Changes from report parliamentary committee draft to plenary report

RemovedAmendment linked to Article 1(1)(c) of proposal (non-codified) which provides that Eurodac will serve not only the purpose of implementation of the Dublin Regulation, but also law enforcement. However, the current ex-ante control by an independent verifying authority of every access by Europol´s operating unit to Eurodac makes it extremely difficult to implement due to legal, data protection and technical reasons. The deletion of this requirement is counterbalanced by a new paragraph 3b in Article 22 reinforcing the obligation to comply with data protection rules and with the control mechanisms provided for therein.

AddedArticle 18 – paragraph 2: 2. The Central System shall, as soon as possible and no later than after 72 hours, inform all Member States of origin of the erasure of data in accordance with paragraph 1 by another Member State of origin having produced a hit with data which they transmitted relating to persons referred to in Articles 10(1), 12a, 13(1) or 14(1).

RemovedArticle 22 – paragraph 1 – point b: (b) the comparison is necessary in a specific case and is carried out only for the purpose of identifying whether the information in the Central System matches the information processed by Europol.

AddedArticle 19 – paragraph 1: 1. For the purposes laid down in Article 1(1)(a), the Member State of origin which granted international protection to an applicant for international protection whose data were previously recorded in the Central System pursuant to Article 12 shall mark the relevant data in conformity with the requirements for electronic communication with the Central System established by eu-LISA . That mark shall be stored in the Central System in accordance with Article 17(1) for the purpose of transmission under Articles 15 and 16. The Central System shall, as soon as possible and no later than 72 hours, inform all Member States of origin of the marking of data by another Member State of origin having produced a hit with data which they transmitted relating to persons referred to in Article 10(1), 13(1) or 14(1). Those Member States of origin shall also mark the corresponding data sets.

RemovedAmendment linked to Article 1(1)(c) of proposal (non-codified) which provides that Eurodac will serve not only the purpose of implementation of the Dublin Regulation, but also law enforcement. However, the current ex-ante control by an independent verifying authority of every access by Europol´s operating unit to Eurodac makes it extremely difficult to implement due to legal, data protection and technical reasons. The deletion of this requirement is counterbalanced by a new paragraph 3b in Article 22 reinforcing the obligation to comply with data protection rules and with the control mechanisms provided for therein.

AddedArticle 19 – paragraph 2 – subparagraph 1: The data of beneficiaries of international protection stored in the Central System and marked pursuant to paragraph 1 of this Article shall be made available for comparison for the purposes laid down in Article 1(1)(c) until such data are automatically erased from the Central System in accordance with Article 17(4).

RemovedArticle 22 – paragraph 1 – point c: deleted

AddedArticle 20 – title: Procedure for comparison of biometric or alphanumeric data with Eurodac data

RemovedAmendment linked to Article1 (1)(c) of proposal (non-codified) which provides that Eurodac will serve not only the purpose of implementation of the Dublin Regulation, but also law enforcement.

AddedArticle 20 – paragraph 1: 1. For the purposes laid down in Article 1(1)(c), the designated authorities referred to in Articles 6(1) may submit a reasoned electronic request as provided for in Article 21(1) together with the reference number used by them, to the verifying authority for the transmission for comparison of biometric or alphanumeric data to the Central System, via the National Access Point. Upon receipt of such a request, the verifying authority shall verify whether all the conditions for requesting a comparison referred to in Articles 21 or 22, as appropriate, are fulfilled.

RemovedArticle 22 – paragraph 2: deleted

AddedArticle 20 – paragraph 2: 2. Where all the conditions for requesting a comparison referred to in Articles 21 or 22 are fulfilled, the verifying authority shall transmit the request for comparison to the National Access Point which will process it to the Central System in accordance with Articles 15 and 16 for the purpose of comparison with the biometric or alphanumeric data transmitted to the Central System pursuant to Articles 10(1), 12a, 13 (1) and 14(1).

RemovedUnder the proposal, national law enforcement authorities and Europol cannot request comparison with specific alphanumeric data, which is highly detrimental to investigations, especially in the counter-terrorism field, trying to establish the places and dates of entry in the EU of suspects for which a used identity is known, but no fingerprint is available. In this context, and given that Article 1 (1)(c) of the proposal, extends its scope of Eurodac to law enforcement purposes, it would be essential for national law enforcement authorities and Europol to have access to all data contained in Eurodac in order to properly carry out their tasks.

AddedArticle 20 – paragraph 2 a (new): 2a. For the purposes laid down in Article 1(1)(c), Europol's designated authority may submit a reasoned electronic request as provided for in Article 22(1) for the comparison of biometric data or alphanumeric data to the Europol access point referred to in Article 8(2). Upon receipt of such a request, the Europol access point shall verify whether all the conditions for requesting a comparison referred to in Article 22 are fulfilled. Where all the conditions referred to in Article 22 are fulfilled, the duly authorised staff of the Europol access point shall process the request. The Eurodac data requested shall be transmitted to the operating unit referred to in Article 8(1) in such a way as to ensure the security of the data.

RemovedArticle 22 – paragraph 3: 3. Processing of information obtained by Europol from comparison with Eurodac data shall be subject to the authorisation of the Member State of origin.

AddedArticle 20 – paragraph 4: 4. In exceptional cases of urgency where there is a need to prevent an imminent danger associated with a terrorist offence or other serious criminal offence, the verifying authority may transmit the biometric or alphanumeric data to the National Access Point for comparison immediately upon receipt of a request by a designated authority and only verify ex-post whether all the conditions for requesting a comparison referred to in Article 21 or Article 22 are fulfilled, including whether an exceptional case of urgency actually existed. The ex-post verification shall take place without undue delay after the processing of the request.

RemovedArticle 1(1)(c) of the Commission proposal, extends its scope beyond the mere implementation of the Dublin Regulation to law enforcement purposes. Europol’s dependency on a MS’s technical infrastructure in order to access Eurodac data creates unnecessary risk and once used, would be cumbersome and slow. The MS’s system connecting Europol to Eurodac would need to meet Europol’s stringent data security requirements. At present, the connection to Eurodac via the Dutch National Access point could not be successfully established due to technical and data security issues encountered.

AddedArticle 21 – paragraph 1 – introductory part: 1. For the purposes laid down in Article 1(1)(c), designated authorities may submit a reasoned electronic request for the comparison of biometric or alphanumeric data with the data stored in the Central System within the scope of their powers only if prior check has been conducted in:

AddedArticle 21 – paragraph 1 – indent 2: - the automated fingerprinting identification systems of all other Member States under Decision 2008/615/JHA ; and

AddedArticle 21 – paragraph 2: 2. Requests for comparison with Eurodac data shall be limited to searching with biometric or alphanumeric data.

AddedArticle 22 – paragraph 2: 2. Requests for comparison with Eurodac data shall be limited to comparisons of biometric or alphanumeric data

Article 22 – paragraph 3 a (new): 3a. Europol may request further information from the Member State concerned in accordance with Regulation (EU) 2016/794.

Change 16

RemovedAmendment linked to Article1(1)(c) of proposal (non-codified) which provides that Eurodac will serve not only the purpose of implementation of the Dublin Regulation, but also law enforcement purposes. The wording is taken from Article 41(4) SIS Decision for alignment purposes.

Article 22 – paragraph 3 b (new): 3b. The processing of personal data as a result of the access referred to in paragraph 1 shall be carried out in compliance with the data protection safeguards provided for in Regulation (EU) 2016/794. Europol shall keep records of all searches and access to the Central System and shall make that documentation available, upon request, to the Data Protection Officer appointed pursuant to Regulation (EU) 2016/794 and to the European Data Protection Supervisor for the purpose of verifying the lawfulness of the data processing.

Change 17

RemovedAmendment linked to Article1(1)(c) of proposal (non-codified) which provides that Eurodac will serve not only the purpose of implementation of the Dublin Regulation, but also law enforcement purposes. Europol should have simplified and direct access to EURODAC data and avoid unnecessary procedures that would just slow their capability to undergo its tasks. Paragraph 3b stemming from Article 18(4) of the Europol Regulation, is inserted to reinforce data protection requirements and to counterbalance the removal of the requirement of a double layer control system (priori authorisation by verifying authority)

AddedArticle 22 – paragraph 3 c (new): 3 c. Personal data obtained as a result of a search in the Central System shall not be transferred or made available to any third country, international organisation or private entity established in or outside the Union unless such a transfer is strictly necessary and proportionate in cases falling within Europol's mandate. Any such transfer shall be carried out in accordance with Chapter V of Regulation (EU) 2016/794 and subject to the consent of the Member State of origin.

RemovedArticle 22 – paragraph 3 c (new): 3 c. The Executive Director of Europol shall duly authorise a limited number of Europol officials to have access to the Central System if it is necessary for the performance of their tasks.

AddedArticle 24 – paragraph 1 – point b: (b) fingerprint data and the other data referred to in Article 12, Article 12b, Article 13(2) and Article 14(2) are lawfully transmitted to the Central System;

RemovedAmendment linked to Article1(1)(c) of proposal (non-codified) which provides that Eurodac will serve not only the purpose of implementation of the Dublin Regulation, but also law enforcement purposes. This wording is taken from Article 17(3) of the Europol Regulation and aims at limiting access to Eurodac data only to a restricted number of duly authorised Europol’s officials, in line with the need to know principle..

AddedArticle 25 – paragraph 2: 2. Member States shall transmit the data referred to in Article 12, Article 12b, Article 13(2) and Article 14(2) electronically. The data referred to in Article 12, Article 12b, Article 13(2) and Article 14(2) shall be automatically recorded in the Central System. As far as necessary for the efficient operation of the Central System, eu-LISA shall establish the technical requirements to ensure that data can be properly electronically transmitted from the Member States to the Central System and vice versa.

RemovedArticle 22 – paragraph 3 d (new): 3 d. Personal data obtained as a result of a search in the Central System shall not be transferred or made available to any third country, international organisation or private entity established in or outside the Union unless such a transfer is strictly necessary and proportionate in individual cases that falls within Europol's mandate. Any such transfer shall be carried out in accordance with Chapter V of Regulation (EU) 2016/794 and subject to the consent of the Member State of origin.

AddedArticle 25 – paragraph 3: 3. The reference number referred to in Articles 12(i), 12b(i), 13(2)(i), 14 (2)(i) and 20(1) shall make it possible to relate data unambiguously to one particular person and to the Member State which is transmitting the data. In addition, it shall make it possible to tell whether such data relate to a person referred to in Articles 10(1), 12a, 13(1) or 14(1).

RemovedAmendment linked to Article1(1)(c) of proposal (non-codified) which provides that Eurodac will serve not only the purpose of implementation of the Dublin Regulation, but also law enforcement purposes. This paragraph foresees the possibility for Europol to transmit data obtained from Eurodac to third Parties, under specific conditions and in accordance with the applicable rules on external relations of the Europol Regulation. In fact, one of Europol’s added values is to create synergies between law enforcement information originating within and outside the EU. Internal and external dimensions of the security of the Union are very much interlinked.

AddedArticle 25 – paragraph 4: 4. The reference number shall begin with the identification letter or letters by which the Member State transmitting the data is identified. The identification letter or letters shall be followed by the identification of the category of person or request. "1” refers to data relating to persons referred to in Article 10(1), "2" to persons referred to in Article 13(1), "3” to persons referred to in Article 14(1), "4" to requests referred to in Article 21, "5" to requests referred to in Article 22 ,"9" to requests referred to in Article 30, and “6” to requests referred to in Article 12a.

Change 18

ChangedArticle 26 – paragraph 4: 4. The result of the comparison of fingerprintfingerprints dataand facial image carried out pursuant to Article 15 shall be immediately checked,checked in the receiving Member State by a fingerprint and facial identification expert as defined in accordance with its national rules, specifically trained in the types of fingerprint comparisons provided for in this Regulation. Where the Central System returns a hit based on both fingerprint and facial image data, Member States may check and verify the result of the comparison ofcomparisons facialprovided imagefor datain ifthis needed.Regulation. For the purposes laid down in Article 1(1)(a)1(1)(a), (aa) and (b) of this Regulation, final identification shall be made by the Member State of origin in cooperation with the other Member States concerned.

Change 19

RemovedUpon the entry into force of this Regulation, comparisons should be based on fingerprints and facial image data.

AddedArticle 26 – paragraph 5 – subparagraph 1: The result of the comparison of facial image data carried out pursuant to Article 16 shall be immediately checked and verified in the receiving Member State, where necessary by a specially trained expert and in accordance with its national rules. For the purposes laid down in Article 1(1)(a), (aa) and (b) of this Regulation, final identification shall be made by the Member State of origin in cooperation with the other Member States concerned.

Change 20

ChangedArticle 2628 – paragraph 5 – subparagraph2: 1:2. The resultauthorities of theMember comparisonStates ofwhich, facialpursuant imageto dataparagraph carried1 outof pursuantthis Article, have access to Articledata 16recorded shallin bethe immediatelyCentral checkedSystem andshall verifiedbe inthose thedesignated receivingby each Member State,State wherefor necessarythe bypurposes alaid speciallydown trainedin expertArticle and1(1)(a), in(aa) accordanceand with(b). itsThat nationaldesignation rules.shall Forspecify the purposesexact laidunit downresponsible infor Articlecarrying 1(1)(a)out andtasks (b)related to the application of this Regulation,Regulation. finalEach identificationMember State shall bewithout madedelay bycommunicate to the MemberCommission Stateand eu-LISA a list of originthose units and any amendments thereto. eu-LISA shall publish the consolidated list in cooperationthe withOfficial Journal of the otherEuropean MemberUnion. StatesWhere concerned.there are amendments thereto, eu-LISA shall publish once a year an updated consolidated list online.

Change 21

RemovedArticle 30 – paragraph 2 – subparagraph 2: Where a person covered by Article 10(1), Article 13(1) and Article 14(1) is a minor, Member States shall ensure that that person understands the procedure by providing the information in an age-appropriate manner, both orally and in writing, using leaflets, infographics, demonstrations, or a combination of all three, which are specifically designed to explain the fingerprinting and facial image procedure to minors.

AddedArticle 29 – paragraph 3: 3. For the purposes laid down in Article 1(1)(a), (aa) and (b), each Member State shall take the necessary measures in order to achieve the objectives set out in paragraphs 1 and 2 of this Article in relation to its national system. In addition, each Member State shall keep records of the staff duly authorised to enter or retrieve the data.

RemovedThe best interest of the child should be an essential part of this Regulation. This Amendment is linked to Article 2 (non-codified text).

AddedArticle 30 – paragraph 1 – introductory part: 1. A person covered by Articles 10(1), 12a, Article 13(1) or Article 14(1) shall be informed by the Member State of origin in writing, and where necessary, orally, in a language that he or she understands or is reasonably supposed to understand in a concise, transparent, intelligible and easily accessible form, using clear and plain language , of the following:

Change 22

ChangedArticle 3830 – paragraph 1 – introductory part: 1. By way ofpoint derogationb: from(b) Articlethe 37purpose offor thiswhich Regulation,his theor personalher data relating to personswill referredbe toprocessed in Articles 10(1), 13(2), 14(1) obtained by a Member StateEurodac, followingincluding a hitdescription forof the purposes laid down inaims Articleof 1(1)(a)Regulation or(EU) (b)No may[…/…] be, transferredin oraccordance madewith availableArticle to6 athereof third-countryand, inwhere accordanceapplicable, withof Chapterthe Vaims of Regulation (EU) 2016/679,XXX/XXX, ifand necessaryan explanation in orderintelligible toform proveof the identity offact third-countrythat nationalsEurodac ormay statelessbe personsaccessed forby the purpose of return,Member onlyStates whereand theEuropol followingfor conditionslaw areenforcement satisfied:purposes;

Change 23

RemovedArticle 40 a (new): Article 40a / Operational Management of DubliNet and related tasks / 1. Eu-LISA shall operate and manage a separate secure electronic transmission channel between the authorities of Member States known as the 'DubliNet' communication network established by Article 18 of Commission Regulation (EC) No 1560/20031a for the purposes set out in Articles 32, 33 and 46 of Regulation (EU) No ...[Dublin IV]. / 2. The operational management of DubliNet shall consist of all the tasks necessary to ensure its availability five days a week during normal business hours. / 3. Eu-LISA shall be responsible for the following tasks relating to DubliNet: / (a) providing technical support to Member States by way of a helpdesk, five days a week during normal business hours, including in relation to problems concerning communication, email encryption and decryption, and problems arising from the signature of forms; / (b) providing IT security services; / (c) managing, registring and renewing digital certificates used for encrypting and signing DubliNet e-mail messages; / (d) the technical evolution of DubliNet; / (e) contractual matters. / 4. The Agency shall ensure, in cooperation with the Member States, that at all times the best available and most secure technology and techniques, subject to a cost-benefit analysis, are used for DubliNet. / 1a Commission Regulation (EC) No 1560/2003 of 2 September 2003 laying down detailed rules for the application of Council Regulation (EC) No 343/2003 establishi…

AddedArticle 30 – paragraph 1 – point c: (c) the recipients of the data;

RemovedThe initial proposal had included DubliNet and the operational responsibility of eu-LISA in the Article describing the Eurodac architecture, which was not really correct .This new chapter contains relevant text with additional descriptions clarifying what Operational responsibility means is now included as amendment to eu-LISA’s establishing Regulation.

AddedArticle 30 – paragraph 1 – point d: (d) in relation to a person covered by Articles 10(1), 12a, 13(1) or 14(1) , the obligation to have his or her fingerprints taken;

RemovedChapter VIII a (new): CHAPTER VIIIa / AMENDMENTS TO REGULATION (EU) NO 1077/2011 / Article 40 b / Regulation 1077/2011 is amended as follows: / (1) In Article 1(2), the following subparagraph is added: / "The Agency shall also be responsible for the operational management of a separate secure electronic transmission channel between the authorities of Member States, known as the 'DubliNet' communication network, established by Article 18 of Commission Regulation (EC) No 1560/2003, for the exchange of information under Regulation (EU) No... *[Dublin IV]. / * Commission Regulation (EC) No 1560/2003 of 2 September 2003 laying down detailed rules for the application of Council Regulation (EC) No 343/2003 establishing the criteria and mechanisms for determining the Member State responsible for examining an asylum application lodged in one of the Member States by a third-country national (OJ L 222, 5.9.2003, p. 3).”. / (2) The following Article is inserted: / "Article 5a / Tasks relating to DubliNet / 1. In relation to DubliNet, the Agency shall perform: / (a) the tasks conferred on it by Article [...] of Regulation (EU) No ...[Eurodac]; / (b) tasks relating to training with regard to the technical use of DubliNet.".

AddedArticle 30 – paragraph 1 – point f: (f) the existence of the right to object to the processing of personal data, to request from the controller access to data relating to him or her, and the right to request that inaccurate data relating to him or her be rectified and the completion of incomplete personal data or that unlawfully processed personal data concerning him or her be erased or restricted, as well as the right to receive information on the procedures for exercising those rights including the contact details of the controller and the supervisory authorities referred to in Article 32(1);

RemovedSee justification of Amendment 58.

AddedArticle 30 – paragraph 2 – subparagraph 1: In relation to a person covered by Articles 10(1), 12a, 13(1) and 14(1) , the information referred to in paragraph 1 of this Article shall be provided at the time when his or her fingerprints are taken.

AddedArticle 30 – paragraph 2 – subparagraph 2: Where a person covered by Article 10(1), Article 12a, Article 13(1) and Article 14(1) is a minor, Member States shall ensure that that person understands the procedure by providing the information in an age-appropriate manner, both orally and in writing, using leaflets, infographics, demonstrations, or a combination of all three, which are specifically designed to explain the fingerprinting and facial image procedure to minors..

AddedArticle 30 – paragraph 3 – subparagraph 3: The leaflet shall be established in such a manner as to enable Member States to complete it with additional Member State-specific information. This Member State-specific information shall include at least the possible administrative sanctions under national law to which a person may be subject in case of non-compliance with the fingerprinting process or the process for capturing facial images, the rights of the data subject, the possibility of information and assistance by the national supervisory authorities, as well as the contact details of the office of the controller and of the data protection officer, and the national supervisory authorities.

AddedArticle 31 – paragraph 1: 1. For the purposes laid down in Article 1(1)(a), (aa) and (b) of this Regulation, the data subject's rights of access, rectification and erasure shall be exercised in accordance ,with Chapter III of Regulation (EU) No. […/2016] and applied as set out in this Article.

AddedArticle 31 – paragraph 2: 2. The right of access of the data subject in each Member State shall include the right to obtain communication of the data relating to him or her recorded in the Central System and of the Member State which transmitted them to the Central System. Such access to data may be granted only by a Member State. For the purposes laid down in Article 1(1), in each Member State, any person may request that data which are factually inaccurate be corrected or that data recorded unlawfully be erased. The Member State that transmitted such data shall correct or erase it without excessive delay, in accordance with national law and practice.

AddedArticle 32 – paragraph 1: 1. Each Member State shall provide that The supervisory authority or authorities of each Member State designated pursuant to Article 41 of Directive referred to in Article [46(1)] of Regulation (EU) […/2016] shall monitor the lawfulness of the processing of personal data by the Member State in question for the purposes laid out in Article 1(1)(a), (aa) and (b), including their transmission to the Central System.

AddedArticle 34 – paragraph 4: 4. For the purpose laid down in paragraph 3, the national supervisory authorities and the European Data Protection Supervisor shall meet at least twice a year. The costs and servicing of these meetings shall be for the account of the European Data Protection Supervisor. Rules of procedure shall be adopted at the first meeting. Further working methods shall be developed jointly as necessary. A joint report of activities, assessing the application of the data protection provisions of this Regulation, as well as the necessity and proportionality of access to Eurodac for law enforcement purposes, shall be sent to the European Parliament, the Council, the Commission and eu-LISA every years.

AddedArticle 36 – paragraph 3: 3. Member States shall inform eu-LISA of security incidents detected on their systems without prejudice to the notification and communication of a personal data breach pursuant to [Articles 33 and 34] of Regulation (EU) 679/2016. In particular, data subjects shall be notified by eu-LISA without undue delay when a security incident is likely to result in a high risk to their rights and freedoms. eu-LISA shall inform the Member States, Europol and the European Data Protection Supervisor in case of security incidents. The Member States concerned, eu-LISA and Europol shall collaborate during a security incident.

AddedArticle 37 – paragraph 1: 1. Personal data obtained by a Member State or Europol pursuant to this Regulation from the Central System shall not be transferred or made available to any third country, international organisation or private entity established in or outside the Union. This prohibition shall also apply if those data are further processed at national level or between Member States within the meaning of Regulation (EU) 679/2016 and [Article [...]2(b) of Directive [ (EU) 2016/680].

AddedArticle 37 – paragraph 2: 2. Personal data which originated in a Member State and are exchanged between Member States following a hit obtained for the purposes laid down in Article 1(1)(c) shall not be transferred to third countries, including if there is a real risk that as a result of such transfer the data subject may be subjected to torture, inhuman and degrading treatment or punishment or any other violation of his or her fundamental rights.