Changes from plenary report to adopted text

RemovedArticle 39 – paragraph 1: 1. Where designated authorities are authorised to use the router pursuant to Article 36, they may launch a query to Member States’ databases and Europol data simultaneously with a query to the Common Identity Repository, provided that the relevant conditions under Union law are fulfilled and that the query is launched in accordance with their access rights. For this purpose, the router shall query the Common Identity Repository via the European Search Portal.

RemovedArticle 39 – paragraph 2 – subparagraph 2: deleted

RemovedArticle 39 – paragraph 2 – subparagraph 3: Simultaneous queries of the Member States’ databases and Europol data and the Common Identity Repository may only be launched where there are reasonable grounds to believe that data on a suspect, perpetrator or victim of a terrorist offence or other serious criminal offences as defined respectively in Article 4, points 21 and 22, of Regulation (EU) 2019/817 and Article 4, points 21 and 22, of Regulation (EU) 2019/818 are stored in the Common Identity Repository.

RemovedArticle 40 – title: Keeping of logs of all data processing operations in the router

RemovedArticle 40 – paragraph 2 – subparagraph 1: Each Member State shall keep logs of queries that the staff of its competent law enforcement authorities duly authorised to use the router make as well as logs of queries requested by other Member States.

RemovedArticle 40 – paragraph 3 – subparagraph 2: Those logs shall be protected by appropriate measures against unauthorised access and erased three years after their creation. If, however, they are required for monitoring procedures that have already begun, they shall be erased once the monitoring procedures no longer require the logs.

RemovedArticle 41 – paragraph 1: 1. Where it is technically impossible to use the router to query one or several national databases or Europol data because of a failure of the router, the competent law enforcement authorities referred to in Article 36, and Europol shall be notified in an automated manner by eu-LISA. eu-LISA shall take measures to address the technical impossibility to use the router without delay.

RemovedArticle 41 – paragraph 2: 2. Where it is technically impossible to use the router to query one or several national databases because of a failure of the national infrastructure in a Member State, that Member State shall notify the other Member States, Europol, eu-LISA and the Commission in an automated manner. The Member State concerned shall take appropriate measures to address the technical impossibility to use the router without delay.

RemovedArticle 41 – paragraph 3: 3. Where it is technically impossible to use the router to query Europol data because of a failure of the infrastructure of Europol, Europol shall notify the Member States, eu-LISA and the Commission in an automated manner. Europol shall take appropriate measures to address the technical impossibility to use the router without delay.

RemovedArticle 42 – paragraph 1: 1. For the automated searching of national police records indexes referred to in Article 26, Member States and Europol shall use the European Police Records Index System (EPRIS).

RemovedArticle 43 – paragraph 1 – introductory part: 1. For the purposes of searching national police records indexes via EPRIS, at least two of the following sets of data shall be used:

RemovedArticle 43 – paragraph 2 – point a: (a) alias(es) and previously used name or names;

RemovedArticle 44 – paragraph 1 – subparagraph 2: EPRIS shall dispatch the request for a query to the Member States’ national police records indexes with the data submitted by the requesting Member State or Europol and in accordance with this Regulation.

RemovedArticle 44 – paragraph 3: 3. Any matches resulting from the query in each requested Member State’s police records indexes shall be sent back in an automated manner to EPRIS.

RemovedArticle 44 – paragraph 4: 4. The list of matches shall be returned to the requesting Member State and Europol by EPRIS. The list of matches shall indicate the quality of the match as well as the Member State or States whose database or databases contain data that resulted in the match or matchees.

RemovedArticle 44 – paragraph 6 – subparagraph 2: Upon confirmation, the requested Member State(s) shall share the data referred to in Article 43 where available. This exchange of data shall take place via SIENA.

RemovedArticle 45 – paragraph 2: 2. Each participating Member State shall keep logs of the requests for queries that the staff of its competent law enforcement authorities duly authorised to use EPRIS make. Europol shall keep logs of requests for queries that its duly authorised staff make.

RemovedArticle 45 – paragraph 3 – subparagraph 2: Those logs shall be protected by appropriate measures against unauthorised access and erased three years after their creation.

RemovedArticle 46 – paragraph 1: 1. Where it is technically impossible to use EPRIS to query one or several national police records indexes because of a failure of the infrastructure of Europol, Member States shall be notified in an automated manner by Europol. Europol shall take measures to address the technical impossibility to use EPRIS in a timely manner.

RemovedArticle 46 – paragraph 2: 2. Where it is technically impossible to use EPRIS to query one or several national databases because of a failure of the national infrastructure in a Member State, that Member State shall notify Europol and the Commission in an automated manner. Member States shall take measures to address the technical impossibility to use EPRIS in a timely manner.

RemovedArticle 47 – paragraph 1 – introductory part: Where the procedures referred to in Article 6, 7, 13 or 22 show a match between the data used for the search or comparison and data held in the database of the requested Member State(s), and upon manual confirmation of this match by qualified staff of the requesting Member State, the requested Member State shall return a set of core data via the router within 24 hours. Where a judicial authorisation is required under national law, the set of core data shall be returned within 72 hours.

RemovedArticle 47 – paragraph 1 – point a: deleted

RemovedArticle 47 – paragraph 1 – point b: deleted

RemovedArticle 47 – paragraph 1 – point c: deleted

RemovedArticle 47 – paragraph 1 – point d: deleted

RemovedArticle 47 – paragraph 1 – point e: deleted

RemovedArticle 47 – paragraph 1 – point f: deleted

RemovedArticle 47 – paragraph 1 a (new): Where the confirmed match concerns identified data of a person, the set of core data referred to in paragraph 1 shall, to the extent available, contain the following data: / (a) first name or names; / (b) family name or names; / (c) alias or aliases and previously used name or names; / (d) date of birth; / (e) nationality or nationalities; / (f) place and country of birth; / (g) gender; / (h) the date on which and the place where the biometric data were acquired; / (i) the criminal offence for which the biometric data were acquired; / (j) the criminal case number; / (k) the competent law enforcement authority responsible for the criminal case.

RemovedArticle 47 – paragraph 1 b (new): Where the confirmed match concerns unidentified data or traces, the set of core data referred to in paragraph 1 shall, to the extent available, contain the following data: / (a) the date on which and the place where the biometric data were acquired; / (b) the criminal offence for which the biometric data were acquired; / (c) the criminal case number; / (d) the competent law enforcement authority responsible for the criminal case.

RemovedArticle 47 – paragraph 1 c (new): The release of core data by the requested Member State shall be subject to the decision of a human.

RemovedArticle 47 – paragraph 1 d (new): The requested Member State or States shall only refuse to share the core data where: / (a) the judicial authorisation required under the national law of the requested Member State was refused; / (b) there are objective reasons to believe sharing core data would disproportionately infringe the fundamental rights of the data subject; or / (c) there are objective reasons to believe sharing core data would jeopardise the success of an ongoing investigation of a criminal offence. / The justification for such refusals shall be provided promptly to the requesting Member State and in any event within the time limits provided in paragraph 1.

RemovedArticle 48: deleted / (deleted) / (deleted)

RemovedArticle 49 – paragraph 1: 1. Without prejudice to any restrictions indicated by the provider of the information to Europol in accordance with Article 19(2) of Regulation (EU) 2016/794, Member States shall, in accordance with Regulation (EU) 2016/794, have access to, and be able to search via the router, biometric data which has been provided to Europol by third countries for the purposes of Article 18(2), points (a), (b) and (c), of Regulation (EU) 2016/794.

RemovedArticle 49 – paragraph 2: 2. Where the search referred to in paragraph 1 results in a match between the data used for the search and third-country-sourced data held by Europol, the follow-up shall take place in accordance with Regulation (EU) 2016/794.

RemovedArticle 50 – paragraph 1: 1. Where necessary to achieve the objectives set out in Article 3 of Regulation (EU) 2016/794, Europol shall, in accordance with Regulation (EU) 2016/794, have access to data which are stored by Member States in their national databases in accordance with this Regulation.

RemovedArticle 50 – paragraph 4: 4. Europol queries performed with biographical data referred to in Article 25 as a search criterion shall be carried out using EPRIS.

RemovedArticle 50 – paragraph 5: 5. Europol shall carry out the searches in accordance with paragraph 1 of this Article only for the purpose of Article 18(2), point (a), of Regulation (EU) 2016/794, when carrying out its tasks referred to in Regulation (EU) 2016/794.

RemovedArticle 50 – paragraph 6 – introductory part: 6. Where the procedures referred to in Article 6, 7, 13 or 22 show a match between the data used for the search or comparison and data held in the national database of the requested Member State(s), and upon human review of that match by qualified staff of Europol in accordance with this Regulation and the transmission of the name of the third country which provided the data, the requested Member State shall decide whether to return a set of core data via the router within 24 hours. Where a judicial authorisation is required under national law, the core data shall be returned within 72 hours. That set of core data, if available, shall contain the following data:

RemovedArticle 50 – paragraph 7: 7. Europol's use of information obtained from a search made in accordance with paragraphs 1 and 5, and from the exchange of core data in accordance with paragraph 6, shall be subject to the consent of the Member State in whose database the match occurred. If the Member State allows the use of such information, its handling by Europol shall be governed by Regulation (EU) 2016/794.

RemovedArticle 51 – title: Purpose of the data processing

RemovedArticle 51 – paragraph 1: 1. Processing of personal data received by the requesting Member State or Europol shall be permitted solely for the purposes for which the data have been supplied by the requested Member State in accordance with this Regulation. Without prejudice to Directive (EU) 2016/680 or Regulation (EU) 2018/1725, as applicable, processing for other purposes shall be permitted solely with the prior authorisation of the requested Member State or Europol, as relevant.

RemovedArticle 51 – paragraph 2 – introductory part: 2. Processing of data supplied pursuant to Article 6, 7, 13, 18, 22 or 26 by the requesting Member State or Europol shall be permitted solely where necessary in order to:

RemovedArticle 51 – paragraph 2 – point a a (new): (aa) exchange a set of core data pursuant to Article 47;

RemovedArticle 51 – paragraph 2 – point b: (b) prepare and submit a police or judicial request for legal assistance if those data match;

RemovedArticle 51 – paragraph 2 – point c: (c) logging within the meaning of Articles 20, 40 and 45.

RemovedArticle 51 – paragraph 3: 3. The personal data received by the requesting Member State or Europol shall be deleted immediately following data comparison or automated replies to searches unless further processing by the requesting Member State is strictly necessary and proportionate for the purposes of the prevention, detection and investigation of criminal offences.

RemovedArticle 51 – paragraph 4: 4. Data supplied in accordance with Article 18 may be used by the requesting Member State solely where this is strictly necessary and proportionate to achieve the purposes of this Regulation. The data supplied shall be deleted immediately following automated replies to searches unless further processing is necessary for recording pursuant to Article 20. The requesting Member State shall use the data received in a reply solely for the procedure for which the search was made.

RemovedArticle 51 – paragraph 4 a (new): 4a. Prior to connecting their national databases to the router, EPRIS or Eucaris, Member States shall conduct a data protection impact assessment as referred to in Article 27 of Directive (EU) 2016/680 and consult the supervisory authority as referred to in Article 28 of that Directive. The supervisory authority may use any of its powers referred to in Article 47 of Directive (EU) 2016/680, in accordance with paragraph 5 of Article 28 of that Directive.

RemovedArticle 51 – paragraph 4 b (new): 4b. Member States shall ensure that data subjects are provided with information pursuant to Article 13 of Directive (EU) 2016/680 to allow them to exercise their rights.

RemovedArticle 51 – paragraph 4 c (new): 4c. The European Data Protection Board shall issue guidelines on the implementation of Directive (EU) 2016/680 concerning the criminal databases and cross-border exchanges of personal data, in particular concerning accuracy, strict necessity and how to ensure respect for the right to data protection.

RemovedArticle 52 – paragraph 1: 1. Member States and Europol shall ensure the accuracy and current relevance of personal data which are processed pursuant to this Regulation. Should a requested Member State or Europol become aware that data that are incorrect or no longer up to date or data which should not have been supplied have been supplied, this shall be notified without delay to any requesting Member State. All requesting Member States concerned shall be obliged to correct or delete the data accordingly without delay. Moreover, personal data supplied shall be corrected if they are found to be incorrect. If the requesting Member State or Europol has reason to believe that the supplied data are incorrect or should be deleted the requested Member State shall be informed without delay.

RemovedArticle 52 – paragraph 1 – subparagraph 1 a (new): Member States and Europol shall put in place appropriate measures for updating their databases, including as regards acquittals of persons whose personal data are in the databases.

RemovedArticle 52 – paragraph 2: 2. Where a data subject contested the accuracy of data in possession of a Member State or Europol, where the accuracy cannot be reliably established by the Member State concerned or Europol and where it is requested by the data subject, the data concerned shall be marked with a flag. Where such a flag exists, Member States or Europol may remove it only with the permission of the data subject or based on a decision of the competent court or national supervisory authority or the European Data Protection Supervisor, as relevant.

RemovedArticle 52 – paragraph 3 – subparagraph 1 – point b: (b) following the expiry of the maximum period for keeping data laid down under the national law of the requested Member State where the requested Member State or Europol informed the requesting Member State of that maximum period at the time of supplying the data;

RemovedArticle 52 – paragraph 3 – subparagraph 1 – point b a (new): (ba) following the expiry of the maximum period for keeping data laid down in Regulation (EU) 2016/794.

RemovedArticle 52 – paragraph 3 – subparagraph 2: Where there is reason to believe that the deletion of data would prejudice the interests of the data subject, the data shall be restricted instead of being deleted. Restricted data shall be processed solely for the purpose which prevented their deletion.

RemovedArticle 53 – paragraph 2 a (new): 2a. Member States shall be the processors for the processing of personal data via Eucaris.

RemovedArticle 54 – paragraph 1: 1. Europol, eu-LISA and Member States’ competent law enforcement authorities shall ensure the security of the processing of personal data that takes place pursuant to this Regulation. Europol, eu-LISA and Member States’ competent law enforcement authorities shall cooperate on security-related tasks.

RemovedArticle 54 – paragraph 2: 2. Without prejudice to Article 91 of Regulation (EU) 2018/1725 and Article 32 of Regulation (EU) 2016/794, eu-LISA and Europol shall take the necessary measures to ensure the security of the router and EPRIS respectively as well as their related communication infrastructure.

RemovedArticle 55 – paragraph 2: 2. Security incidents shall be managed in close cooperation between the Member States concerned or Europol and eu-LISA, as relevant, so as to ensure a quick, effective and proper response.