Changes from report parliamentary committee draft to plenary report

Change 9

ChangedRecital 19: (19) To the extent it is applicable, theThe universal message format (UMF) standard should be used in the development of the router and EPRIS and forEPRIS. anyAny automated exchange of data in accordance with this Regulation.Regulation should use the UMF standard. Member States’ competent law enforcement authorities and Europol are encouraged to use the UMF standard also in relation to any further exchange of data between them in the context of the Prüm II framework. The UMF standard should serve as a standard for structured, cross-border information exchange between information systems, authorities or organisations in the field of Justice and Home Affairs.

Change 10

ChangedRecital 21: (21) Certain aspects of the Prüm II framework cannot be covered exhaustively by this Regulation given their technical, highly detailed and frequently changing nature. Those aspects include, for example, technical arrangements and specifications for automated searching procedures, the standards,standards for data exchange, including minimum quality standards, for data exchange and the data elements to be exchanged. In order to ensure uniform conditions for the implementation of this Regulation implementing powers should be conferred on the Commission. Those powers should be exercised in accordance with Regulation (EU) No 182/2011 of the European Parliament and of the Council.36

Change 11

RemovedRecital 23: (23) As the router should be developed and managed by the European Union Agency for the Operational Management of Large-Scale Information Systems in the Area of Freedom, Security and Justice established by Regulation (EU)2018/1726 of the European Parliament and of the Council37 (eu-LISA), it is necessary to amend Regulation (EU) 2018/1726 with a view to adding that task to the tasks of eu-LISA.

AddedRecital 21 a (new): (21a) Data quality in the context of automated comparison is an essential prerequisite to ensure the efficiency of this Regulation and reduce the risk of false matches. Adequate standards for data exchanged in the framework of this Regulation should be determined at Union level by means of implementing acts.

AddedRecital 21 b (new): (21b) Given the scale and sensitivity of the personal data exchanged for the purposes of this Regulation, and the existence of different national rules for storing information on individuals in national databases, it is important to ensure that the databases used for the automated searching of DNA profiles, dactyloscopic data, facial images, police records and certain vehicle registration data are established in accordance with national law and, as applicable, Directive (EU) 2016/680, Regulation (EU) 2018/1725 and Regulation (EU) 2016/794. Therefore, prior to connecting their national databases to the router, EPRIS or Eucaris, Member States should conduct a data protection impact assessment as referred to in Directive (EU) 2016/680 and consult the supervisory authority as referred to in that Directive, in order to ensure that data in the national databases has been stored in accordance with the applicable law.

AddedRecital 21 c (new): (21c) Member States and Europol should ensure that data exchanged in the framework of this Regulation are accurate and up-to-date. In accordance with the principles of data protection, Member States and Europol should make sure that any data transmitted that are found to be incorrect, inaccurate or outdated are corrected or deleted, as appropriate, and that any correction or deletion is communicated to all recipients without delay.

AddedRecital 21 d (new): (21d) Strong monitoring of the implementation of this Regulation is of utmost importance. In particular, compliance with rules for processing personal data should be subject to effective safeguards, and regular monitoring and audits by data controllers, supervisory authorities and the European Data Protection Supervisor should be ensured. Provisions allowing for a regular checking of the admissibility of queries and the lawfulness of data processing should also be in place. Member States and Europol should ensure adequate human, technical and financial resources for those purposes.

AddedRecital 21 e (new): (21e) Supervisory authorities and the European Data Protection Supervisor should ensure coordinated supervision of the application of this Regulation within the framework of their responsibilities, in particular where they find major discrepancies between Member State’s practices, potentially unlawful transfers or potential politically-motivated requests.

Change 12

ChangedRecital 26: (26) The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 of the European Parliament and of the Council38 and delivered an opinion on 2 March 202239 . / 39 OJ C 225, 9.6.2022, p. 6p.6.

Change 13

ChangedArticle 1 – paragraph 2: This Regulation lays down the conditions and procedures for the automated searching of biometricDNA date,profiles, dactyloscopic data, facial images, police records and certain vehicle registration data and the rules regarding the exchange of core data following a confirmed match on biometric data.match.

Change 14

ChangedArticle 2 – paragraph 1: The purpose of Prüm II shall be to step up cross-border cooperation in matters covered by Part III, Title V, Chapter 5 of the Treaty on the Functioning of the European Union, particularly by facilitating the exchange of information between Member States’ competent law enforcement authorities.authorities, in full respect for the fundamental rights of natural persons, including the right to respect for one’s private life, and for the protection of personal data, in accordance with the Charter of Fundamental Rights of the European Union.

Change 15

ChangedArticle 2 – paragraph 2: The purpose of Prüm II shall also be to allow for the search for missing persons and the identification of unidentified human remains by Member States’ competent law enforcement authorities,authorities in the context of a criminal investigation, provided that those authorities have beenare empowered to conduct such searches and to carry out such identificationsidentification under national law.

Change 16

ChangedArticle 3 – paragraph 1: This Regulation applies to the databases, established in accordance with national databaseslaw and in compliance with, as applicable, Directive (EU) 2016/680, Regulation (EU) 2018/1725 or Regulation (EU) 2016/794, used for the automated transfer of the data categories of DNA profiles, dactyloscopic data, facial images, police records and certain vehicle registration data.

Change 17

ChangedArticle 4 – paragraph 1 – point 8 ba (new): (8b)(8a) ‘unidentified dactyloscopic data’ means the dactyloscopic data obtained from traces collected during the investigation of a criminal offence which belongsbelong to a person not yet identified;

Change 18

ChangedArticle 4 – paragraph 1 – point 10 a (new): (10a) ‘facial image reference data’ means thea facial image and theits reference number referred to in Article 23;

Change 19

ChangedArticle 4 – paragraph 1 – point 10 cb (new): (10c)(10b) ‘unidentified facial image’ means a facial image collected during the investigation of a criminal offence which belongs to a person not yet identified;

Change 20

ChangedArticle 4 – paragraph 1 – point 16: (16) ‘police records’ means biographicbiographical information on suspectsregarding andpersons convicted personsor suspected of having committed a serious criminal offence available in the national databases established for the prevention, detection and investigation of criminal offences;

Change 21

ChangedArticle 4 – paragraph 1 – point 17: (17) ‘pseudonymisation’ means pseudonymisation as defined in Article 2,3, point (5), of Directive (EU) 2016/680;

Change 22

RemovedArticle 4 – paragraph 1 – point 17 a (new): (17a) ‘victim of serious crime or terrorism’ means a person that is adversely affected by an offence under national law which corresponds or is equivalent to one of the offences referred to in Directive (EU) 2017/541 of the European Parliament and of the Council or an offence which corresponds or is equivalent to one of the offences referred to in Article 2(2) of Council Framework Decision 2002/584/JHA, if it is punishable under national law by a custodial sentence or a detention order for a maximum period of at least three years;

AddedArticle 4 – paragraph 1 – point 17 a (new): (17a) ‘suspect’ means a person referred to in Article 6, point (a), of Directive (EU) 2016/680;

RemovedArticle 4 – paragraph 1 – point 17 b (new): “(17b) ‘designated authorities’ means the designated authorities as defined in Article 3(1), point (26), of Regulation (EU) 2017/2226 of the European Parliament and of the Council1a, Article 2(1), point (e), of Council Decision 2008/633/JHA1b, and Article 3(1), point (21), of Regulation (EU) 2018/1240 of the European Parliament and of the Council1c; / 1a Regulation (EU) 2017/2226 of the European Parliament and of the Council of 30 November 2017 establishing an Entry/Exit System (EES) to register entry and exit data and refusal of entry data of third-country nationals crossing the external borders of the Member States and determining the conditions for access to the EES for law enforcement purposes, and amending the Convention implementing the Schengen Agreement and Regulations (EC) No 767/2008 and (EU) No 1077/2011 (OJ L 327, 9.12.2017, p. 20). / 1b Council Decision 2008/633/JHA of 23 June 2008 concerning access for consultation of the Visa Information System (VIS) by designated authorities of Member States and by Europol for the purposes of the prevention, detection and investigation of terrorist offences and of other serious criminal offences (OJ L 218, 13.8.2008, p. 129). / 1c Regulation (EU) 2018/1240 of the European Parliament and of the Council of 12 September 2018 establishing a European Travel Information and Authorisation System (ETIAS) and amending Regulations (EU) No 1077/2011, (EU) No 515/2014, (EU) 2016/399, (EU) 2016/1624 and (EU) 2017/2226 (OJ L 236, 19.9.2018,…

AddedArticle 4 – paragraph 1 – point 17 b (new): (17b) ‘serious criminal offence’ means an offence referred to in Article 2(2) of Council Framework Decision 2002/584/JHA1a or in Article 3 of Regulation (EU) 2016/794, which is punishable in the requesting Member State by a custodial sentence or a detention order for a maximum period of at least three years; / 1a Council Framework Decision 2002/584/JHA of 13 June 2002 on the European arrest warrant and the surrender procedures between Member States (OJ L 190, 18.7.2002, p. 1).

AddedArticle 4 – paragraph 1 – point 17 c (new): (17c) ‘victim of serious crime or terrorism’ means a person that is adversely affected by an offence which corresponds or is equivalent to one of the offences referred to in Article 2(2) of Framework Decision 2002/584/JHA, if that offence is punishable under national law by a custodial sentence or a detention order for a maximum period of at least three years or an offence under national law which corresponds or is equivalent to one of the offences referred to in Directive (EU) 2017/541 of the European Parliament and of the Council1a; / 1a Directive (EU) 2017/541 of the European Parliament and of the Council of 15 March 2017 on combating terrorism and replacing Council Framework Decision 2002/475/JHA and amending Council Decision 2005/671/JHA (OJ L 88, 31.3.2017, p. 6).

AddedArticle 4 – paragraph 1 – point 17 d (new): (17d) ‘personal data’ means personal data as defined in Article 3, point (1), of Directive (EU) 2016/680;

Change 23

ChangedArticle 4 – paragraph 1 – point 18 a (new): (18a) 'competent law enforcement authority' means any police, customs or other authority of athe Member StateStates competent under national law to exercise authority and to take coercive measures for the purpose of preventing, detecting or investigating criminal offences;

Change 24

ChangedArticle 4 – paragraph 1 – point 20: (20) ‘SIENA’ means the secure information exchange network application, managed by Europol in accordance with Regulation (EU) 2016/794, aimed at facilitating the exchange and ensuring the secure transmission of operational and strategic crime-related information;information between Member States and Europol;

Change 25

ChangedArticle 5 – paragraph 1 – introductorysubparagraph part:1: 1. Member States shall open and keep national DNA databases for the prevention, detection and investigation of criminal offences.

Change 26

ChangedArticle 5 – paragraph 1 – subparagraph 1:2: Processing of data kept in those databases, under this Regulation, shall be carried out in accordance with this Regulation and in compliance with the national law of the Member States applicable to the processing of those data.

Change 27

ChangedArticle 5 – paragraph 2 – introductorysubparagraph part:1: 2. Member States shall ensure the availability of DNA reference data from their national DNA databases as referred to in paragraph 1 for the purposes of automated searches by other Member States pursuant to this Regulation.

Change 28

ChangedArticle 5 – paragraph 2 – subparagraph 1:2: DNA reference data shall not contain any additional nominal data from which an individual can be directly identified.

Change 29

ChangedArticle 5 – paragraph 2 – subparagraph 2:3: Unidentified DNA profiles shall be recognisable as such.

Change 30

ChangedArticle 5 – paragraph 2 a2a (new): 2a. The Commission shall adopt an implementing act to specify the identification characteristics of a DNA profile which is to be exchanged and the minimum requirements for a match, taking into account international and European standards. That implementing act shall be adopted in accordance with the procedure referred to in Article76(2).Article 75(2).

Change 31

ChangedArticle 6 – paragraph 1 – introductory part:subparagraph 1.1: For the prevention, detection and investigation of criminal offences, Member States shall allow national contact points of other Member States and Europol to conduct automated searchesaccess ofto the DNA profilesreference data in their DNA databases established for that purpose in order to conduct automated searches of the DNA profiles in those databases and to compare those DNA profiles with their DNA profiles.

Change 32

ChangedArticle 6 – paragraph 1 – subparagraph 1:2: Searches shall only be conducted in individual cases, where they are proportionate and necessary for the purposesinvestigation of preventing, detecting or investigating a criminal offence, and in compliance with the national law of the requesting Member State.

Change 33

ChangedArticle 6 – paragraph 2 – introductory part:subparagraph 2.1: Should an automated search show that a supplied DNA profile matches DNA profiles stored in the requested Member State's searched database or databases, the national contact point of the requesting Member State shall receive in an automated way the DNA reference data with which a match has been found.

Change 34

ChangedArticle 6 – paragraph 2 – subparagraph 1:2: deleted

Change 35

ChangedArticle 6 – paragraph 3: 3. The national contact point of the requesting Member State shall manuallyensure that a human review by a forensic expert is conducted in order to confirm a match of DNA profile data with DNA reference data held by the requested Member State following the automated supply of the DNA reference data required for confirming a match.

Change 36

ChangedArticle 7 – paragraph 2: 2. Should a requested Member State, as a result of the comparison referred to in paragraph 1, find that any DNA profiles supplied match any of those in its DNA databases, it shallshall, ,withoutwithout delay, supply the national contact point of the requesting Member State with the DNA reference data with which a match has been found.

Change 37

ChangedArticle 7 – paragraph 3: 3. TheA confirmationhuman ofreview by a forensic expert to confirm a match of DNA profiles with DNA reference data held by the requested Member State shall be carried out manually by the national contact point of the requesting Member State following the automated supply of the DNA reference data required for confirming a match.

Change 38

ChangedArticle 8:8 – paragraph 1: deleted / (deleted) / (deleted)

Change 39

ChangedArticle 9 – paragraph 1 – point a a (new): (aa) a reference number allowing Europol, in case of a match, to retrieve further data and other information for the purposes of Article 49(1) of this Regulation in order to supply them or it to one, several or all Member States in accordance with Regulation (EU) 2016/794;

Change 40

ChangedArticle 10 – paragraph 1: 1. Member States and, where applicable, Europol shall take all appropriate measures to ensure confidentiality and integrity for DNA reference data being sent to other Member States or Europol, including their encryption.

Change 41

ChangedArticle 10 – paragraph 2: 2. Member States and Europol shall take the necessary measures to guarantee the integrity and minimum quality standards of the DNA profiles made available or sent for comparison to the other Member States and to ensure that those measures comply with the relevant European or international standards for DNA data exchange.

Change 42

ChangedArticle 10 – paragraph 3: 3. The Commission shall adopt an implementing act to establish minimum quality requirements to be met by DNA reference data and toacts specifyspecifying the relevant European or international standards that are to be used by Member States and Europol for DNA reference data exchange.exchange, Thatincluding the minimum quality standard to be met by DNA profiles. Those implementing actacts shall be adopted in accordance with the procedure referred to in Article 76(2).75(2).

Change 43

ChangedArticle 11 – paragraph 3: 3. Automated notification of a match shall only be provided if the automated search or comparison has resulted in a match of a minimum number of loci. The CommissionCommission, after consulting the European Data Protection Board in accordance with Article 42(2) of Regulation (EU) 2018/1725, shall adopt an implementing actacts to specify this minimum number of loci, in accordance with the procedure referred to in Article 76(2).75(2) of this Regulation.

Change 44

ChangedArticle 11 – paragraph 5: 5. Member States shall ensure that requests are consistent with notifications sent pursuant to Article 73(2a).72(2a). Those notifications shall be reproduced in the practical handbook referred to in Article 78.77.

Change 45

ChangedArticle 12 – paragraph 2: 2. Dactyloscopic reference data shall not contain any additional nominal data from which an individual can be directly identified.

Change 46

ChangedArticle 12 – paragraph 3: 3. Unidentified dactyloscopic data shall be recognisable as such.such

Change 47

ChangedArticle 13 – paragraph 1 – introductory part:subparagraph 1.1: For the prevention, detection and investigation of criminal offences, Member States shall allow national contact points of other Member States and Europol access to the dactyloscopic reference data in their national databases established for that purpose, to conduct automated searches by comparing dactyloscopic reference data.

Change 48

ChangedArticle 13 – paragraph 1 – subparagraph 1:2: Searches shall only be conducted in individual cases, where they are proportionate and necessary for the purposes of preventing, detecting or investigating a criminal offence, and in compliance with the national law of the requesting Member State.

Change 49

ChangedArticle 13 – paragraph 2: 2. The national contact point of the requesting Member State shall manuallyensure that a human review by a forensic expert is conducted in order to confirm a match of dactyloscopic data with dactyloscopic reference data held by the requested Member State following the automated supply of the dactyloscopic reference data required for confirming a match.

Change 50

ChangedArticle 14 – paragraph 1 – point a: (a) a reference number allowing Member States, in the case of a match, to retrieve further data and other information in their databases referred to in Article 12 in order to supply it to one, several or all of the other Member States in accordance with ArticlesArticle 47 and 48 or to Europol in accordance with Article 50(6);

Change 51

ChangedArticle 14 – paragraph 1 – point a a (new): (aa) a reference number allowing Europol, in case of a match, to retrieve further data and other information for the purposes of Article 49(1) of this Regulation in order to supply them or it to one, several or all Member States in accordance with Regulation (EU) 2016/794;

Change 52

ChangedArticle 15 – paragraph 1: 1. The digitalisation of dactyloscopic data and their transmission to the other Member States or Europol shall be carried out in accordance with a uniform data format. The Commission shall adopt an implementing actacts to specify the uniform data format in accordance with the procedure referred to in Article 76(2).75(2).

Change 53

ChangedArticle 15 – paragraph 2: 2. Each Member State and Europol shall ensure that the dactyloscopic data it transmits are of sufficient quality for automated comparison. The Commission shall adopt an implementing act to specify the minimum quality standard for the comparison of dactyloscopic data. That implementing act shall be adopted in accordance with the procedure referred to in Article 76(2).

Change 54

ChangedArticle 15 – paragraph 3: 3. Member States and Europol shall take all appropriate measures to ensure the confidentiality and integrity of dactyloscopic data being sent to other Member States, including their encryption.

Change 55

ChangedArticle 15 – paragraph 4: 4. The Commission shall adopt an implementing act toacts specifyspecifying the relevant existing European or international standards for dactyloscopic data exchange that are to be used by Member States.States, Thatincluding the minimum quality standard for the automated comparison of dactyloscopic data. Those implementing actacts shall be adopted in accordance with the procedure referred to in Article 76(2).75(2).

Change 56

ChangedArticle 16 – paragraph 1 – introductory part:subparagraph 1.1: Member States and Europol shall ensure that their search requests do not exceed the search capacities specified by the requested Member State.

Change 57

ChangedArticle 16 – paragraph 1 – subparagraph 1:2: Member States shall inform other Member States, Europol, the Commission and eu-LISA about their maximum search capacities per day for dactyloscopic data of identified persons and for dactyloscopic data of persons not yet identified. Member States may raise those maximum search capacities. Where a Member State raises those maximum search capacities, it shall notify the other Member States, Europol, the Commission and eu-LISA of the new maximum search capacities.

Change 58

RemovedArticle 16 – paragraph 2: 2. The Commission shall adopt an implementing act to specify the maximum numbers of candidates accepted for comparison per transmission in accordance with the procedure referred to in Article 76(2).

Change 59

ChangedArticle 1918 – paragraph 3: 3. The3 Commissiona shall(new): adopt3a. anThe implementingdata actreferred to specify thein dataparagraph elements1, ofpoints the(a) vehicleand registration(b), dataof whichthis mayArticle beshall exchanged.not Thatgo implementingbeyond actthe shalldata beelements adoptedspecified in accordancethe withimplementing theact procedureadopted referredpursuant to in Article 76(2).19(3).

Change 60

RemovedArticle 20 – paragraph 1 – introductory part: 1. Each Member State shall keep logs of queries that the staff of its competent law enforcement authorities duly authorised to exchange vehicle registration data make as well as logs of queries requested by other Member States. Europol shall keep logs of queries that its duly authorised staff make.

AddedArticle 19 – paragraph 3: 3. The Commission shall adopt implementing acts to specify the data elements of the vehicle registration data which may be exchanged. Those implementing acts shall be adopted in accordance with the procedure referred to in Article 75(2).

RemovedArticle 20 – paragraph 2 – subparagraph 1: Those logs shall be protected by appropriate measures against unauthorised access and erased two years after their creation. If, however, they are required for monitoring procedures that have already begun, they shall be erased once the monitoring procedures no longer require the logs.

AddedArticle 20 – paragraph 1 – subparagraph 1: Each Member State shall keep logs of queries that the staff of its competent law enforcement authorities duly authorised to exchange vehicle registration data make as well as logs of queries requested by other Member States. Europol shall keep logs of queries that its duly authorised staff make.

RemovedArticle 21 – paragraph 1 – introductory part: 1. Member States shall ensure the availability of facial images of suspects and convicted persons collected in accordance with their national law from their national databases established for the prevention, detection and investigation of criminal offences. Those data shall only include facial images and the reference number referred to in Article 23, and shall indicate whether the facial images are attributed to an individual or not.

AddedArticle 20 – paragraph 2 – subparagraph 2: Those logs shall be protected by all appropriate measures against unauthorised access and erased three years after their creation. If, however, they are required for monitoring procedures that have already begun, they shall be erased once the monitoring procedures no longer require the logs.

Change 61

ChangedArticle 22 – paragraph 1 – subparagraph 1: Searches1. shallFor onlythe beprevention, conducteddetection inand individualinvestigation cases,of wherecriminal theyoffences, areMember proportionateStates andshall necessaryallow fornational thecontact purposepoints of preventing, detecting or investigating aother criminalMember offence,States and inEuropol complianceaccess withto the nationalfacial lawimages ofstored thein requestingtheir Membernational State.databases Searchesreferred forto thein purposeArticle of21(1), profilingto shallconduct beautomated prohibited.searches.

Change 62

RemovedArticle 22 – paragraph 2: 2. The requesting Member State shall receive a list composed of candidates. That Member State shall manually review the list to determine the existence of a confirmed match.

AddedArticle 22 – paragraph 1 – subparagraph 2: Searches shall only be conducted in individual cases, where they are proportionate and necessary for the purpose of preventing, detecting or investigating a serious criminal offence, and in compliance with the national law of the requesting Member State. Searches for the purpose of profiling shall be prohibited.

AddedArticle 22 – paragraph 2: 2. The requesting Member State shall receive a list composed of matches concerning likely candidates. That Member State shall ensure that a human review of the list is conducted by two forensic experts in order to determine the existence of a confirmed match.

Change 63

ChangedArticle 23 – paragraph 1 – point a: (a) a reference number allowing Member States, in case of a match, to retrieve further data and other information in their databases referred to in Article 21 in order to supply it to one, several or all of the other Member States in accordance with ArticlesArticle 47 or Europol in accordance with Article 50(6);

Change 64

ChangedArticle 23 a (new): Article 23a / Principles for the exchange of facial images / 1. Each Member State and Europol shall ensure that the facial images itin transmitstheir databases are of sufficient quality for automated comparison. The Commission shall adopt an implementing act to specify the minimum quality standard for the comparisonpurpose of facial images. That implementing act shall bethis adoptedRegulation, in accordance with the procedure referred toparticular infor Articleautomated 76(2).comparison. / 2. Member States and Europol shall take appropriate measures to ensure the confidentiality and integrity of facial images being sent to other Member States, and Europol of facial images being sent to Member States, including theirthe encryption.encryption of such facial images. / 3. The Commission shall adopt an implementing acts to specifyspecifying the relevant European or international standards for facial image exchange that are to be used by Member States and EuropolEuropol, including the minimum quality standard for facialthe imageautomated exchange.comparison Thatof facial images. Those implementing actacts shall be adopted in accordance with the procedure referred to in Article 76(2).75(2).

Change 65

ChangedArticle 25 – title: National policePolice records indexindexes

Change 66

ChangedArticle 25 – paragraph 1 – introductory part: 1. Member States may decide to participate in the automated exchange of police records.records indexes. For the purposes of such exchanges, Member States participating in the automated exchange of policeMember recordsStates shall ensure the availability of national police records indexes which contain sets of biographical data of persons suspected of,convicted or convictedsuspected for,of having committed an offence as referred to in Article 3 of Regulation (EU) 2016/794 or Article 2(2) of Councila Frameworkserious Decisioncriminal 2002/584/JHAoffence from their national databases established for the prevention, detection and investigation of criminal offences. Those sets of data shall, if applicable and to the extent that they are available, contain only the following data:

Change 67

ChangedArticle 25 – paragraph 1 – point c: (c) alias(es) and previously used names(s);name or names;

Change 68

ChangedArticle 25 – paragraph 1 – subparagraph 1 a (new): 1a. Member States shall, in accordance with Article 7(2) of Directive (EU) 2016/680, ensure that the data included in the national police records indexes as listed in paragraph 1 of this Article are accurate, complete and up to date.

Change 69

RemovedArticle 26 – paragraph 1 – introductory part: 1. For the prevention, detection and investigation of criminal offences, Member States participating in the automated exchange of police records shall allow national contact points of other Member States participating in such exchanges and Europol access to data in their national police records indexes, to conduct automated searches.

AddedArticle 26 – title: Automated searching of police records indexes

Change 70

ChangedArticle 26 – paragraph 1 – subparagraph 1: Searches1. shallFor onlythe beinvestigation conductedof criminal offences, Member States participating in individualthe cases,automated whereexchange theyof arepolice proportionaterecords andindexes necessaryshall forallow thenational purposescontact points of preventing,other detectingMember orStates investigatingparticipating ain criminalsuch offence,exchanges and inEuropol complianceaccess withto thedata in their national lawpolice ofrecords theindexes, requestingto Memberconduct State.automated searches.

Change 71

AddedArticle 26 – paragraph 1 – subparagraph 2: Searches shall only be conducted in individual cases, where they are proportionate and necessary for the investigation of a serious criminal offence, and in compliance with the national law of the requesting Member State.

Change 72

RemovedArticle 28 – paragraph 1 – point c: (c) the data referred to in Article 25(1), where available and pseudonymised in accordance with Article 25(2).

AddedArticle 28 – title: Rules for requests and answers regarding police records indexes

AddedArticle 28 – paragraph 1 – introductory part: 1. A request for an automated search of police records indexes shall include only the following information:

AddedArticle 28 – paragraph 1 – point c: (c) the data referred to in Article 25(1), where available, and pseudonymised in accordance with Article 25(2).

Change 73

ChangedArticle 29 – paragraph 2 a (new): 2a. Member States shall provideensure that their national contact points withare sufficientprovided resources,with includingadequate qualifiedhuman, staff,technical and shall ensure thatfinancial theyresources, haveincluding sufficientqualified capacitystaff, to carry out their tasks under this Regulation in an adequate, effective and rapid manner in accordance with this Regulation.manner.

Change 74

ChangedArticle 30 – paragraph 1: The Commission shall adopt an implementing actacts to specify the technical arrangements to be made by the Member States with respect to the procedures set out in Articles 6, 7, 13, 18, 22 and 26. ThatThose implementing actacts shall be adopted in accordance with the procedure referred to in Article 76(2).75(2).

Change 75

ChangedArticle 31: deleted31 /– (deleted)paragraph /1: (deleted)deleted

Change 76

ChangedArticle 32 – paragraph 2 – introductory part:subparagraph 2.1: National contact points shall immediately inform each other, the Commission, Europol and eu-LISA whereof technical faults causing unavailability of the automated data exchange is unavailable.exchange.

Change 77

ChangedArticle 32 – paragraph 2 – subparagraph 1: Where the automated data exchange is unavailable,2: nationalNational contact points shall agree on temporary alternative information exchange arrangements in accordance with the applicable Union and national law.law to be used in cases where automated data exchange is unavailable.

Change 78

ChangedArticle 32 – paragraph 3: 3. Where the automated data exchange is unavailable, national contact points shall ensure that the it is re-established without delay.

Change 79

ChangedArticle 33 – paragraph 1 – introductorysubparagraph part:1: 1. Each Member State shall keep a justification of the queries that its competent law enforcement authorities make.

Change 80

RemovedArticle 33 – paragraph 2 – point b: (b) an indication on whether the query concerns a suspect or a perpetrator of a criminal offence, a victim of a terrorist offence as defined in Article 4, point (21), of Regulation (EU) 2019/817, a victim of a serious criminal offence as defined in Article 4, point (22), of that Regulation, a missing person or unidentified human remains;

AddedArticle 33 – paragraph 2 – point a: (a) the purpose of the query, including a reference to the specific case or investigation and the criminal offence, where applicable;

AddedArticle 33 – paragraph 2 – point b: (b) an indication on whether the query concerns a suspect or a person convicted of a criminal offence, a victim of serious crime or terrorism, a missing person or unidentified human remains;

Change 81

ChangedArticle 33 – paragraph 3 – subparagraph 1: ThoseThe justifications shall be protected by appropriate measuresreferred againstto unauthorisedin accessparagraph and2 erasedshall twoonly yearsbe afterused theirfor creation.fundamental If,rights however,and theydata areprotection requiredmonitoring, forincluding monitoringchecking proceduresthe thatadmissibility haveof alreadya begun,query theyand shallthe belawfulness erasedof oncedata theprocessing, monitoringand proceduresfor noensuring longerdata requiresecurity theand justification.integrity.

Change 82

RemovedArticle 34 – paragraph 1: 1. To the extent it is applicable, the universal message format (UMF) standard referred to in Article 38 of Regulation (EU)2019/817 shall be used in the development of the router referred to in Article 35 and EPRIS.

AddedArticle 33 – paragraph 3 – subparagraph 2: Those justifications shall be protected by appropriate measures against unauthorised access and erased three years after their creation. If, however, they are required for monitoring procedures that have already begun, they shall be erased once the monitoring procedures no longer require the justification.

Change 83

ChangedArticle 3533 – paragraph 1:4: 1.4. AFor routerthe ispurposes establishedof forfundamental therights purposesand ofdata facilitatingprotection monitoring, including checking the establishmentadmissibility of connectionsa betweenquery Memberand Statesthe andlawfulness withof Europoldata forprocessing, queryingthe with,data retrievingcontrollers andshall scoringhave biometricunrestricted dataaccess andto forthose retrievingjustifications alphanumericfor dataself-monitoring inas accordancereferred withto thisin Regulation.Article 56.

Change 84

RemovedArticle 35 – paragraph 2 – point b: (b) a secure communication channel between the central infrastructure, Member States’ competent law enforcement authorities authorised to use the router in accordance with Article 36 and Europol;

AddedArticle 34 – paragraph 1: 1. The universal message format (UMF) standard established under Article 38 of Regulation (EU)2019/818 shall be used in the development of the router referred to in Article 35 of this Regulation and EPRIS, to the extent it is applicable.

Change 85

ChangedArticle 3635 – paragraph 1: The1. useA ofrouter theis routerestablished shallfor bethe reservedpurposes toof thefacilitating Memberthe States’establishment competentof lawconnections enforcementbetween authoritiesMember thatStates, areand authorisedbetween toMember accessStates and exchangeEuropol, DNAfor profiles,querying dactyloscopicwith, dataretrieving and facial imagesscoring inbiometric accordancedata withand thisfor Regulationretrieving andalphanumeric Europoldata in accordance with Regulation (EU)this 2016/794.Regulation.

Change 86

RemovedArticle 37 – paragraph 1: 1. The competent law enforcement authorities authorised to access the router in accordance with Article 36 shall request a query by submitting biometric data to the router. The router shall dispatch the request for a query to the databases of the requested Member States and Europol data simultaneously with the data submitted by the user in accordance with his or her access rights.

AddedArticle 35 – paragraph 2 – point a: (a) a central infrastructure, including a search tool enabling the simultaneous querying of Member States’ databases referred to in Articles 5, 12 and 21 and Europol data;

AddedArticle 35 – paragraph 2 – point b: (b) a secure communication channel between the central infrastructure, Member States’ competent law enforcement authorities authorised to use the router in accordance with Article 36, and Europol;

AddedArticle 36 – paragraph 1: The use of the router shall be reserved to the Member States’ competent law enforcement authorities that are authorised to access and exchange DNA profiles, dactyloscopic data and facial images in accordance with this Regulation, and Europol in accordance with this Regulation and Regulation (EU) 2016/794 where they have a demonstrable need for such access. Member States and Europol shall ensure that their authorised staff have completed relevant training, including on data protection, confidentiality, detection of biases, as well as the accurate review of matches under the relevant data category.

AddedArticle 37 – paragraph 1: 1. The competent law enforcement authorities authorised to access the router pursuant to Article 36 shall request a query by submitting biometric data to the router. The router shall dispatch the request for a query to the databases of the requested Member States and Europol data simultaneously with the data submitted by the user in accordance with his or her access rights.

Change 87

ChangedArticle 37 – paragraph 3: 3. Any candidates resulting from queries as referred to in paragraph 2 shall be sent back in an automated manner to the router. The requesting Member State shall be notified in an automated manner where there is no match.

Change 88

ChangedArticle 37 – paragraph 5: 5. The router shall return the list of matching biometric data and their scores to the requestingrouter Memberuser. State.That list shall be limited to the maximum number of candidates set out in the implementing act adopted pursuant to paragraph 6.

Change 89

ChangedArticle 37 – paragraph 6: 6. The CommissionCommission, after consulting the European Data Protection Board in accordance with Article 42(2) of Regulation 2018/1725, shall adopt an implementing actacts to specify the technical procedure for the router to query Member States’ databases and Europol data, the format of the router replies andreplies, the technical rules for scoring the correspondence between biometric data.data Thatand the relevant thresholds, as well as the maximum number of candidates that can be returned per search, with a view to ensuring accuracy, minimising the risk of misidentification and preventing discrimination. Those implementing actacts shall be adopted in accordance with the procedure referred to in Article 76(2).75(2).

Change 90

ChangedArticle 38 – paragraph 2:1: The requested Member State shall informcheck the requesting Member State, without delay,quality viaof the router where thetransmitted data areby unsuitablemeans forof an automated comparison.procedure.

Change 91

RemovedArticle 39 – paragraph 1: 1. Where designated authorities are authorised to use the router in accordance with Article 36, they may launch a query to Member States’ databases and Europol data simultaneously with a query to the Common Identity Repository, provided that the relevant conditions under Union law are fulfilled and that the query is launched in accordance with their access rights. For this purpose, the router shall query the Common Identity Repository via the European Search Portal.

AddedArticle 38 – paragraph 2: The requested Member State shall, without delay, inform the requesting Member State via the router where the data are unsuitable for an automated comparison.

RemovedArticle 39 – paragraph 2 – subparagraph 1: deleted

AddedArticle 39 – paragraph 1: 1. Where designated authorities are authorised to use the router pursuant to Article 36, they may launch a query to Member States’ databases and Europol data simultaneously with a query to the Common Identity Repository, provided that the relevant conditions under Union law are fulfilled and that the query is launched in accordance with their access rights. For this purpose, the router shall query the Common Identity Repository via the European Search Portal.

RemovedArticle 39 – paragraph 2 – subparagraph 2: Simultaneous queries of the Member States’ databases and Europol data and the Common Identity Repository may only be launched where there are reasonable grounds to believe that data on a suspect, perpetrator or victim of serious crime or terrorism are stored in the Common Identity Repository.

AddedArticle 39 – paragraph 2 – subparagraph 2: deleted

Change 92

ChangedArticle 43 – paragraph 2 – point a: (a) alias(es) and previously used name(s);name or names;

Change 93

ChangedArticle 44 – paragraph 1 – subparagraph 1:2: EPRIS shall dispatch the request for a query to the Member States’ national police records indexes with the data submitted by the requesting Member State or Europol and in accordance with this Regulation.

Change 94

ChangedArticle 44 – paragraph 3: 3. Any matches resulting from the query in each requested Member State’s police recordrecords indexindexes shall be sent back in an automated manner to EPRIS.

Change 95

ChangedArticle 44 – paragraph 4: 4. The list of matches shall be returned to the requesting Member State and Europol by EPRIS. The list of matches shall indicate the quality of the matchesmatch as well as the Member State or Member States whose database or databases contain data that resulted in the matches.match or matchees.

Change 96

ChangedArticle 44 – paragraph 6 – subparagraph 1:2: Upon confirmation, the requested Member State or Member StatesState(s) shall share the data referred to in Article 43 where available. This exchange of data shall take place via SIENA.

Change 97

RemovedArticle 44 – paragraph 7: 7. The Commission shall adopt an implementing act to specify the technical procedure for EPRIS to query Member States’ databases and the format of the replies. That implementing act shall be adopted in accordance with the procedure referred to in Article 76(2).

Change 98

ChangedArticle 45 – paragraph 3 – subparagraph 1:2: Those logs shall be protected by appropriate measures against unauthorised access and erased twothree years after their creation.

Change 99

ChangedArticle 46 – paragraph 1: 1. Where it is technically impossible to use EPRIS to query one or several national police records indexes because of a failure of the infrastructure of Europol, Member States shall be notified in an automated manner by Europol. Europol shall take measures to address the technical impossibility to use EPRIS withoutin delay.a timely manner.

Change 100

ChangedArticle 46 – paragraph 2: 2. Where it is technically impossible to use EPRIS to query one or several national police records indexesdatabases because of a failure of the national infrastructure in a Member State, that Member State shall notify other participating Member States, Europol and the Commission in an automated manner. Member States shall take measures to address the technical impossibility to use EPRIS withoutin delay.a timely manner.

Change 101

ChangedArticle 47 – paragraph 1:1 1.– introductory part: Where the procedures referred to in Article 6, 7, 13 or 22 show a match between the data used for the search or comparison and data held in the database of the requested Member State(s), and upon manual confirmation of this match by qualified staff of the requesting Member State, the requested Member State shall return a set of core data via the router within 24 hours. Where a judicial authorisation is required under national law, the set of core data shall be returned within 72 hours. / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted)

Change 102

RemovedArticle 47 – paragraph 1 a (new): 1a. Where the confirmed match concerns identified data of a person, that set of core data, if available, shall contain the following data: / (a) first name(s); / (b) family name(s); / (c) alias(es) and previous used name(s); / (d) date of birth; / (e) nationality or nationalities; / (f) place and country of birth; / (g) gender; / (h) the date when and place where the biometric data were acquired; / (i) the criminal offence for which the biometric data were acquired; / (j) the criminal case number; / (k) the competent law enforcement authority responsible for the criminal case.

AddedArticle 47 – paragraph 1 – point a: deleted

RemovedArticle 47 – paragraph 1 b (new): 1b. Where the confirmed match concerns unidentified data or traces, that set of core data, if available, shall contain the following data: / (a) the date when and place where the biometric data were acquired; / (b) the criminal offence for which the biometric data were acquired; / (c) the criminal case number; / (d) the competent law enforcement authority responsible for the criminal case.

AddedArticle 47 – paragraph 1 – point b: deleted

RemovedArticle 47 – paragraph 1 c (new): 1c. The release of core data by the requested Member State shall not take place in an automated manner but be subject to the decision of a human, as required by Article 11 of Directive (EU) 2016/680.

AddedArticle 47 – paragraph 1 – point c: deleted

Change 103

ChangedArticle 49 – paragraph 1: 1. Without prejudice to any restrictions indicated by the provider of the information to Europol in accordance with Article 19(2) of Regulation (EU) 2016/794, Member States shall, in accordance with Regulation (EU) 2016/794, have access to, and be able to search via the router, biometric data which has been provided to Europol by third-countrythird authoritiescountries for the purposes of Article 18(2), points(a),points (a), (b) and (c), of Regulation (EU) 2016/794.

Change 104

ChangedArticle 49 – paragraph 2: 2. Where the search referred to in paragraph 1 results in a match between the data used for the search and third-country-sourced data held by Europol, the follow-up shall take place in accordance with Regulation (EU) 2016/794.

Change 105

ChangedArticle 50 – paragraph 1: 1. Where necessary to achieve itsthe objectives and carryset out its tasks, Europol shall, in accordanceArticle with3 of Regulation (EU) 2016/794, have access, for the purposes of Article 18(2), pointsEuropol (a)shall, andin (c),accordance ofwith Regulation (EU) 2016/794, have access to data which are stored by Member States in their national databases and police records indexes in accordance with this Regulation.

Change 106

ChangedArticle 50 – paragraph 3:4: 3.4. Europol queries performed with vehicle registrationbiographical data as referred to in Article 1825 as a search criterion shall be carried out using Eucaris.EPRIS.

Change 107

ChangedArticle 50 – paragraph 4:5: 4.5. Europol queriesshall performedcarry without the biographicalsearches datain ofaccordance suspectswith andparagraph convicted1 personsof asthis referredArticle toonly infor Articlesthe 25purpose andof 26Article as18(2), apoint search(a), criterionof shallRegulation be(EU) carried2016/794, when carrying out usingits EPRIS.tasks referred to in Regulation (EU) 2016/794.

Change 108

RemovedArticle 50 – paragraph 5: deleted

AddedArticle 50 – paragraph 6 – introductory part: 6. Where the procedures referred to in Article 6, 7, 13 or 22 show a match between the data used for the search or comparison and data held in the national database of the requested Member State(s), and upon human review of that match by qualified staff of Europol in accordance with this Regulation and the transmission of the name of the third country which provided the data, the requested Member State shall decide whether to return a set of core data via the router within 24 hours. Where a judicial authorisation is required under national law, the core data shall be returned within 72 hours. That set of core data, if available, shall contain the following data:

Change 109

ChangedArticle 50 – paragraph 67: –7. introductoryEuropol's part:use 6.of Whereinformation theobtained proceduresfrom referreda tosearch made in Articleaccordance 6,with 7,paragraphs 131 orand 225, showand afrom matchthe betweenexchange theof datacore useddata forin theaccordance searchwith orparagraph comparison6, andshall databe heldsubject into the national databaseconsent of the requested Member State(s), and uponState manualin confirmationwhose ofdatabase thatthe match byoccurred. Europol,If the requested Member State shall decide whether to return a set of core data viaallows the router within 24 hours. Where a judicial authorisation isuse requiredof undersuch nationalinformation, law,its thehandling coreby dataEuropol shall be returned within 72 hours. That set of core data, if available, shallgoverned containby theRegulation following(EU) data:2016/794.

Change 110

RemovedArticle 50 – paragraph 7: 7. Europol's use of information obtained from a search made in accordance with paragraph 1 and from the exchange of core data in accordance with paragraph 6 shall be subject to the consent of the Member State in whose database the match occurred. If the Member State allows the use of such information, its handling by Europol shall be governed by Regulation (EU) 2016/794.

Change 111

ChangedArticle 51 – paragraph 1: 1. Processing of personal data received by the requesting Member State or Europol shall be permitted solely for the purposes for which the data have been supplied by the requested Member State.State Processingin accordance with this Regulation. Without prejudice to Directive (EU) 2016/680 or Regulation (EU) 2018/1725, as applicable, processing for other purposes shall be permitted solely with the prior authorisation of the requested Member State or Europol, as relevant.

Change 112

ChangedArticle 51 – paragraph 2 – point a a (new): (aa) exchange a set of core data in accordancepursuant withto Article 47;

Change 113

ChangedArticle 51 – paragraph 3: 3. The personal data received by the requesting Member State or Europol shall be deleted immediately following data comparison or automated replies to searches unless further processing is necessary by the requesting Member State is strictly necessary and proportionate for the purposes of the prevention, detection and investigation of criminal offences.

Change 114

ChangedArticle 5251 – paragraph 1: 1. Member States and Europol shall ensure the accuracy and current4: relevance4. ofData personalsupplied datain whichaccordance arewith processedArticle pursuant18 tomay thisbe Regulation.used Shouldby athe requestedrequesting Member State or Europol become aware that incorrect data or data which should not have been supplied have beensolely supplied,where this shallis bestrictly notifiednecessary withoutand delayproportionate to anyachieve requestingthe Memberpurposes State.of Allthis requestingRegulation. MemberThe Statesdata concernedsupplied shall be obliged to correct or delete the data accordinglydeleted withoutimmediately unduefollowing delay.automated Moreover,replies personalto datasearches suppliedunless shallfurther beprocessing correctedis ifnecessary theyfor arerecording foundpursuant to be incorrect.Article If20. theThe requesting Member State or Europol has reason to believeshall thatuse the supplied data arereceived incorrectin ora shouldreply besolely deletedfor the requestedprocedure Memberfor Statewhich shallthe besearch informed.was made.

Change 115

AddedArticle 51 – paragraph 4 a (new): 4a. Prior to connecting their national databases to the router, EPRIS or Eucaris, Member States shall conduct a data protection impact assessment as referred to in Article 27 of Directive (EU) 2016/680 and consult the supervisory authority as referred to in Article 28 of that Directive. The supervisory authority may use any of its powers referred to in Article 47 of Directive (EU) 2016/680, in accordance with paragraph 5 of Article 28 of that Directive.

AddedArticle 51 – paragraph 4 b (new): 4b. Member States shall ensure that data subjects are provided with information pursuant to Article 13 of Directive (EU) 2016/680 to allow them to exercise their rights.

AddedArticle 51 – paragraph 4 c (new): 4c. The European Data Protection Board shall issue guidelines on the implementation of Directive (EU) 2016/680 concerning the criminal databases and cross-border exchanges of personal data, in particular concerning accuracy, strict necessity and how to ensure respect for the right to data protection.

AddedArticle 52 – paragraph 1: 1. Member States and Europol shall ensure the accuracy and current relevance of personal data which are processed pursuant to this Regulation. Should a requested Member State or Europol become aware that data that are incorrect or no longer up to date or data which should not have been supplied have been supplied, this shall be notified without delay to any requesting Member State. All requesting Member States concerned shall be obliged to correct or delete the data accordingly without delay. Moreover, personal data supplied shall be corrected if they are found to be incorrect. If the requesting Member State or Europol has reason to believe that the supplied data are incorrect or should be deleted the requested Member State shall be informed without delay.

AddedArticle 52 – paragraph 1 – subparagraph 1 a (new): Member States and Europol shall put in place appropriate measures for updating their databases, including as regards acquittals of persons whose personal data are in the databases.

Change 116

ChangedArticle 52 – paragraph 3 – subparagraph 1 – point b: (b) following the expiry of the maximum period for keeping data laid down under the national law of the requested Member State where the requested Member State or Europol informed the requesting Member State of that maximum period at the time of supplying the data;

Change 117

ChangedArticle 52 – paragraph 3 – subparagraph 1 – point b a (new): (ba) following the expiry of the maximum period for keeping data laid down in Regulation (EU) 2016/794.

Change 118

ChangedArticle 52 – paragraph 3 – subparagraph 1:2: Where there is reason to believe that the deletion of data would prejudice the interests of the data subject, the data shall be restricted instead of being deleted. Restricted data shall be processed solely for the purpose which prevented their deletion.

Change 119

RemovedArticle 55 – paragraph 3 – subparagraph 1: Without prejudice to Article 34 of Regulation (EU) 2016/794 and Article 92 of Regulation (EU) 2018/1725, Europol shall notify CERT-EU of significant cyber threats, significant vulnerabilities and significant incidents without undue delay and in any event no later than 24 hours after becoming aware of them. Actionable and appropriate technical details of cyber threats, vulnerabilities and incidents that enable proactive detection, incident response or mitigating measures shall be disclosed to CERT-EU without undue delay.

AddedArticle 55 – paragraph 2: 2. Security incidents shall be managed in close cooperation between the Member States concerned or Europol and eu-LISA, as relevant, so as to ensure a quick, effective and proper response.

Change 120

ChangedArticle 55 – paragraph 3 – subparagraph 2: In the event of a security incident inWithout relationprejudice to the centralArticle infrastructure34 of the router and without prejudice toRegulation Articles(EU) 342016/794 and Article 92 of Regulation (EU) 2018/1725, eu-LISAEuropol shall notify CERT-EU of significant cyber threats, significant vulnerabilities and significant incidents without undue delay and in any event no later than 24 hours after becoming aware of them. Actionable and appropriate technical details of cyber threats, vulnerabilities and incidents that enable proactive detection, incident response or mitigating measures shall be disclosed to CERT-EU without undue delay.

Change 121

RemovedArticle 56 – paragraph 1: 1. Member States shall ensure that each authority entitled to use Prüm II takes the measures necessary to monitor its compliance with this Regulation and cooperates, where necessary, with the supervisory authority.

AddedArticle 55 – paragraph 3 – subparagraph 3: In the event of a security incident in relation to the central infrastructure of the router and without prejudice to Article 92 of Regulation (EU) 2018/1725, eu-LISA shall notify CERT-EU of significant cyber threats, significant vulnerabilities and significant incidents without undue delay and in any event no later than 24 hours after becoming aware of them. Actionable and appropriate technical details of cyber threats, vulnerabilities and incidents that enable proactive detection, incident response or mitigating measures shall be disclosed to CERT-EU without undue delay.

Change 122

ChangedArticle 5655 – paragraph 15 –a subparagraph(new): 15a. (new):This EuropolArticle shallis takewithout prejudice to the measuresreporting necessaryobligations pursuant to monitorArticles its92 complianceand with93 thisof Regulation and(EU) shall2018/1725 cooperate,and whereArticles necessary,30 withand the31 Europeanof DataDirective Protection(EU) Supervisor.2016/680.

Change 123

ChangedArticle 56 – paragraph 2: 2.1: The1. dataMember controllersStates shall takeensure thethat necessaryeach measuresauthority entitled to monitoruse thePrüm complianceII oftakes datathe processingmeasures pursuantnecessary to thismonitor Regulation,includingits throughcompliance frequentwith verificationthis ofRegulation theand logscooperates, referredwhere tonecessary, inwith Articlesthe 20,supervisory 40authority. andEuropol 45,shall andtake cooperate,the wheremeasures necessary andto asmonitor appropriate,its withcompliance thewith supervisorythis authoritiesRegulation and shall cooperate, where necessary, with the European Data Protection Supervisor.

Change 124

ChangedArticle 6156 – paragraph 1:2: 1.2. The supervisorydata authoritiescontrollers andshall implement the Europeannecessary Datatechnical Protectionand Supervisororganisational shall,measures eachto actingensure withineffective supervision and monitor the scopecompliance of theirdata respectiveprocessing competences,pursuant cooperateto activelythis withinRegulation, theincluding frameworkthrough offrequent theirverification respectiveof responsibilitiesthe tologs ensurereferred theto coordinatedin supervisionArticles of20, the40 applicationand of45 thisconcerning Regulation,the inadmissibility particularof ifqueries, the Europeanlawfulness Dataof Protectiondata Supervisorprocessing orand adata supervisorysecurity authorityand findsintegrity, majorand discrepanciescooperate, betweenwhere practicesnecessary ofand Memberas Statesappropriate, orwith findsthe potentiallysupervisory unlawfulauthorities transfersand usingwith the PrümEuropean IIData communicationProtection channels.Supervisor.

Change 125

RemovedArticle 62 – title: Transfer of personal data to third countries and international organisations

AddedArticle 56 – paragraph 2 a (new): 2a. The data controllers and Europol shall be provided with adequate human, financial and technical resources to fulfil their tasks pursuant to this Article.

Change 126

ChangedArticle 6258 – paragraph 1: 1.If Aany requestingfailure of a Member State shallto transfercomply anywith dataits itobligations hasunder obtainedthis inRegulation accordancecauses withdamage thisto Regulationthe torouter aor thirdEPRIS, countrythat orMember anState internationalshall organisationbe onlyliable infor accordancesuch withdamage, Chapterunless Vand ofin Directiveso (EU)far 2016/680as andeu-LISA, whereEuropol theor requestedanother Member State hasbound grantedby itsthis authorisationRegulation priorfailed to take reasonable measures to prevent the transfer.damage from occurring or to minimise the impact.

Change 127

ChangedArticle 6259 – paragraph 12: a2. (new):Without 1a.prejudice Europolto shallArticle transfer43(3) anyof dataRegulation it(EU) has2016/794, obtainedeu-LISA inand accordanceEuropol withshall thissupply Regulationinformation requested by the European Data Protection Supervisor to ait, thirdgrant countrythe orEuropean anData internationalProtection organisationSupervisor onlyaccess whereto all the conditionsdocuments laidit downrequests inand Articleto 25their oflogs Regulationreferred (EU)to 2016/794in areArticles fulfilled40 and 45 and allow the requestedEuropean MemberData StateProtection hasSupervisor grantedaccess itsto authorisationall priortheir premises at any time. This paragraph is without prejudice to the transfer.powers of the European Data Protection Supervisor pursuant to Article 58 of Regulation (EU) 2018/1725.

Change 128

RemovedArticle 63 – paragraph 1 – point g: (g) the management of, and arrangements for, access by the duly authorised staff of the competent national law enforcement authorities to the router in accordance with this Regulation and the creation and regular update of a list of those staff and their profiles;

AddedArticle 59 – paragraph 2 a (new): 2a. The European Data Protection Supervisor shall be provided with the staff and financial resources necessary to carry out the audits referred to in paragraph 1.

RemovedArticle 63 – paragraph 1 – point h: (h) the management of, and arrangements for, access by the duly authorised staff of the competent national law enforcement authorities to EPRIS in accordance with this Regulation and the creation and regular update of a list of those staff and their profiles;

AddedArticle 60 – paragraph 1: 1. The supervisory authorities and the European Data Protection Supervisor shall, each acting within the scope of their respective competences, cooperate actively within the framework of their respective responsibilities to ensure the coordinated supervision of the application of this Regulation, in particular if the European Data Protection Supervisor or a supervisory authority finds major discrepancies between practices of Member States or finds potentially unlawful transfers using the Prüm II communication channels.

RemovedArticle 63 – paragraph 1 – point i: (i) the management of, and arrangements for, access by the duly authorised staff of the competent national law enforcement authorities to Eucaris in accordance with this Regulation and the creation and regular update of a list of those staff and their profiles;

AddedArticle 60 – paragraph 3: 3. The European Data Protection Supervisor and the European Data Protection Board shall send a joint report of its activities under this Article to the European Parliament, to the Council, to the Commission, to Europol and to eu-LISA by 2 years after entry into operation of the router and EPRIS and every two years thereafter. That report shall include a chapter on each Member State prepared by the supervisory authority of the Member State concerned.

Change 129

ChangedArticle 6461 – paragraph 3:1 3.a Without(new): prejudiceEuropol toshall Articletransfer 26(6c)personal ofany Regulationdata (EU)it 2016/794has andobtained Europol’sin searchesaccordance pursuantwith this Regulation to Articlea 50(4)third ofcountry thisor Regulation,an Europolinternational shallorganisation notonly havewhere accessthe toconditions anylaid down in Article 25 of Regulation (EU) 2016/794 are fulfilled and the personalrequested dataMember processedState throughhas EPRIS.granted its authorisation prior to the transfer.

Change 130

RemovedArticle 66 – paragraph 1 – subparagraph 2: The router shall be developed and managed in such a way as to ensure fast, efficient and controlled access, full and uninterrupted availability of the router, and a response time in line with the operational needs of the competent law enforcement authorities of the Member States and Europol.

AddedArticle 61 a (new): Article 61 a / Relation to other legal acts on data protection / Any processing of personal data for the purposes of this Regulation shall be carried out in compliance with this Chapter and with Directive (EU) 2016/680, Regulation (EU) 2018/1725 or Regulation (EU) 2016/794, as applicable.

AddedArticle 62 – paragraph 1 – point g: (g) the management of, and arrangements for, access by the duly authorised staff of the competent national law enforcement authorities to the router in accordance with this Regulation and the creation and regular update of a list of those staff and their profiles;

AddedArticle 62 – paragraph 1 – point h: (h) the management of, and arrangements for, access by the duly authorised staff of the competent national law enforcement authorities to EPRIS in accordance with this Regulation and the creation and regular update of a list of those staff and their profiles;

AddedArticle 62 – paragraph 1 – point i: (i) the management of, and arrangements for, access by the duly authorised staff of the competent national law enforcement authorities to Eucaris in accordance with this Regulation and the creation and regular update of a list of those staff and their profiles;

AddedArticle 62 – paragraph 1 – point j: (j) the human confirmation by qualified staff of a match as referred to in Article 6(3), Article 7(3), Article 13(2) and Article 22(2);

Change 131

ChangedArticle 6867 – paragraph 1 – point 2 a (new), Article 19 – paragraph 1 – point ee a (new): (2a) in Article 19(1), the following point (eea) is added:added after point (ee): / (eea)‘(eea) adopt the reports on the state of play of the development of the router referred to in Article 35 of Regulation (EU) ../.. of the European Parliament and of the Council [2021/0410(COD)] pursuant to Article 79(2)78(2) of that Regulation;Regulation;’

Change 132

ChangedArticle 6867 – paragraph 1 – point 2 b (new), Article 19 – paragraph 1 – points ff andpoint hh:ff: (2b) in Article 19(1), pointspoint (ff) and (hh) areis replaced by the following:“following: / (ff)‘(ff) adopt the reports on the technical functioning of the following: / (i) SIS II pursuant to Article 50(4) of Regulation (EC) No 1987/2006 and Article 66(4) of Decision 2007/533/JHA;2007/533/JHA /respectively, (viii)of the routerVIS referredpursuant to in Article 3550(3) of Regulation (EU) ../..(EC) [2021/0410(COD)]No pursuant767/2008 toand Article 79(5)17(3) of that Regulation (EU) ../...; / (hh) adopt formal comments on the European Data Protection Supervisor’sDecision reports2008/633/JHA, onof the audits carried outEES pursuant to Article 45(2)72(4) of Regulation (EC) No 1987/2006, Article(EU) 42(2)2017/2226, of Regulation (EC)ETIAS Nopursuant 767/2008,to Article 31(2)92(4) of Regulation (EU) No 603/2013, Article2018/1240 56(2)and of Regulation (EU) 2017/2226, Article 67 ofthe Regulationrouter (EU)referred 2018/1240to andin Article 60(1)35 of Regulation (EU) ../.. [2021/0410(COD)] andpursuant ensureto appropriateArticle follow-up78(5) of thosethat audits;”Regulation (EU) ../...;

Change 133

AddedRegulation (EU) 2018/1726

AddedArticle 67 – paragraph 1 – point 2 c (new), Article 19 – paragraph 1 – point hh: (2c) in Article 19(1), point (hh) is replaced by the following: / ‘(hh) adopt formal comments on the European Data Protection Supervisor’s reports on its audits carried out pursuant to Article 56(2) of Regulation (EU) 2018/1861, Article 42(2) of Regulation (EC) No 767/2008, Article 31(2) of Regulation (EU) No 603/2013, Article 56(2) of Regulation (EU) 2017/2226, Article 67 of Regulation (EU) 2018/1240, Article 29(2) of Regulation (EU) 2019/816, Article 52 of Regulations (EU) 2019/817 and (EU) 2019/818 and Article 59(1) of Regulation (EU) ../.. [2021/0410(COD)] and ensure appropriate follow-up of those audits;”

Change 134

ChangedArticle 7069 – paragraph 1 – point 2, Article 39 – paragraph 1: 1. A central repository for reporting and statistics (CRRS) is established for the purposes of supporting the objectives of the SIS, Eurodac, ECRIS-TCN, in accordance with the respective legal instruments governing those systems, and to provide cross-system statistical data and analytical reporting for policy, operational and data quality purposes. The CRRS shall also support the objectives of Regulation (EU) … /… of the European Parliament and of the Council* [2021/0410(COD)].”[2021/0410(COD)]..”

Change 135

ChangedArticle 7069 – paragraph 1 – point 2, Article 39 – paragraph 2: “2. eu-LISA shall establish, implement and host in its technical sites the CRRS containing the data and statistics referred to in Article 74 of Regulation (EU) 2018/1862 and Article 32 of Regulation (EU) 2019/816 logically separated by EU information system. eu-LISA shall also collect the data and statistics from the router referred to in Article 71(1)70(1) of Regulation (EU) …/… * [this Regulation ]. Access to the CRRS shall be granted by means of controlled, secured access and specific user profiles, solely for the purpose of reporting and statistics, to the authorities referred to in Article 74 of Regulation (EU) 2018/1862, Article 32 of Regulation (EU) 2019/816 and Article 65(1)64(1) of Regulation (EU) …/… * [this Regulation ].”

Change 136

ChangedArticle 7170 – paragraph 1 – subparagraph 1 – introductory part: 1. The duly authorised staff of the competent law enforcement authorities of Member States, the Commission, Europol and eu-LISA shall have access to the following data related to the router, as relevant, solely for the purposes of reporting and statistics:

Change 137

ChangedArticle 7170 – paragraph 1 – subparagraph 1 – point a: (a) number of queries per Member State and by EuropolEuropol, per category of data;

Change 138

ChangedArticle 7170 – paragraph 1 – subparagraph 1 – point b: deleted

Change 139

ChangedArticle 7170 – paragraph 1 – subparagraph 1 – point f: (f) number of confirmed matches where there were exchanges of core data;

Change 140

ChangedArticle 7170 – paragraph 1 – subparagraph 1 – point f a (new): (fa)(f a) number of confirmed matches where there were no exchanges of core data; and

Change 141

RemovedArticle 71 – paragraph 1 – subparagraph 1: The data shall be aggregated. It shall not be possible to identify individuals from the data.

AddedArticle 70 – paragraph 1 – subparagraph 1 – point f b (new): (f b) number of unconfirmed matches; and

RemovedArticle 71 – paragraph 2 – introductory part: 2. The duly authorised staff of the competent law enforcement authorities of Member States, Europol and the Commission shall have access to consult the following data related to Eucaris, solely for the purposes of reporting and statistics:

AddedArticle 70 – paragraph 1 – subparagraph 2: The data shall be aggregated. It shall not be possible to identify individuals from the data.

RemovedArticle 71 – paragraph 2 – subparagraph 1: The data shall be aggregated. It shall not be possible to identify individuals from the data.

AddedArticle 70 – paragraph 2 – subparagraph 1 – introductory part: The duly authorised staff of the competent law enforcement authorities of Member States, Europol and the Commission shall have access to consult the following data related to Eucaris, solely for the purposes of reporting and statistics:

Change 142

ChangedArticle 7170 – paragraph 43 – subparagraph 1 – introductory part: 4.The eu-LISAduly shallauthorised storestaff of the datacompetent referredlaw toenforcement inauthorities paragraphof 1Member ofStates, thisthe ArticleCommission inand theEuropol centralshall repositoryhave foraccess reportingto andconsult statisticsthe establishedfollowing bydata Articlerelated 39to EPRIS, solely for the purposes of Regulationreporting (EU)and 2019/818.statistics:

Change 143

ChangedArticle 7170 – paragraph 4 – subparagraph 1: The dataeu-LISA shall allowstore the competent lawdata enforcementreferred authoritiesto ofin theparagraph Member1 States,of Europol,this eu-LISAArticle andin the Commission tocentral obtainrepository customisablefor reportsreporting and statistics toestablished enhancepursuant theto efficiencyArticle 39 of lawRegulation enforcement(EU) cooperation.2019/818.

Change 144

ChangedArticle 7370 – paragraph 1:4 1.– Membersubparagraph States2: shallThe notifydata eu-LISAshall ofallow the competent law enforcement authorities referredof tothe inMember ArticleStates, 36Europol, whicheu-LISA mayand usethe orCommission haveto accessobtain customisable reports and statistics to enhance the router.efficiency of law enforcement cooperation.

Change 145

ChangedArticle 7372 – paragraph 2 a (new):1: 2a.1. Member States shall notify the other Membereu-LISA States,of the Commission, eu-LISA andcompetent Europollaw ofenforcement theauthorities contentreferred ofto theirin nationalArticle DNA36, databaseswhich tomay whichuse Articlesor 5,have 6access andto 7the apply.router.

Change 146

ChangedArticle 7372 – paragraph 2 ba (new): 2b.2a. Each Member StatesState shall informnotify the other Member States, the Commission, eu-LISA and Europol of the content of theirits national dactyloscopicDNA databases to which Articles 125, 6 and 137 apply.

Change 147

ChangedArticle 7372 – paragraph 2 cb (new): 2c.2b. Each Member States shall inform the other Member States, the Commission, eu-LISA and Europol of the content of theirits national facial imagesdactyloscopic databases to which Articles 2112 and 2213 apply.

Change 148

ChangedArticle 7372 – paragraph 2 dc (new): 2d.2c. Each Member States participating in automated exchanges of police records pursuant to Articles 25 and 26 shall notifyinform the other Member States, the CommissionCommission, eu-LISA and Europol of the content of theirits national police records indexes, thefacial nationalimages databases used for the establishmentto ofwhich thoseArticles indexes21 and the conditions for automated22 searches.apply.

Change 149

ChangedArticle 7372 – paragraph 3:2 3.d (new): 2d. Member States shallparticipating notifyin theautomated Commission,exchanges Europolof andpolice eu-LISArecords ofpursuant theirto nationalArticles contact25 pointand designated26 pursuantshall tonotify Articlethe 29.other TheMember CommissionStates, shallthe compileCommission aand listEuropol of the content of its national contactpolice pointsrecords ofindexes, whichthe itnational hasdatabases beenused notifiedfor andthe makeestablishment itof availablethose toindexes alland Memberthe States.conditions for automated searches.

Change 150

ChangedArticle 7472 – paragraph 13: –3. introductoryMember part:States 1.shall Thenotify Commissionthe shallCommission, determineEuropol theand dateeu-LISA fromof whichtheir thenational Membercontact Statespoint anddesignated Europolpursuant mayto startArticle using29. theThe routerCommission byshall meanscompile a list of anthe implementingnational actcontact oncepoints theof followingwhich conditionsit havehas been met:notified and make it available to all Member States.

Change 151

RemovedArticle 74 – paragraph 1 – point b: (b) eu-LISA has declared the successful completion of a comprehensive test of the router, which it has conducted in cooperation with the Member States’ competent law enforcement authorities and Europol.

AddedArticle 73 – paragraph 1 – subparagraph 1 – introductory part: 1. The Commission shall determine the date from which the Member States and Europol may start using the router by means of an implementing act once the following conditions have been met:

RemovedArticle 74 – paragraph 1 – subparagraph 1: In that implementing act the Commission shall also determine the date from which the Member States and Europol shall start using the router. That date shall be one year after the date determined in accordance with the first subparagraph.

AddedArticle 73 – paragraph 1 – subparagraph 1 – point a: (a) the measures referred to in Article 5(2c), Article 10(3), Article 15(4), Article 19(3), Article 23a(3), Article 30 and Article 37(6) have been adopted;

RemovedArticle 74 – paragraph 1 – subparagraph 2: The Commission may postpone the date from which the Member States and the Union agencies are to start using the router by one year at most where an assessment of the implementation of the router has shown that such a postponement is necessary.

AddedArticle 73 – paragraph 1 – subparagraph 1 – point b: (b) eu-LISA has declared the successful completion of a comprehensive test of the router, which it has conducted in cooperation with the Member States’ competent law enforcement authorities and Europol.

Change 152

ChangedArticle 7473 – paragraph 21 – introductorysubparagraph part:2: 2.In Thethat implementing act the Commission shall also determine the date from which the Member States and Europol are toshall start using EPRISthe byrouter. meansThat ofdate anshall implementingbe actone onceyear after the followingdate conditionsdetermined havein beenaccordance met:with the first subparagraph.

Change 153

RemovedArticle 74 – paragraph 2 – point b: (b) Europol has declared the successful completion of a comprehensive test of EPRIS, which it has conducted in cooperation with the Member States’ competent law enforcement authorities.

AddedArticle 73 – paragraph 1 – subparagraph 3: The Commission may postpone the date from which the Member States and the Union agencies are to start using the router by one year at most where an assessment of the implementation of the router has shown that such a postponement is necessary.

RemovedArticle 74 – paragraph 3 – point b: (b) Europol has declared the successful completion of a comprehensive test of the connection, which it has conducted in cooperation with the Member States’ competent law enforcement authorities and eu-LISA.

AddedArticle 73 – paragraph 2 – introductory part: 2. The Commission shall determine the date from which the Member States and Europol are to start using EPRIS by means of an implementing act once the following conditions have been met:

Change 154

ChangedArticle 7473 – paragraph 42 – point b: (b) Europol has declared the successful completion of a comprehensive test of the connection,EPRIS, which it has conducted in cooperation with the Member States’ competent law enforcement authorities and eu-LISA.authorities.

Change 155

RemovedArticle 74 – paragraph 4 a (new): 4a. The implementing acts referred to in this Article shall be adopted in accordance with the procedure referred to in Article 76(2).

AddedArticle 73 – paragraph 3 – point b: (b) Europol has declared the successful completion of a comprehensive test of the connection, which it has conducted in cooperation with the Member States competent law enforcement authorities’ and eu-LISA.

RemovedArticle 79 – paragraph 1: 1. eu-LISA and Europol shall, respectively, ensure that procedures are in place to monitor the development of the router and of EPRIS in light of objectives relating to planning and costs and to monitor their functioning in light of objectives relating to the technical output, cost-effectiveness, security and quality of service.

AddedArticle 73 – paragraph 4 – point b: (b) Europol has declared the successful completion of a comprehensive test of the connection, which it has conducted in cooperation with the Member States’ competent law enforcement authorities and eu-LISA.

RemovedArticle 79 – paragraph 2 – introductory part: 2. By [one year after entry into force of this Regulation] and every year thereafter during the development phase of the router, eu-LISA shall submit a report to the European Parliament and to the Council on the state of play of the development of the router. That report shall contain detailed information about the costs incurred and information as to any risks which may impact the overall costs to be borne by the general budget of the Union in accordance with Article 72.

AddedArticle 73 – paragraph 4 a (new): 4a. The implementing acts referred to in this Article shall be adopted in accordance with the procedure referred to in Article 75(2).

Change 156

ChangedArticle 7978 – paragraph 10: 10. Without prejudice to confidentiality4: requirements4. andFor the protectionpurposes of ongoing investigations, Membertechnical States,maintenance, eu-LISA and Europol shall provide thehave Commissionaccess withto the information necessary to produce the evaluationsinformation referredrelating to in paragraph 7. Member States shallthe alsodata provideprocessing theoperations Commissionperformed within the numberrouter ofand confirmedEPRIS matchesrespectively. againstThat eachaccess Membershall State’sexclude databaseaccess perto categoryany ofpersonal data.

Change 157

AddedArticle 78 – paragraph 7 – subparagraph 1 – introductory part: Two years after the start of operations of the router and EPRIS as referred to in Article 73 and every four years thereafter, the Commission shall produce an overall evaluation of Prüm II, including:

AddedArticle 78 – paragraph 7 – subparagraph 1 – point a: (a) an assessment of the application of this Regulation for each Member State and Europol;

AddedArticle 78 – paragraph 7 – subparagraph 1 a (new): The Commission shall pay due attention to any Member State subject to a procedure referred to in Article 7 of the Treaty on the European Union

AddedArticle 78 – paragraph 8: 8. The Member States and Europol shall provide eu-LISA and the Commission with the information necessary to draft the reports referred to in paragraphs 2 and 5. This information shall not jeopardise working methods or include information that reveals sources, staff members or investigations of the competent law enforcement authorities.

AddedArticle 78 – paragraph 9: 9. The Member States shall provide Europol and the Commission with the information necessary to draft the reports referred to in paragraphs 3 and 6. This information shall not jeopardise working methods or include information that reveals sources, staff members or investigations of the competent law enforcement authorities.

AddedArticle 78 – paragraph 10: 10. Without prejudice to confidentiality requirements and the protection of ongoing investigations, Member States, eu-LISA and Europol shall provide the Commission with the information necessary to produce the evaluations referred to in paragraph 7. Member States shall also provide the Commission with the number of confirmed matches against each Member State’s database per category of data.