Changes from report parliamentary committee draft to plenary report

AddedArticle 37 – paragraph 3: 3. No information regarding the fact that an application for international protection has been made in a Member State shall be disclosed to any third-country for persons related to Article 10(1) or Article 12a, particularly where that country is also the applicant's country of origin.

AddedArticle 38 – paragraph 1 – introductory part: 1. By way of derogation from Article 37 of this Regulation, only the necessary personal data relating to persons referred to in Articles 10(1), 13(2), 14(1) obtained by a Member State following a hit for the purposes laid down in Article 1(1)(a) or (b) may be transferred or made available to a third-country in accordance with Chapter V of Regulation (EU) 2016/679, if necessary in order to prove the identity of third-country nationals or stateless persons for the purpose of return, only where the following conditions are satisfied:

AddedArticle 38 – paragraph 1 – point c: (c) the Member State of origin which entered the data in the Central System has given its consent and the individual concerned has been informed that his or her personal information will be shared with the authorities of that third-country.

AddedArticle 38 – paragraph 1 a (new): 1a. Personal data which originated in a Member State and are exchanged between Member States following a hit obtained for the purposes laid down in Article 1(1)(a) and (b) shall not be transferred to third countries if there is a real risk that, as a result of such transfer, the data subject may be subjected to torture, inhuman and degrading treatment or punishment or any other violation of his or her fundamental rights.

AddedArticle 38 – paragraph 2: 2. No information regarding the fact that an application for international protection has been made in a Member State shall be disclosed to any third-country for persons related to Article 10(1).

AddedArticle 40 – paragraph 2 a (new): 2a. Ultimate responsibility for the processing of personal data shall lie with the Member States, which are considered to be ‘controllers’ within the meaning of Regulation (EU) 2016/679.

AddedArticle 40 – paragraph 3: 3. Claims for compensation against a Member State for the damage referred to in paragraphs 1 and 2 shall be governed by the provisions of national law of the defendant Member State in accordance with Chapter VIII of Regulation (EU) 2016/679 and Chapter VIII of Directive (EU) 2016/680 concerning remedies, liabilities and penalties.

AddedArticle 40 a (new): Article 40a / Operational management of DubliNet and related tasks / 1. Eu-LISA shall operate and manage a separate secure electronic transmission channel between the authorities of Member States known as the 'DubliNet' communication network established by Article 18 of Commission Regulation (EC) No 1560/20031a for the purposes set out in Articles 32, 33 and 46 of Regulation (EU) No ...[Dublin IV]. / 2. The operational management of DubliNet shall consist of all the tasks necessary to ensure its availability five days a week during normal business hours. / 3. Eu-LISA shall be responsible for the following tasks relating to DubliNet: / (a) providing technical support to Member States by way of a helpdesk, five days a week during normal business hours, including in relation to problems concerning communication, email encryption and decryption, and problems arising from the signature of forms; / (b) providing IT security services; / (c) managing, registering and renewing digital certificates used for encrypting and signing DubliNet e-mail messages; / (d) the technical evolution of DubliNet; / (e) contractual matters. / 4. Eu-LISA shall ensure, in cooperation with the Member States, that at all times the best available and most secure technology and techniques, subject to a cost-benefit analysis, are used for DubliNet. / 1a Commission Regulation (EC) No 1560/2003 of 2 September 2003 laying down detailed rules for the application of Council Regulation (EC) No 343/2003 establishing…

AddedChapter VIII a (new): CHAPTER VIIIa / AMENDMENTS TO REGULATION (EU) NO 1077/2011

AddedArticle 40 b (new): Article 40 b / Regulation (EU) No 1077/2011 is amended as follows: / (1) In Article 1(2), the following subparagraph is added: / "The Agency shall also be responsible for the operational management of a separate secure electronic transmission channel between the authorities of Member States, known as the 'DubliNet' communication network, established by Article 18 of Commission Regulation (EC) No 1560/2003, for the exchange of information under Regulation (EU) No... *[Dublin IV]. / * Commission Regulation (EC) No 1560/2003 of 2 September 2003 laying down detailed rules for the application of Council Regulation (EC) No 343/2003 establishing the criteria and mechanisms for determining the Member State responsible for examining an asylum application lodged in one of the Member States by a third-country national (OJ L 222, 5.9.2003, p. 3).”. / (2) The following Article is inserted: / "Article 5a / Tasks relating to DubliNet / 1. In relation to DubliNet, the Agency shall perform: / (a) the tasks conferred on it by Article [...] of Regulation (EU).../...[Eurodac]; / (b) tasks relating to training on the technical use of DubliNet.".

AddedArticle 41 – paragraph 1: 1. The costs incurred in connection with the establishment and operation of the Central System and the Communication Infrastructure shall be borne by the general budget of the European Union, in accordance with the principles of sound financial management.

AddedArticle 42 – paragraph 2 a (new): 2a. In order to enable interoperability between the EES and Eurodac, eu-LISA shall establish a secure communication channel between the EES Central System and the Eurodac Central System. The two central systems shall be connected to allow for the transfer to Eurodac of the biometric data of third-country nationals registered in the EES where registration of those biometric data are required by this Regulation.

AddedArticle 42 – paragraph 4: 4. By [2020] eu-LISA shall conduct a study on the technical feasibility and added value of adding facial recognition software to the Central System for the purposes of comparing facial images of minors. The study shall evaluate the reliability and accuracy of the results produced from facial recognition software for the purposes of EURODAC and shall make any necessary recommendations prior to the introduction of the facial recognition technology to the Central System. The study shall also include an impact assessment of the possible risks to the rights of privacy and human dignity, the rights of the child, as well as non-discrimination, as a result of using facial recognition software. The study shall take into account the views of other Union agencies, the European Data Protection Supervisor, relevant actors as well as academics.

AddedArticle 42 – paragraph 5: 5. By [...] and every four years thereafter, the Commission shall produce an overall evaluation of Eurodac, together with a full data protection and privacy impact assessment, examining the results achieved against objectives and the impact on fundamental rights, including whether law enforcement access has led to indirect discrimination against persons covered by this Regulation, and assessing the continuing validity of the underlying rationale and any implications for future operations, and shall make any necessary recommendations. The Commission shall transmit the evaluation to the European Parliament and the Council.

Article 45 – paragraph 2: 2. By […] , Europol shall notify the Commission of its designated authority, and it shall notify any amendment thereto without delay.

Change 24

RemovedSee justification on amendment 8. Moreover, current, Europol’s dependency on a MS’s technical infrastructure in order to access Eurodac data creates unnecessary risk and once used, would be cumbersome and slow. The MS’s system connecting Europol to Eurodac would need to meet Europol’s stringent data security requirements. At present, the connection to Eurodac via the Dutch National Access point could not be successfully established due to technical and data security issues encountered.