in order to supply it to one, several or all of the Member States in accordance with Article 44;

RemovedArticle 28 – title: Rules for requests and answers regarding police records indexes

RemovedArticle 28 – paragraph 1 – introductory part: 1. A request for an automated search of police records indexes shall include only the following information:

RemovedArticle 28 – paragraph 1 – point c: (c) the data referred to in Article 25(1), where available, and pseudonymised in accordance with Article 25(2).

RemovedArticle 28 – paragraph 2 – point a: (a) an indication as to the number of matches;

RemovedArticle 29 – paragraph 1: Each Member State shall designate at least one national contact point.

RemovedArticle 29 – paragraph 2 a (new): 2a. Member States shall ensure that their national contact points are provided with adequate human, technical and financial resources, including qualified staff, to carry out their tasks under this Regulation in an adequate, effective and rapid manner.

RemovedArticle 30 – paragraph 1: The Commission shall adopt implementing acts to specify the technical arrangements to be made by the Member States with respect to the procedures set out in Articles 6, 7, 13, 18, 22 and 26. Those implementing acts shall be adopted in accordance with the procedure referred to in Article 75(2).

RemovedArticle 31 – paragraph 1: deleted

RemovedArticle 32 – paragraph 2 – subparagraph 1: National contact points shall immediately inform each other, the Commission, Europol and eu-LISA of technical faults causing unavailability of the automated data exchange.

RemovedArticle 32 – paragraph 2 – subparagraph 2: National contact points shall agree on temporary alternative information exchange arrangements in accordance with the applicable Union and national law to be used in cases where automated data exchange is unavailable.

RemovedArticle 32 – paragraph 3: 3. Where automated data exchange is unavailable, national contact points shall ensure that it is re-established without delay.

RemovedArticle 33 – paragraph 1 – subparagraph 1: 1. Each Member State shall keep a justification of the queries that its competent law enforcement authorities make.

RemovedArticle 33 – paragraph 2 – point a: (a) the purpose of the query, including a reference to the specific case or investigation and the criminal offence, where applicable;

RemovedArticle 33 – paragraph 2 – point b: (b) an indication on whether the query concerns a suspect or a person convicted of a criminal offence, a victim of serious crime or terrorism, a missing person or unidentified human remains;

RemovedArticle 33 – paragraph 2 – point c: (c) an indication on whether the query aims to identify a person or obtain more data on a known person.

RemovedArticle 33 – paragraph 3 – subparagraph 1: The justifications referred to in paragraph 2 shall only be used for fundamental rights and data protection monitoring, including checking the admissibility of a query and the lawfulness of data processing, and for ensuring data security and integrity.

RemovedArticle 33 – paragraph 3 – subparagraph 2: Those justifications shall be protected by appropriate measures against unauthorised access and erased three years after their creation. If, however, they are required for monitoring procedures that have already begun, they shall be erased once the monitoring procedures no longer require the justification.

RemovedArticle 33 – paragraph 4: 4. For the purposes of fundamental rights and data protection monitoring, including checking the admissibility of a query and the lawfulness of data processing, the data controllers shall have unrestricted access to those justifications for self-monitoring as referred to in Article 56.

RemovedArticle 34 – paragraph 1: 1. The universal message format (UMF) standard established under Article 38 of Regulation (EU)2019/818 shall be used in the development of the router referred to in Article 35 of this Regulation and EPRIS, to the extent it is applicable.

RemovedArticle 35 – paragraph 1: 1. A router is established for the purposes of facilitating the establishment of connections between Member States, and between Member States and Europol, for querying with, retrieving and scoring biometric data and for retrieving alphanumeric data in accordance with this Regulation.

RemovedArticle 35 – paragraph 2 – point a: (a) a central infrastructure, including a search tool enabling the simultaneous querying of Member States’ databases referred to in Articles 5, 12 and 21 and Europol data;

RemovedArticle 35 – paragraph 2 – point b: (b) a secure communication channel between the central infrastructure, Member States’ competent law enforcement authorities authorised to use the router in accordance with Article 36, and Europol;

RemovedArticle 36 – paragraph 1: The use of the router shall be reserved to the Member States’ competent law enforcement authorities that are authorised to access and exchange DNA profiles, dactyloscopic data and facial images in accordance with this Regulation, and Europol in accordance with this Regulation and Regulation (EU) 2016/794 where they have a demonstrable need for such access. Member States and Europol shall ensure that their authorised staff have completed relevant training, including on data protection, confidentiality, detection of biases, as well as the accurate review of matches under the relevant data category.

RemovedArticle 37 – paragraph 1: 1. The competent law enforcement authorities authorised to access the router pursuant to Article 36 shall request a query by submitting biometric data to the router. The router shall dispatch the request for a query to the databases of the requested Member States and Europol data simultaneously with the data submitted by the user in accordance with his or her access rights.

RemovedArticle 37 – paragraph 2: 2. Upon receipt of a request for a query from the router, each requested Member State and Europol shall launch a query of their databases in an automated manner and without delay.

RemovedArticle 37 – paragraph 3: 3. Any candidates resulting from queries referred to in paragraph 2 shall be sent back in an automated manner to the router. The requesting Member State shall be notified in an automated manner where there is no match.

RemovedArticle 37 – paragraph 4: 4. The router shall rank the replies in accordance with the score of the correspondence between the biometric data used for querying and the biometric data supplied by the requested Member States’ databases and Europol data.

RemovedArticle 37 – paragraph 5: 5. The router shall return the list of matching biometric data and their scores to the router user. That list shall be limited to the maximum number of candidates set out in the implementing act adopted pursuant to paragraph 6.

RemovedArticle 37 – paragraph 6: 6. The Commission, after consulting the European Data Protection Board in accordance with Article 42(2) of Regulation 2018/1725, shall adopt implementing acts to specify the technical procedure for the router to query Member States’ databases and Europol data, the format of the router replies, the technical rules for scoring the correspondence between biometric data and the relevant thresholds, as well as the maximum number of candidates that can be returned per search, with a view to ensuring accuracy, minimising the risk of misidentification and preventing discrimination. Those implementing acts shall be adopted in accordance with the procedure referred to in Article 75(2).

RemovedArticle 38 – paragraph 1: The requested Member State shall check the quality of the transmitted data by means of an automated procedure.

RemovedArticle 38 – paragraph 2: The requested Member State shall, without delay, inform the requesting Member State via the router where the data are unsuitable for an automated comparison.

RemovedArticle 39 – paragraph 1: 1. Where designated authorities are authorised to use the router pursuant to Article 36, they may launch a query to Member States’ databases and Europol data simultaneously with a query to the Common Identity Repository, provided that the relevant conditions under Union law are fulfilled and that the query is launched in accordance with their access rights. For this purpose, the router shall query the Common Identity Repository via the European Search Portal.

RemovedArticle 39 – paragraph 2 – subparagraph 2: deleted

RemovedArticle 39 – paragraph 2 – subparagraph 3: Simultaneous queries of the Member States’ databases and Europol data and the Common Identity Repository may only be launched where there are reasonable grounds to believe that data on a suspect, perpetrator or victim of a terrorist offence or other serious criminal offences as defined respectively in Article 4, points 21 and 22, of Regulation (EU) 2019/817 and Article 4, points 21 and 22, of Regulation (EU) 2019/818 are stored in the Common Identity Repository.

RemovedArticle 40 – title: Keeping of logs of all data processing operations in the router

RemovedArticle 40 – paragraph 2 – subparagraph 1: Each Member State shall keep logs of queries that the staff of its competent law enforcement authorities duly authorised to use the router make as well as logs of queries requested by other Member States.

RemovedArticle 40 – paragraph 3 – subparagraph 2: Those logs shall be protected by appropriate measures against unauthorised access and erased three years after their creation. If, however, they are required for monitoring procedures that have already begun, they shall be erased once the monitoring procedures no longer require the logs.

RemovedArticle 41 – paragraph 1: 1. Where it is technically impossible to use the router to query one or several national databases or Europol data because of a failure of the router, the competent law enforcement authorities referred to in Article 36, and Europol shall be notified in an automated manner by eu-LISA. eu-LISA shall take measures to address the technical impossibility to use the router without delay.

RemovedArticle 41 – paragraph 2: 2. Where it is technically impossible to use the router to query one or several national databases because of a failure of the national infrastructure in a Member State, that Member State shall notify the other Member States, Europol, eu-LISA and the Commission in an automated manner. The Member State concerned shall take appropriate measures to address the technical impossibility to use the router without delay.

RemovedArticle 41 – paragraph 3: 3. Where it is technically impossible to use the router to query Europol data because of a failure of the infrastructure of Europol, Europol shall notify the Member States, eu-LISA and the Commission in an automated manner. Europol shall take appropriate measures to address the technical impossibility to use the router without delay.

RemovedArticle 42 – paragraph 1: 1. For the automated searching of national police records indexes referred to in Article 26, Member States and Europol shall use the European Police Records Index System (EPRIS).

RemovedArticle 43 – paragraph 1 – introductory part: 1. For the purposes of searching national police records indexes via EPRIS, at least two of the following sets of data shall be used:

RemovedArticle 43 – paragraph 2 – point a: (a) alias(es) and previously used name or names;

RemovedArticle 44 – paragraph 1 – subparagraph 2: EPRIS shall dispatch the request for a query to the Member States’ national police records indexes with the data submitted by the requesting Member State or Europol and in accordance with this Regulation.

RemovedArticle 44 – paragraph 3: 3. Any matches resulting from the query in each requested Member State’s police records indexes shall be sent back in an automated manner to EPRIS.

RemovedArticle 44 – paragraph 4: 4. The list of matches shall be returned to the requesting Member State and Europol by EPRIS. The list of matches shall indicate the quality of the match as well as the Member State or States whose database or databases contain data that resulted in the match or matchees.

RemovedArticle 44 – paragraph 6 – subparagraph 2: Upon confirmation, the requested Member State(s) shall share the data referred to in Article 43 where available. This exchange of data shall take place via SIENA.

RemovedArticle 45 – paragraph 2: 2. Each participating Member State shall keep logs of the requests for queries that the staff of its competent law enforcement authorities duly authorised to use EPRIS make. Europol shall keep logs of requests for queries that its duly authorised staff make.

RemovedArticle 45 – paragraph 3 – subparagraph 2: Those logs shall be protected by appropriate measures against unauthorised access and erased three years after their creation.

RemovedArticle 46 – paragraph 1: 1. Where it is technically impossible to use EPRIS to query one or several national police records indexes because of a failure of the infrastructure of Europol, Member States shall be notified in an automated manner by Europol. Europol shall take measures to address the technical impossibility to use EPRIS in a timely manner.

RemovedArticle 46 – paragraph 2: 2. Where it is technically impossible to use EPRIS to query one or several national databases because of a failure of the national infrastructure in a Member State, that Member State shall notify Europol and the Commission in an automated manner. Member States shall take measures to address the technical impossibility to use EPRIS in a timely manner.

RemovedArticle 47 – paragraph 1 – introductory part: Where the procedures referred to in Article 6, 7, 13 or 22 show a match between the data used for the search or comparison and data held in the database of the requested Member State(s), and upon manual confirmation of this match by qualified staff of the requesting Member State, the requested Member State shall return a set of core data via the router within 24 hours. Where a judicial authorisation is required under national law, the set of core data shall be returned within 72 hours.

RemovedArticle 47 – paragraph 1 – point a: deleted

RemovedArticle 47 – paragraph 1 – point b: deleted

RemovedArticle 47 – paragraph 1 – point c: deleted

RemovedArticle 47 – paragraph 1 – point d: deleted

RemovedArticle 47 – paragraph 1 – point e: deleted

RemovedArticle 47 – paragraph 1 – point f: deleted

RemovedArticle 47 – paragraph 1 a (new): Where the confirmed match concerns identified data of a person, the set of core data referred to in paragraph 1 shall, to the extent available, contain the following data: / (a) first name or names; / (b) family name or names; / (c) alias or aliases and previously used name or names; / (d) date of birth; / (e) nationality or nationalities; / (f) place and country of birth; / (g) gender; / (h) the date on which and the place where the biometric data were acquired; / (i) the criminal offence for which the biometric data were acquired; / (j) the criminal case number; / (k) the competent law enforcement authority responsible for the criminal case.

RemovedArticle 47 – paragraph 1 b (new): Where the confirmed match concerns unidentified data or traces, the set of core data referred to in paragraph 1 shall, to the extent available, contain the following data: / (a) the date on which and the place where the biometric data were acquired; / (b) the criminal offence for which the biometric data were acquired; / (c) the criminal case number; / (d) the competent law enforcement authority responsible for the criminal case.

RemovedArticle 47 – paragraph 1 c (new): The release of core data by the requested Member State shall be subject to the decision of a human.

RemovedArticle 47 – paragraph 1 d (new): The requested Member State or States shall only refuse to share the core data where: / (a) the judicial authorisation required under the national law of the requested Member State was refused; / (b) there are objective reasons to believe sharing core data would disproportionately infringe the fundamental rights of the data subject; or / (c) there are objective reasons to believe sharing core data would jeopardise the success of an ongoing investigation of a criminal offence. / The justification for such refusals shall be provided promptly to the requesting Member State and in any event within the time limits provided in paragraph 1.

RemovedArticle 48: deleted / (deleted) / (deleted)

RemovedArticle 49 – paragraph 1: 1. Without prejudice to any restrictions indicated by the provider of the information to Europol in accordance with Article 19(2) of Regulation (EU) 2016/794, Member States shall, in accordance with Regulation (EU) 2016/794, have access to, and be able to search via the router, biometric data which has been provided to Europol by third countries for the purposes of Article 18(2), points (a), (b) and (c), of Regulation (EU) 2016/794.

RemovedArticle 49 – paragraph 2: 2. Where the search referred to in paragraph 1 results in a match between the data used for the search and third-country-sourced data held by Europol, the follow-up shall take place in accordance with Regulation (EU) 2016/794.

RemovedArticle 50 – paragraph 1: 1. Where necessary to achieve the objectives set out in Article 3 of Regulation (EU) 2016/794, Europol shall, in accordance with Regulation (EU) 2016/794, have access to data which are stored by Member States in their national databases in accordance with this Regulation.

RemovedArticle 50 – paragraph 4: 4. Europol queries performed with biographical data referred to in Article 25 as a search criterion shall be carried out using EPRIS.

RemovedArticle 50 – paragraph 5: 5. Europol shall carry out the searches in accordance with paragraph 1 of this Article only for the purpose of Article 18(2), point (a), of Regulation (EU) 2016/794, when carrying out its tasks referred to in Regulation (EU) 2016/794.

RemovedArticle 50 – paragraph 6 – introductory part: 6. Where the procedures referred to in Article 6, 7, 13 or 22 show a match between the data used for the search or comparison and data held in the national database of the requested Member State(s), and upon human review of that match by qualified staff of Europol in accordance with this Regulation and the transmission of the name of the third country which provided the data, the requested Member State shall decide whether to return a set of core data via the router within 24 hours. Where a judicial authorisation is required under national law, the core data shall be returned within 72 hours. That set of core data, if available, shall contain the following data:

RemovedArticle 50 – paragraph 7: 7. Europol's use of information obtained from a search made in accordance with paragraphs 1 and 5, and from the exchange of core data in accordance with paragraph 6, shall be subject to the consent of the Member State in whose database the match occurred. If the Member State allows the use of such information, its handling by Europol shall be governed by Regulation (EU) 2016/794.

RemovedArticle 51 – title: Purpose of the data processing

RemovedArticle 51 – paragraph 1: 1. Processing of personal data received by the requesting Member State or Europol shall be permitted solely for the purposes for which the data have been supplied by the requested Member State in accordance with this Regulation. Without prejudice to Directive (EU) 2016/680 or Regulation (EU) 2018/1725, as applicable, processing for other purposes shall be permitted solely with the prior authorisation of the requested Member State or Europol, as relevant.

RemovedArticle 51 – paragraph 2 – introductory part: 2. Processing of data supplied pursuant to Article 6, 7, 13, 18, 22 or 26 by the requesting Member State or Europol shall be permitted solely where necessary in order to:

RemovedArticle 51 – paragraph 2 – point a a (new): (aa) exchange a set of core data pursuant to Article 47;

RemovedArticle 51 – paragraph 2 – point b: (b) prepare and submit a police or judicial request for legal assistance if those data match;

RemovedArticle 51 – paragraph 2 – point c: (c) logging within the meaning of Articles 20, 40 and 45.

RemovedArticle 51 – paragraph 3: 3. The personal data received by the requesting Member State or Europol shall be deleted immediately following data comparison or automated replies to searches unless further processing by the requesting Member State is strictly necessary and proportionate for the purposes of the prevention, detection and investigation of criminal offences.

RemovedArticle 51 – paragraph 4: 4. Data supplied in accordance with Article 18 may be used by the requesting Member State solely where this is strictly necessary and proportionate to achieve the purposes of this Regulation. The data supplied shall be deleted immediately following automated replies to searches unless further processing is necessary for recording pursuant to Article 20. The requesting Member State shall use the data received in a reply solely for the procedure for which the search was made.

RemovedArticle 51 – paragraph 4 a (new): 4a. Prior to connecting their national databases to the router, EPRIS or Eucaris, Member States shall conduct a data protection impact assessment as referred to in Article 27 of Directive (EU) 2016/680 and consult the supervisory authority as referred to in Article 28 of that Directive. The supervisory authority may use any of its powers referred to in Article 47 of Directive (EU) 2016/680, in accordance with paragraph 5 of Article 28 of that Directive.

RemovedArticle 51 – paragraph 4 b (new): 4b. Member States shall ensure that data subjects are provided with information pursuant to Article 13 of Directive (EU) 2016/680 to allow them to exercise their rights.

RemovedArticle 51 – paragraph 4 c (new): 4c. The European Data Protection Board shall issue guidelines on the implementation of Directive (EU) 2016/680 concerning the criminal databases and cross-border exchanges of personal data, in particular concerning accuracy, strict necessity and how to ensure respect for the right to data protection.

RemovedArticle 52 – paragraph 1: 1. Member States and Europol shall ensure the accuracy and current relevance of personal data which are processed pursuant to this Regulation. Should a requested Member State or Europol become aware that data that are incorrect or no longer up to date or data which should not have been supplied have been supplied, this shall be notified without delay to any requesting Member State. All requesting Member States concerned shall be obliged to correct or delete the data accordingly without delay. Moreover, personal data supplied shall be corrected if they are found to be incorrect. If the requesting Member State or Europol has reason to believe that the supplied data are incorrect or should be deleted the requested Member State shall be informed without delay.

RemovedArticle 52 – paragraph 1 – subparagraph 1 a (new): Member States and Europol shall put in place appropriate measures for updating their databases, including as regards acquittals of persons whose personal data are in the databases.

RemovedArticle 52 – paragraph 2: 2. Where a data subject contested the accuracy of data in possession of a Member State or Europol, where the accuracy cannot be reliably established by the Member State concerned or Europol and where it is requested by the data subject, the data concerned shall be marked with a flag. Where such a flag exists, Member States or Europol may remove it only with the permission of the data subject or based on a decision of the competent court or national supervisory authority or the European Data Protection Supervisor, as relevant.

RemovedArticle 52 – paragraph 3 – subparagraph 1 – point b: (b) following the expiry of the maximum period for keeping data laid down under the national law of the requested Member State where the requested Member State or Europol informed the requesting Member State of that maximum period at the time of supplying the data;

RemovedArticle 52 – paragraph 3 – subparagraph 1 – point b a (new): (ba) following the expiry of the maximum period for keeping data laid down in Regulation (EU) 2016/794.

RemovedArticle 52 – paragraph 3 – subparagraph 2: Where there is reason to believe that the deletion of data would prejudice the interests of the data subject, the data shall be restricted instead of being deleted. Restricted data shall be processed solely for the purpose which prevented their deletion.

RemovedArticle 53 – paragraph 2 a (new): 2a. Member States shall be the processors for the processing of personal data via Eucaris.

RemovedArticle 54 – paragraph 1: 1. Europol, eu-LISA and Member States’ competent law enforcement authorities shall ensure the security of the processing of personal data that takes place pursuant to this Regulation. Europol, eu-LISA and Member States’ competent law enforcement authorities shall cooperate on security-related tasks.

RemovedArticle 54 – paragraph 2: 2. Without prejudice to Article 91 of Regulation (EU) 2018/1725 and Article 32 of Regulation (EU) 2016/794, eu-LISA and Europol shall take the necessary measures to ensure the security of the router and EPRIS respectively as well as their related communication infrastructure.

RemovedArticle 55 – paragraph 2: 2. Security incidents shall be managed in close cooperation between the Member States concerned or Europol and eu-LISA, as relevant, so as to ensure a quick, effective and proper response.

RemovedArticle 55 – paragraph 3 – subparagraph 2: Without prejudice to Article 34 of Regulation (EU) 2016/794 and Article 92 of Regulation (EU) 2018/1725, Europol shall notify CERT-EU of significant cyber threats, significant vulnerabilities and significant incidents without undue delay and in any event no later than 24 hours after becoming aware of them. Actionable and appropriate technical details of cyber threats, vulnerabilities and incidents that enable proactive detection, incident response or mitigating measures shall be disclosed to CERT-EU without undue delay.

RemovedArticle 55 – paragraph 3 – subparagraph 3: In the event of a security incident in relation to the central infrastructure of the router and without prejudice to Article 92 of Regulation (EU) 2018/1725, eu-LISA shall notify CERT-EU of significant cyber threats, significant vulnerabilities and significant incidents without undue delay and in any event no later than 24 hours after becoming aware of them. Actionable and appropriate technical details of cyber threats, vulnerabilities and incidents that enable proactive detection, incident response or mitigating measures shall be disclosed to CERT-EU without undue delay.

RemovedArticle 55 – paragraph 5 a (new): 5a. This Article is without prejudice to the reporting obligations pursuant to Articles 92 and 93 of Regulation (EU) 2018/1725 and Articles 30 and 31 of Directive (EU) 2016/680.

RemovedArticle 56 – paragraph 1: 1. Member States shall ensure that each authority entitled to use Prüm II takes the measures necessary to monitor its compliance with this Regulation and cooperates, where necessary, with the supervisory authority. Europol shall take the measures necessary to monitor its compliance with this Regulation and shall cooperate, where necessary, with the European Data Protection Supervisor.

RemovedArticle 56 – paragraph 2: 2. The data controllers shall implement the necessary technical and organisational measures to ensure effective supervision and monitor the compliance of data processing pursuant to this Regulation, including through frequent verification of the logs referred to in Articles 20, 40 and 45 concerning the admissibility of queries, the lawfulness of data processing and data security and integrity, and cooperate, where necessary and as appropriate, with the supervisory authorities and with the European Data Protection Supervisor.

RemovedArticle 56 – paragraph 2 a (new): 2a. The data controllers and Europol shall be provided with adequate human, financial and technical resources to fulfil their tasks pursuant to this Article.

RemovedArticle 58 – paragraph 1: If any failure of a Member State to comply with its obligations under this Regulation causes damage to the router or EPRIS, that Member State shall be liable for such damage, unless and in so far as eu-LISA, Europol or another Member State bound by this Regulation failed to take reasonable measures to prevent the damage from occurring or to minimise the impact.

RemovedArticle 59 – paragraph 2: 2. Without prejudice to Article 43(3) of Regulation (EU) 2016/794, eu-LISA and Europol shall supply information requested by the European Data Protection Supervisor to it, grant the European Data Protection Supervisor access to all the documents it requests and to their logs referred to in Articles 40 and 45 and allow the European Data Protection Supervisor access to all their premises at any time. This paragraph is without prejudice to the powers of the European Data Protection Supervisor pursuant to Article 58 of Regulation (EU) 2018/1725.

RemovedArticle 59 – paragraph 2 a (new): 2a. The European Data Protection Supervisor shall be provided with the staff and financial resources necessary to carry out the audits referred to in paragraph 1.

RemovedArticle 60 – paragraph 1: 1. The supervisory authorities and the European Data Protection Supervisor shall, each acting within the scope of their respective competences, cooperate actively within the framework of their respective responsibilities to ensure the coordinated supervision of the application of this Regulation, in particular if the European Data Protection Supervisor or a supervisory authority finds major discrepancies between practices of Member States or finds potentially unlawful transfers using the Prüm II communication channels.

RemovedArticle 60 – paragraph 3: 3. The European Data Protection Supervisor and the European Data Protection Board shall send a joint report of its activities under this Article to the European Parliament, to the Council, to the Commission, to Europol and to eu-LISA by 2 years after entry into operation of the router and EPRIS and every two years thereafter. That report shall include a chapter on each Member State prepared by the supervisory authority of the Member State concerned.

RemovedArticle 61 – title: Transfer of personal data to third countries and international organisations

RemovedArticle 61 – paragraph 1: A requesting Member State shall transfer personal data it has obtained in accordance with this Regulation to a third country or an international organisation only in accordance with Chapter V of Directive (EU) 2016/680 and where the requested Member State has granted its authorisation prior to the transfer.

RemovedArticle 61 – paragraph 1 a (new): Europol shall transfer personal any data it has obtained in accordance with this Regulation to a third country or an international organisation only where the conditions laid down in Article 25 of Regulation (EU) 2016/794 are fulfilled and the requested Member State has granted its authorisation prior to the transfer.

RemovedArticle 61 a (new): Article 61 a / Relation to other legal acts on data protection / Any processing of personal data for the purposes of this Regulation shall be carried out in compliance with this Chapter and with Directive (EU) 2016/680, Regulation (EU) 2018/1725 or Regulation (EU) 2016/794, as applicable.

RemovedArticle 62 – paragraph 1 – point g: (g) the management of, and arrangements for, access by the duly authorised staff of the competent national law enforcement authorities to the router in accordance with this Regulation and the creation and regular update of a list of those staff and their profiles;

RemovedArticle 62 – paragraph 1 – point h: (h) the management of, and arrangements for, access by the duly authorised staff of the competent national law enforcement authorities to EPRIS in accordance with this Regulation and the creation and regular update of a list of those staff and their profiles;

RemovedArticle 62 – paragraph 1 – point i: (i) the management of, and arrangements for, access by the duly authorised staff of the competent national law enforcement authorities to Eucaris in accordance with this Regulation and the creation and regular update of a list of those staff and their profiles;

RemovedArticle 62 – paragraph 1 – point j: (j) the human confirmation by qualified staff of a match as referred to in Article 6(3), Article 7(3), Article 13(2) and Article 22(2);

RemovedArticle 62 – paragraph 1 – point m: (m) correcting, updating or deleting any data received from a requested Member State within 24 hours following the notification from the requested Member State that the personal data submitted was incorrect, is no longer up-to-date or was unlawfully transmitted.

RemovedArticle 62 – paragraph 2: 2. Each Member State shall be responsible for connecting their competent national law enforcement authorities to the router, EPRIS and Eucaris.

RemovedArticle 63 – paragraph 3 a (new): 3a. Without prejudice to Article 26(6c) of Regulation (EU) 2016/794 and Europol’s searches pursuant to Article 50(4) of this Regulation, Europol shall not have access to any of the personal data processed through EPRIS.

RemovedArticle 65 – paragraph 1 – subparagraph 3: The router shall be developed and managed in such a way as to ensure fast, efficient and controlled access, full and uninterrupted availability of the router, and a response time in line with the operational needs of the competent law enforcement authorities of the Member States and Europol.

RemovedArticle 65 – paragraph 1 – subparagraph 2 a (new): eu-LISA shall make publicly available information on technology supplied by private parties, including the supplier, for the purposes of its tasks referred to in paragraph 1.

RemovedRegulation (EU) 2018/1726

RemovedArticle 67 – paragraph 1 – point 2 a (new), Article 19 – paragraph 1 – point ee a (new): (2a) in Article 19(1), the following point is added after point (ee): / ‘(eea) adopt the reports on the state of play of the development of the router referred to in Article 35 of Regulation (EU) ../.. of the European Parliament and of the Council [2021/0410(COD)] pursuant to Article 78(2) of that Regulation;’

RemovedRegulation (EU) 2018/1726

RemovedArticle 67 – paragraph 1 – point 2 b (new), Article 19 – paragraph 1 – point ff: (2b) in Article 19(1), point (ff) is replaced by the following: / ‘(ff) adopt the reports on the technical functioning of SIS II pursuant to Article 50(4) of Regulation (EC) No 1987/2006 and Article 66(4) of Decision 2007/533/JHA respectively, of the VIS pursuant to Article 50(3) of Regulation (EC) No 767/2008 and Article 17(3) of Decision 2008/633/JHA, of the EES pursuant to Article 72(4) of Regulation (EU) 2017/2226, of ETIAS pursuant to Article 92(4) of Regulation (EU) 2018/1240 and of the router referred to in Article 35 of Regulation (EU) ../.. [2021/0410(COD)] pursuant to Article 78(5) of that Regulation (EU) ../...;

RemovedRegulation (EU) 2018/1726

RemovedArticle 67 – paragraph 1 – point 2 c (new), Article 19 – paragraph 1 – point hh: (2c) in Article 19(1), point (hh) is replaced by the following: / ‘(hh) adopt formal comments on the European Data Protection Supervisor’s reports on its audits carried out pursuant to Article 56(2) of Regulation (EU) 2018/1861, Article 42(2) of Regulation (EC) No 767/2008, Article 31(2) of Regulation (EU) No 603/2013, Article 56(2) of Regulation (EU) 2017/2226, Article 67 of Regulation (EU) 2018/1240, Article 29(2) of Regulation (EU) 2019/816, Article 52 of Regulations (EU) 2019/817 and (EU) 2019/818 and Article 59(1) of Regulation (EU) ../.. [2021/0410(COD)] and ensure appropriate follow-up of those audits;”

RemovedRegulation (EU) 2019/818

RemovedArticle 69 – paragraph 1 – point 2, Article 39 – paragraph 1: 1. A central repository for reporting and statistics (CRRS) is established for the purposes of supporting the objectives of the SIS, Eurodac, ECRIS-TCN, in accordance with the respective legal instruments governing those systems, and to provide cross-system statistical data and analytical reporting for policy, operational and data quality purposes. The CRRS shall also support the objectives of Regulation (EU) … /… of the European Parliament and of the Council* [2021/0410(COD)]..”

RemovedRegulation (EU) 2019/818

RemovedArticle 69 – paragraph 1 – point 2, Article 39 – paragraph 2: “2. eu-LISA shall establish, implement and host in its technical sites the CRRS containing the data and statistics referred to in Article 74 of Regulation (EU) 2018/1862 and Article 32 of Regulation (EU) 2019/816 logically separated by EU information system. eu-LISA shall also collect the data and statistics from the router referred to in Article 70(1) of Regulation (EU) …/… * [this Regulation ]. Access to the CRRS shall be granted by means of controlled, secured access and specific user profiles, solely for the purpose of reporting and statistics, to the authorities referred to in Article 74 of Regulation (EU) 2018/1862, Article 32 of Regulation (EU) 2019/816 and Article 64(1) of Regulation (EU) …/… * [this Regulation ].”

RemovedArticle 70 – paragraph 1 – subparagraph 1 – introductory part: The duly authorised staff of the competent law enforcement authorities of Member States, the Commission, Europol and eu-LISA shall have access to the following data related to the router, as relevant, solely for the purposes of reporting and statistics:

RemovedArticle 70 – paragraph 1 – subparagraph 1 – point a: (a) number of queries per Member State and by Europol, per category of data;

RemovedArticle 70 – paragraph 1 – subparagraph 1 – point b: deleted

RemovedArticle 70 – paragraph 1 – subparagraph 1 – point f: (f) number of confirmed matches where there were exchanges of core data;

RemovedArticle 70 – paragraph 1 – subparagraph 1 – point f a (new): (f a) number of confirmed matches where there were no exchanges of core data;

RemovedArticle 70 – paragraph 1 – subparagraph 1 – point f b (new): (f b) number of unconfirmed matches; and

RemovedArticle 70 – paragraph 1 – subparagraph 2: The data shall be aggregated. It shall not be possible to identify individuals from the data.

RemovedArticle 70 – paragraph 2 – subparagraph 1 – introductory part: The duly authorised staff of the competent law enforcement authorities of Member States, Europol and the Commission shall have access to consult the following data related to Eucaris, solely for the purposes of reporting and statistics:

RemovedArticle 70 – paragraph 2 – subparagraph 2: The data shall be aggregated. It shall not be possible to identify individuals from the data

RemovedArticle 70 – paragraph 3 – subparagraph 1 – introductory part: The duly authorised staff of the competent law enforcement authorities of Member States, the Commission and Europol shall have access to consult the following data related to EPRIS, solely for the purposes of reporting and statistics:

RemovedArticle 70 – paragraph 4 – subparagraph 1: eu-LISA shall store the data referred to in paragraph 1 of this Article in the central repository for reporting and statistics established pursuant to Article 39 of Regulation (EU) 2019/818.

RemovedArticle 70 – paragraph 4 – subparagraph 2: The data shall allow the competent law enforcement authorities of the Member States, Europol, eu-LISA and the Commission to obtain customisable reports and statistics to enhance the efficiency of law enforcement cooperation.

RemovedArticle 72 – paragraph 1: 1. Member States shall notify eu-LISA of the competent law enforcement authorities referred to in Article 36, which may use or have access to the router.

RemovedArticle 72 – paragraph 2 a (new): 2a. Each Member State shall notify the other Member States, the Commission, eu-LISA and Europol of the content of its national DNA databases to which Articles 5, 6 and 7 apply.

RemovedArticle 72 – paragraph 2 b (new): 2b. Each Member States shall inform the other Member States, the Commission, eu-LISA and Europol of the content of its national dactyloscopic databases to which Articles 12 and 13 apply.

RemovedArticle 72 – paragraph 2 c (new): 2c. Each Member States shall inform the other Member States, the Commission, eu-LISA and Europol of the content of its national facial images databases to which Articles 21 and 22 apply.

RemovedArticle 72 – paragraph 2 d (new): 2d. Member States participating in automated exchanges of police records pursuant to Articles 25 and 26 shall notify the other Member States, the Commission and Europol of the content of its national police records indexes, the national databases used for the establishment of those indexes and the conditions for automated searches.

RemovedArticle 72 – paragraph 3: 3. Member States shall notify the Commission, Europol and eu-LISA of their national contact point designated pursuant to Article 29. The Commission shall compile a list of the national contact points of which it has been notified and make it available to all Member States.

RemovedArticle 73 – paragraph 1 – subparagraph 1 – introductory part: 1. The Commission shall determine the date from which the Member States and Europol may start using the router by means of an implementing act once the following conditions have been met:

RemovedArticle 73 – paragraph 1 – subparagraph 1 – point a: (a) the measures referred to in Article 5(2c), Article 10(3), Article 15(4), Article 19(3), Article 23a(3), Article 30 and Article 37(6) have been adopted;

RemovedArticle 73 – paragraph 1 – subparagraph 1 – point b: (b) eu-LISA has declared the successful completion of a comprehensive test of the router, which it has conducted in cooperation with the Member States’ competent law enforcement authorities and Europol.

RemovedArticle 73 – paragraph 1 – subparagraph 2: In that implementing act the Commission shall also determine the date from which the Member States and Europol shall start using the router. That date shall be one year after the date determined in accordance with the first subparagraph.

RemovedArticle 73 – paragraph 1 – subparagraph 3: The Commission may postpone the date from which the Member States and the Union agencies are to start using the router by one year at most where an assessment of the implementation of the router has shown that such a postponement is necessary.

RemovedArticle 73 – paragraph 2 – introductory part: 2. The Commission shall determine the date from which the Member States and Europol are to start using EPRIS by means of an implementing act once the following conditions have been met:

RemovedArticle 73 – paragraph 2 – point b: (b) Europol has declared the successful completion of a comprehensive test of EPRIS, which it has conducted in cooperation with the Member States’ competent law enforcement authorities.

RemovedArticle 73 – paragraph 3 – point b: (b) Europol has declared the successful completion of a comprehensive test of the connection, which it has conducted in cooperation with the Member States competent law enforcement authorities’ and eu-LISA.

RemovedArticle 73 – paragraph 4 – point b: (b) Europol has declared the successful completion of a comprehensive test of the connection, which it has conducted in cooperation with the Member States’ competent law enforcement authorities and eu-LISA.

RemovedArticle 73 – paragraph 4 a (new): 4a. The implementing acts referred to in this Article shall be adopted in accordance with the procedure referred to in Article 75(2).

RemovedArticle 77 – paragraph 1: The Commission shall, in close cooperation with the Member States, Europol, eu-LISA, the European Data Protection Board, the European Data Protection Supervisor and the European Union Agency for Fundamental Rights make available a practical handbook for the implementation and management of this Regulation. The practical handbook shall provide technical and operational guidelines, recommendations and best practices. The Commission shall adopt the practical handbook in the form of a recommendation by ... [six months after entry into force of this Regulation]. The Commission shall regularly and where necessary update the practical handbook.

RemovedArticle 78 – paragraph 1: 1. eu-LISA and Europol shall, respectively, ensure that procedures are in place to monitor the development of the router and of EPRIS in light of objectives relating to planning and costs and to monitor their functioning in light of objectives relating to the technical output, cost-effectiveness, security and quality of service.

RemovedArticle 78 – paragraph 2 – subparagraph 1: By [one year after entry into force of this Regulation] and every year thereafter during the development phase of the router, eu-LISA shall submit a report to the European Parliament and to the Council on the state of play of the development of the router. That report shall contain detailed information about the costs incurred and information as to any risks which may impact the overall costs to be borne by the general budget of the Union in accordance with Article 71.

RemovedArticle 78 – paragraph 3 – subparagraph 1: By [one year after entry into force of this Regulation] and every year thereafter during the development phase of EPRIS, Europol shall submit a report to the European Parliament and to the Council on the state of play of the development of EPRIS including detailed information about the costs incurred and information as to any risks which may impact the overall costs to be borne by the general budget of the Union in accordance with Article 71.

RemovedArticle 78 – paragraph 4: 4. For the purposes of technical maintenance, eu-LISA and Europol shall have access to the necessary information relating to the data processing operations performed in the router and EPRIS respectively. That access shall exclude access to any personal data.

RemovedArticle 78 – paragraph 7 – subparagraph 1 – introductory part: Two years after the start of operations of the router and EPRIS as referred to in Article 73 and every four years thereafter, the Commission shall produce an overall evaluation of Prüm II, including:

RemovedArticle 78 – paragraph 7 – subparagraph 1 – point a: (a) an assessment of the application of this Regulation for each Member State and Europol;

RemovedArticle 78 – paragraph 7 – subparagraph 1 a (new): The Commission shall pay due attention to any Member State subject to a procedure referred to in Article 7 of the Treaty on the European Union

RemovedArticle 78 – paragraph 8: 8. The Member States and Europol shall provide eu-LISA and the Commission with the information necessary to draft the reports referred to in paragraphs 2 and 5. This information shall not jeopardise working methods or include information that reveals sources, staff members or investigations of the competent law enforcement authorities.

RemovedArticle 78 – paragraph 9: 9. The Member States shall provide Europol and the Commission with the information necessary to draft the reports referred to in paragraphs 3 and 6. This information shall not jeopardise working methods or include information that reveals sources, staff members or investigations of the competent law enforcement authorities.

RemovedArticle 78 – paragraph 10: 10. Without prejudice to confidentiality requirements and the protection of ongoing investigations, Member States, eu-LISA and Europol shall provide the Commission with the information necessary to produce the evaluations referred to in paragraph 7. Member States shall also provide the Commission with the number of confirmed matches against each Member State’s database per category of data.