Changes from plenary report to adopted text

RemovedArticle 15 – paragraph 1: 1. The digitalisation of dactyloscopic data and their transmission to the other Member States or Europol shall be carried out in accordance with a uniform data format. The Commission shall adopt implementing acts to specify the uniform data format in accordance with the procedure referred to in Article 75(2).

RemovedArticle 15 – paragraph 2: 2. Each Member State and Europol shall ensure that the dactyloscopic data it transmits are of sufficient quality for automated comparison.

RemovedArticle 15 – paragraph 3: 3. Member States and Europol shall take all appropriate measures to ensure the confidentiality and integrity of dactyloscopic data being sent to other Member States, including their encryption.

RemovedArticle 15 – paragraph 4: 4. The Commission shall adopt implementing acts specifying the relevant existing European or international standards for dactyloscopic data exchange that are to be used by Member States, including the minimum quality standard for the automated comparison of dactyloscopic data. Those implementing acts shall be adopted in accordance with the procedure referred to in Article 75(2).

RemovedArticle 16 – paragraph 1 – subparagraph 1: Member States and Europol shall ensure that their search requests do not exceed the search capacities specified by the requested Member State.

RemovedArticle 16 – paragraph 1 – subparagraph 2: Member States shall inform other Member States, Europol, the Commission and eu-LISA about their maximum search capacities per day for dactyloscopic data of identified persons and for dactyloscopic data of persons not yet identified. Member States may raise those maximum search capacities. Where a Member State raises those maximum search capacities, it shall notify the other Member States, Europol, the Commission and eu-LISA of the new maximum search capacities.

RemovedArticle 18 – paragraph 1 – point a: (a) data relating to owners or keepers;

RemovedArticle 18 – paragraph 3 a (new): 3a. The data referred to in paragraph 1, points (a) and (b), of this Article shall not go beyond the data elements specified in the implementing act adopted pursuant to Article 19(3).

RemovedArticle 19 – paragraph 3: 3. The Commission shall adopt implementing acts to specify the data elements of the vehicle registration data which may be exchanged. Those implementing acts shall be adopted in accordance with the procedure referred to in Article 75(2).

RemovedArticle 20 – paragraph 1 – subparagraph 1: Each Member State shall keep logs of queries that the staff of its competent law enforcement authorities duly authorised to exchange vehicle registration data make as well as logs of queries requested by other Member States. Europol shall keep logs of queries that its duly authorised staff make.

RemovedArticle 20 – paragraph 2 – subparagraph 2: Those logs shall be protected by all appropriate measures against unauthorised access and erased three years after their creation. If, however, they are required for monitoring procedures that have already begun, they shall be erased once the monitoring procedures no longer require the logs.

RemovedArticle 21 – paragraph 1 – subparagraph 1: Member States shall ensure the availability of facial images of persons convicted or suspected of having committed a criminal offence collected in accordance with their national law from their national databases established for the prevention, detection and investigation of criminal offences. Those data shall only include facial images and the reference number referred to in Article 23, and shall indicate whether the facial images are attributed to an individual or not.

RemovedArticle 21 – paragraph 1 – subparagraph 2: Member States shall not make available in this context any additional data from which an individual can be directly identified.

RemovedArticle 21 – paragraph 2: 2. Unidentified facial images must be recognisable as such.

RemovedArticle 22 – paragraph 1 – subparagraph 1: 1. For the prevention, detection and investigation of criminal offences, Member States shall allow national contact points of other Member States and Europol access to the facial images stored in their national databases referred to in Article 21(1), to conduct automated searches.

RemovedArticle 22 – paragraph 1 – subparagraph 2: Searches shall only be conducted in individual cases, where they are proportionate and necessary for the purpose of preventing, detecting or investigating a serious criminal offence, and in compliance with the national law of the requesting Member State. Searches for the purpose of profiling shall be prohibited.

RemovedArticle 22 – paragraph 2: 2. The requesting Member State shall receive a list composed of matches concerning likely candidates. That Member State shall ensure that a human review of the list is conducted by two forensic experts in order to determine the existence of a confirmed match.

RemovedArticle 22 – paragraph 3: deleted

RemovedArticle 23 – paragraph 1 – point a: (a) a reference number allowing Member States, in case of a match, to retrieve further data and other information in their databases referred to in Article 21 in order to supply it to one, several or all of the other Member States in accordance with Article 47 or Europol in accordance with Article 50(6);

RemovedArticle 23 a (new): Article 23a / Principles for the exchange of facial images / 1. Each Member State and Europol shall ensure that the facial images in their databases are of sufficient quality for the purpose of this Regulation, in particular for automated comparison. / 2. Member States shall take appropriate measures to ensure the confidentiality and integrity of facial images being sent to other Member States, and Europol of facial images being sent to Member States, including the encryption of such facial images. / 3. The Commission shall adopt implementing acts specifying the relevant European or international standards for facial image exchange that are to be used by Member States and Europol, including the minimum quality standard for the automated comparison of facial images. Those implementing acts shall be adopted in accordance with the procedure referred to in Article 75(2).

RemovedArticle 25 – title: National Police records indexes

RemovedArticle 25 – paragraph 1 – introductory part: 1. Member States may decide to participate in the automated exchange of police records indexes. For the purposes of such exchanges, participating Member States shall ensure the availability of national police records indexes which contain sets of biographical data of persons convicted or suspected of having committed a serious criminal offence from their national databases established for the investigation of criminal offences. Those sets of data shall, if applicable and to the extent that they are available, contain only the following data:

RemovedArticle 25 – paragraph 1 – point c: (c) alias(es) and previously used name or names;

RemovedArticle 25 – paragraph 1 a (new): 1a. Member States shall, in accordance with Article 7(2) of Directive (EU) 2016/680, ensure that the data included in the national police records indexes as listed in paragraph 1 of this Article are accurate, complete and up to date.

RemovedArticle 26 – title: Automated searching of police records indexes

RemovedArticle 26 – paragraph 1 – subparagraph 1: 1. For the investigation of criminal offences, Member States participating in the automated exchange of police records indexes shall allow national contact points of other Member States participating in such exchanges and Europol access to data in their national police records indexes, to conduct automated searches.

RemovedArticle 26 – paragraph 1 – subparagraph 2: Searches shall only be conducted in individual cases, where they are proportionate and necessary for the investigation of a serious criminal offence, and in compliance with the national law of the requesting Member State.

RemovedArticle 26 – paragraph 2: deleted / (deleted)

RemovedArticle 27 – paragraph 1 – point a: (a) a reference number allowing Member States, in the case of a match, to retrieve personal data and other information in their national police records indexes referred to in Article 25 in order to supply it to one, several or all of the Member States in accordance with Article 44;

RemovedArticle 28 – title: Rules for requests and answers regarding police records indexes

RemovedArticle 28 – paragraph 1 – introductory part: 1. A request for an automated search of police records indexes shall include only the following information:

RemovedArticle 28 – paragraph 1 – point c: (c) the data referred to in Article 25(1), where available, and pseudonymised in accordance with Article 25(2).

RemovedArticle 28 – paragraph 2 – point a: (a) an indication as to the number of matches;

RemovedArticle 29 – paragraph 1: Each Member State shall designate at least one national contact point.

RemovedArticle 29 – paragraph 2 a (new): 2a. Member States shall ensure that their national contact points are provided with adequate human, technical and financial resources, including qualified staff, to carry out their tasks under this Regulation in an adequate, effective and rapid manner.

RemovedArticle 30 – paragraph 1: The Commission shall adopt implementing acts to specify the technical arrangements to be made by the Member States with respect to the procedures set out in Articles 6, 7, 13, 18, 22 and 26. Those implementing acts shall be adopted in accordance with the procedure referred to in Article 75(2).

RemovedArticle 31 – paragraph 1: deleted

RemovedArticle 32 – paragraph 2 – subparagraph 1: National contact points shall immediately inform each other, the Commission, Europol and eu-LISA of technical faults causing unavailability of the automated data exchange.

RemovedArticle 32 – paragraph 2 – subparagraph 2: National contact points shall agree on temporary alternative information exchange arrangements in accordance with the applicable Union and national law to be used in cases where automated data exchange is unavailable.

RemovedArticle 32 – paragraph 3: 3. Where automated data exchange is unavailable, national contact points shall ensure that it is re-established without delay.

RemovedArticle 33 – paragraph 1 – subparagraph 1: 1. Each Member State shall keep a justification of the queries that its competent law enforcement authorities make.

RemovedArticle 33 – paragraph 2 – point a: (a) the purpose of the query, including a reference to the specific case or investigation and the criminal offence, where applicable;

RemovedArticle 33 – paragraph 2 – point b: (b) an indication on whether the query concerns a suspect or a person convicted of a criminal offence, a victim of serious crime or terrorism, a missing person or unidentified human remains;

RemovedArticle 33 – paragraph 2 – point c: (c) an indication on whether the query aims to identify a person or obtain more data on a known person.

RemovedArticle 33 – paragraph 3 – subparagraph 1: The justifications referred to in paragraph 2 shall only be used for fundamental rights and data protection monitoring, including checking the admissibility of a query and the lawfulness of data processing, and for ensuring data security and integrity.

RemovedArticle 33 – paragraph 3 – subparagraph 2: Those justifications shall be protected by appropriate measures against unauthorised access and erased three years after their creation. If, however, they are required for monitoring procedures that have already begun, they shall be erased once the monitoring procedures no longer require the justification.

RemovedArticle 33 – paragraph 4: 4. For the purposes of fundamental rights and data protection monitoring, including checking the admissibility of a query and the lawfulness of data processing, the data controllers shall have unrestricted access to those justifications for self-monitoring as referred to in Article 56.

RemovedArticle 34 – paragraph 1: 1. The universal message format (UMF) standard established under Article 38 of Regulation (EU)2019/818 shall be used in the development of the router referred to in Article 35 of this Regulation and EPRIS, to the extent it is applicable.

RemovedArticle 35 – paragraph 1: 1. A router is established for the purposes of facilitating the establishment of connections between Member States, and between Member States and Europol, for querying with, retrieving and scoring biometric data and for retrieving alphanumeric data in accordance with this Regulation.

RemovedArticle 35 – paragraph 2 – point a: (a) a central infrastructure, including a search tool enabling the simultaneous querying of Member States’ databases referred to in Articles 5, 12 and 21 and Europol data;

RemovedArticle 35 – paragraph 2 – point b: (b) a secure communication channel between the central infrastructure, Member States’ competent law enforcement authorities authorised to use the router in accordance with Article 36, and Europol;

RemovedArticle 36 – paragraph 1: The use of the router shall be reserved to the Member States’ competent law enforcement authorities that are authorised to access and exchange DNA profiles, dactyloscopic data and facial images in accordance with this Regulation, and Europol in accordance with this Regulation and Regulation (EU) 2016/794 where they have a demonstrable need for such access. Member States and Europol shall ensure that their authorised staff have completed relevant training, including on data protection, confidentiality, detection of biases, as well as the accurate review of matches under the relevant data category.

RemovedArticle 37 – paragraph 1: 1. The competent law enforcement authorities authorised to access the router pursuant to Article 36 shall request a query by submitting biometric data to the router. The router shall dispatch the request for a query to the databases of the requested Member States and Europol data simultaneously with the data submitted by the user in accordance with his or her access rights.

RemovedArticle 37 – paragraph 2: 2. Upon receipt of a request for a query from the router, each requested Member State and Europol shall launch a query of their databases in an automated manner and without delay.

RemovedArticle 37 – paragraph 3: 3. Any candidates resulting from queries referred to in paragraph 2 shall be sent back in an automated manner to the router. The requesting Member State shall be notified in an automated manner where there is no match.

RemovedArticle 37 – paragraph 4: 4. The router shall rank the replies in accordance with the score of the correspondence between the biometric data used for querying and the biometric data supplied by the requested Member States’ databases and Europol data.

RemovedArticle 37 – paragraph 5: 5. The router shall return the list of matching biometric data and their scores to the router user. That list shall be limited to the maximum number of candidates set out in the implementing act adopted pursuant to paragraph 6.

RemovedArticle 37 – paragraph 6: 6. The Commission, after consulting the European Data Protection Board in accordance with Article 42(2) of Regulation 2018/1725, shall adopt implementing acts to specify the technical procedure for the router to query Member States’ databases and Europol data, the format of the router replies, the technical rules for scoring the correspondence between biometric data and the relevant thresholds, as well as the maximum number of candidates that can be returned per search, with a view to ensuring accuracy, minimising the risk of misidentification and preventing discrimination. Those implementing acts shall be adopted in accordance with the procedure referred to in Article 75(2).

RemovedArticle 38 – paragraph 1: The requested Member State shall check the quality of the transmitted data by means of an automated procedure.

RemovedArticle 38 – paragraph 2: The requested Member State shall, without delay, inform the requesting Member State via the router where the data are unsuitable for an automated comparison.