Changes from plenary report to adopted text

RemovedArticle 55 – paragraph 3 – subparagraph 2: Without prejudice to Article 34 of Regulation (EU) 2016/794 and Article 92 of Regulation (EU) 2018/1725, Europol shall notify CERT-EU of significant cyber threats, significant vulnerabilities and significant incidents without undue delay and in any event no later than 24 hours after becoming aware of them. Actionable and appropriate technical details of cyber threats, vulnerabilities and incidents that enable proactive detection, incident response or mitigating measures shall be disclosed to CERT-EU without undue delay.

RemovedArticle 55 – paragraph 3 – subparagraph 3: In the event of a security incident in relation to the central infrastructure of the router and without prejudice to Article 92 of Regulation (EU) 2018/1725, eu-LISA shall notify CERT-EU of significant cyber threats, significant vulnerabilities and significant incidents without undue delay and in any event no later than 24 hours after becoming aware of them. Actionable and appropriate technical details of cyber threats, vulnerabilities and incidents that enable proactive detection, incident response or mitigating measures shall be disclosed to CERT-EU without undue delay.

RemovedArticle 55 – paragraph 5 a (new): 5a. This Article is without prejudice to the reporting obligations pursuant to Articles 92 and 93 of Regulation (EU) 2018/1725 and Articles 30 and 31 of Directive (EU) 2016/680.

RemovedArticle 56 – paragraph 1: 1. Member States shall ensure that each authority entitled to use Prüm II takes the measures necessary to monitor its compliance with this Regulation and cooperates, where necessary, with the supervisory authority. Europol shall take the measures necessary to monitor its compliance with this Regulation and shall cooperate, where necessary, with the European Data Protection Supervisor.

RemovedArticle 56 – paragraph 2: 2. The data controllers shall implement the necessary technical and organisational measures to ensure effective supervision and monitor the compliance of data processing pursuant to this Regulation, including through frequent verification of the logs referred to in Articles 20, 40 and 45 concerning the admissibility of queries, the lawfulness of data processing and data security and integrity, and cooperate, where necessary and as appropriate, with the supervisory authorities and with the European Data Protection Supervisor.

RemovedArticle 56 – paragraph 2 a (new): 2a. The data controllers and Europol shall be provided with adequate human, financial and technical resources to fulfil their tasks pursuant to this Article.

RemovedArticle 58 – paragraph 1: If any failure of a Member State to comply with its obligations under this Regulation causes damage to the router or EPRIS, that Member State shall be liable for such damage, unless and in so far as eu-LISA, Europol or another Member State bound by this Regulation failed to take reasonable measures to prevent the damage from occurring or to minimise the impact.

RemovedArticle 59 – paragraph 2: 2. Without prejudice to Article 43(3) of Regulation (EU) 2016/794, eu-LISA and Europol shall supply information requested by the European Data Protection Supervisor to it, grant the European Data Protection Supervisor access to all the documents it requests and to their logs referred to in Articles 40 and 45 and allow the European Data Protection Supervisor access to all their premises at any time. This paragraph is without prejudice to the powers of the European Data Protection Supervisor pursuant to Article 58 of Regulation (EU) 2018/1725.

RemovedArticle 59 – paragraph 2 a (new): 2a. The European Data Protection Supervisor shall be provided with the staff and financial resources necessary to carry out the audits referred to in paragraph 1.

RemovedArticle 60 – paragraph 1: 1. The supervisory authorities and the European Data Protection Supervisor shall, each acting within the scope of their respective competences, cooperate actively within the framework of their respective responsibilities to ensure the coordinated supervision of the application of this Regulation, in particular if the European Data Protection Supervisor or a supervisory authority finds major discrepancies between practices of Member States or finds potentially unlawful transfers using the Prüm II communication channels.

RemovedArticle 60 – paragraph 3: 3. The European Data Protection Supervisor and the European Data Protection Board shall send a joint report of its activities under this Article to the European Parliament, to the Council, to the Commission, to Europol and to eu-LISA by 2 years after entry into operation of the router and EPRIS and every two years thereafter. That report shall include a chapter on each Member State prepared by the supervisory authority of the Member State concerned.

RemovedArticle 61 – title: Transfer of personal data to third countries and international organisations

RemovedArticle 61 – paragraph 1: A requesting Member State shall transfer personal data it has obtained in accordance with this Regulation to a third country or an international organisation only in accordance with Chapter V of Directive (EU) 2016/680 and where the requested Member State has granted its authorisation prior to the transfer.

RemovedArticle 61 – paragraph 1 a (new): Europol shall transfer personal any data it has obtained in accordance with this Regulation to a third country or an international organisation only where the conditions laid down in Article 25 of Regulation (EU) 2016/794 are fulfilled and the requested Member State has granted its authorisation prior to the transfer.

RemovedArticle 61 a (new): Article 61 a / Relation to other legal acts on data protection / Any processing of personal data for the purposes of this Regulation shall be carried out in compliance with this Chapter and with Directive (EU) 2016/680, Regulation (EU) 2018/1725 or Regulation (EU) 2016/794, as applicable.

RemovedArticle 62 – paragraph 1 – point g: (g) the management of, and arrangements for, access by the duly authorised staff of the competent national law enforcement authorities to the router in accordance with this Regulation and the creation and regular update of a list of those staff and their profiles;

RemovedArticle 62 – paragraph 1 – point h: (h) the management of, and arrangements for, access by the duly authorised staff of the competent national law enforcement authorities to EPRIS in accordance with this Regulation and the creation and regular update of a list of those staff and their profiles;

RemovedArticle 62 – paragraph 1 – point i: (i) the management of, and arrangements for, access by the duly authorised staff of the competent national law enforcement authorities to Eucaris in accordance with this Regulation and the creation and regular update of a list of those staff and their profiles;

RemovedArticle 62 – paragraph 1 – point j: (j) the human confirmation by qualified staff of a match as referred to in Article 6(3), Article 7(3), Article 13(2) and Article 22(2);

RemovedArticle 62 – paragraph 1 – point m: (m) correcting, updating or deleting any data received from a requested Member State within 24 hours following the notification from the requested Member State that the personal data submitted was incorrect, is no longer up-to-date or was unlawfully transmitted.

RemovedArticle 62 – paragraph 2: 2. Each Member State shall be responsible for connecting their competent national law enforcement authorities to the router, EPRIS and Eucaris.

RemovedArticle 63 – paragraph 3 a (new): 3a. Without prejudice to Article 26(6c) of Regulation (EU) 2016/794 and Europol’s searches pursuant to Article 50(4) of this Regulation, Europol shall not have access to any of the personal data processed through EPRIS.

RemovedArticle 65 – paragraph 1 – subparagraph 3: The router shall be developed and managed in such a way as to ensure fast, efficient and controlled access, full and uninterrupted availability of the router, and a response time in line with the operational needs of the competent law enforcement authorities of the Member States and Europol.

RemovedArticle 65 – paragraph 1 – subparagraph 2 a (new): eu-LISA shall make publicly available information on technology supplied by private parties, including the supplier, for the purposes of its tasks referred to in paragraph 1.

RemovedRegulation (EU) 2018/1726

RemovedArticle 67 – paragraph 1 – point 2 a (new), Article 19 – paragraph 1 – point ee a (new): (2a) in Article 19(1), the following point is added after point (ee): / ‘(eea) adopt the reports on the state of play of the development of the router referred to in Article 35 of Regulation (EU) ../.. of the European Parliament and of the Council [2021/0410(COD)] pursuant to Article 78(2) of that Regulation;’

RemovedRegulation (EU) 2018/1726

RemovedArticle 67 – paragraph 1 – point 2 b (new), Article 19 – paragraph 1 – point ff: (2b) in Article 19(1), point (ff) is replaced by the following: / ‘(ff) adopt the reports on the technical functioning of SIS II pursuant to Article 50(4) of Regulation (EC) No 1987/2006 and Article 66(4) of Decision 2007/533/JHA respectively, of the VIS pursuant to Article 50(3) of Regulation (EC) No 767/2008 and Article 17(3) of Decision 2008/633/JHA, of the EES pursuant to Article 72(4) of Regulation (EU) 2017/2226, of ETIAS pursuant to Article 92(4) of Regulation (EU) 2018/1240 and of the router referred to in Article 35 of Regulation (EU) ../.. [2021/0410(COD)] pursuant to Article 78(5) of that Regulation (EU) ../...;

RemovedRegulation (EU) 2018/1726

RemovedArticle 67 – paragraph 1 – point 2 c (new), Article 19 – paragraph 1 – point hh: (2c) in Article 19(1), point (hh) is replaced by the following: / ‘(hh) adopt formal comments on the European Data Protection Supervisor’s reports on its audits carried out pursuant to Article 56(2) of Regulation (EU) 2018/1861, Article 42(2) of Regulation (EC) No 767/2008, Article 31(2) of Regulation (EU) No 603/2013, Article 56(2) of Regulation (EU) 2017/2226, Article 67 of Regulation (EU) 2018/1240, Article 29(2) of Regulation (EU) 2019/816, Article 52 of Regulations (EU) 2019/817 and (EU) 2019/818 and Article 59(1) of Regulation (EU) ../.. [2021/0410(COD)] and ensure appropriate follow-up of those audits;”

RemovedRegulation (EU) 2019/818

RemovedArticle 69 – paragraph 1 – point 2, Article 39 – paragraph 1: 1. A central repository for reporting and statistics (CRRS) is established for the purposes of supporting the objectives of the SIS, Eurodac, ECRIS-TCN, in accordance with the respective legal instruments governing those systems, and to provide cross-system statistical data and analytical reporting for policy, operational and data quality purposes. The CRRS shall also support the objectives of Regulation (EU) … /… of the European Parliament and of the Council* [2021/0410(COD)]..”

RemovedRegulation (EU) 2019/818

RemovedArticle 69 – paragraph 1 – point 2, Article 39 – paragraph 2: “2. eu-LISA shall establish, implement and host in its technical sites the CRRS containing the data and statistics referred to in Article 74 of Regulation (EU) 2018/1862 and Article 32 of Regulation (EU) 2019/816 logically separated by EU information system. eu-LISA shall also collect the data and statistics from the router referred to in Article 70(1) of Regulation (EU) …/… * [this Regulation ]. Access to the CRRS shall be granted by means of controlled, secured access and specific user profiles, solely for the purpose of reporting and statistics, to the authorities referred to in Article 74 of Regulation (EU) 2018/1862, Article 32 of Regulation (EU) 2019/816 and Article 64(1) of Regulation (EU) …/… * [this Regulation ].”

RemovedArticle 70 – paragraph 1 – subparagraph 1 – introductory part: The duly authorised staff of the competent law enforcement authorities of Member States, the Commission, Europol and eu-LISA shall have access to the following data related to the router, as relevant, solely for the purposes of reporting and statistics:

RemovedArticle 70 – paragraph 1 – subparagraph 1 – point a: (a) number of queries per Member State and by Europol, per category of data;

RemovedArticle 70 – paragraph 1 – subparagraph 1 – point b: deleted

RemovedArticle 70 – paragraph 1 – subparagraph 1 – point f: (f) number of confirmed matches where there were exchanges of core data;

RemovedArticle 70 – paragraph 1 – subparagraph 1 – point f a (new): (f a) number of confirmed matches where there were no exchanges of core data;

RemovedArticle 70 – paragraph 1 – subparagraph 1 – point f b (new): (f b) number of unconfirmed matches; and

RemovedArticle 70 – paragraph 1 – subparagraph 2: The data shall be aggregated. It shall not be possible to identify individuals from the data.

RemovedArticle 70 – paragraph 2 – subparagraph 1 – introductory part: The duly authorised staff of the competent law enforcement authorities of Member States, Europol and the Commission shall have access to consult the following data related to Eucaris, solely for the purposes of reporting and statistics:

RemovedArticle 70 – paragraph 2 – subparagraph 2: The data shall be aggregated. It shall not be possible to identify individuals from the data

RemovedArticle 70 – paragraph 3 – subparagraph 1 – introductory part: The duly authorised staff of the competent law enforcement authorities of Member States, the Commission and Europol shall have access to consult the following data related to EPRIS, solely for the purposes of reporting and statistics:

RemovedArticle 70 – paragraph 4 – subparagraph 1: eu-LISA shall store the data referred to in paragraph 1 of this Article in the central repository for reporting and statistics established pursuant to Article 39 of Regulation (EU) 2019/818.

RemovedArticle 70 – paragraph 4 – subparagraph 2: The data shall allow the competent law enforcement authorities of the Member States, Europol, eu-LISA and the Commission to obtain customisable reports and statistics to enhance the efficiency of law enforcement cooperation.

RemovedArticle 72 – paragraph 1: 1. Member States shall notify eu-LISA of the competent law enforcement authorities referred to in Article 36, which may use or have access to the router.

RemovedArticle 72 – paragraph 2 a (new): 2a. Each Member State shall notify the other Member States, the Commission, eu-LISA and Europol of the content of its national DNA databases to which Articles 5, 6 and 7 apply.

RemovedArticle 72 – paragraph 2 b (new): 2b. Each Member States shall inform the other Member States, the Commission, eu-LISA and Europol of the content of its national dactyloscopic databases to which Articles 12 and 13 apply.

RemovedArticle 72 – paragraph 2 c (new): 2c. Each Member States shall inform the other Member States, the Commission, eu-LISA and Europol of the content of its national facial images databases to which Articles 21 and 22 apply.

RemovedArticle 72 – paragraph 2 d (new): 2d. Member States participating in automated exchanges of police records pursuant to Articles 25 and 26 shall notify the other Member States, the Commission and Europol of the content of its national police records indexes, the national databases used for the establishment of those indexes and the conditions for automated searches.

RemovedArticle 72 – paragraph 3: 3. Member States shall notify the Commission, Europol and eu-LISA of their national contact point designated pursuant to Article 29. The Commission shall compile a list of the national contact points of which it has been notified and make it available to all Member States.

RemovedArticle 73 – paragraph 1 – subparagraph 1 – introductory part: 1. The Commission shall determine the date from which the Member States and Europol may start using the router by means of an implementing act once the following conditions have been met:

RemovedArticle 73 – paragraph 1 – subparagraph 1 – point a: (a) the measures referred to in Article 5(2c), Article 10(3), Article 15(4), Article 19(3), Article 23a(3), Article 30 and Article 37(6) have been adopted;

RemovedArticle 73 – paragraph 1 – subparagraph 1 – point b: (b) eu-LISA has declared the successful completion of a comprehensive test of the router, which it has conducted in cooperation with the Member States’ competent law enforcement authorities and Europol.

RemovedArticle 73 – paragraph 1 – subparagraph 2: In that implementing act the Commission shall also determine the date from which the Member States and Europol shall start using the router. That date shall be one year after the date determined in accordance with the first subparagraph.

RemovedArticle 73 – paragraph 1 – subparagraph 3: The Commission may postpone the date from which the Member States and the Union agencies are to start using the router by one year at most where an assessment of the implementation of the router has shown that such a postponement is necessary.

RemovedArticle 73 – paragraph 2 – introductory part: 2. The Commission shall determine the date from which the Member States and Europol are to start using EPRIS by means of an implementing act once the following conditions have been met:

RemovedArticle 73 – paragraph 2 – point b: (b) Europol has declared the successful completion of a comprehensive test of EPRIS, which it has conducted in cooperation with the Member States’ competent law enforcement authorities.

RemovedArticle 73 – paragraph 3 – point b: (b) Europol has declared the successful completion of a comprehensive test of the connection, which it has conducted in cooperation with the Member States competent law enforcement authorities’ and eu-LISA.