Changes from report parliamentary committee draft to plenary report

Article 1 – paragraph 1: This Regulation establishes a framework for the exchange of information between Member States’ competent law enforcement authorities (Prüm II).

Change 13

ChangedArticle 1 – paragraph 2: This Regulation lays down the conditions and procedures for the automated searching of biometricDNA date,profiles, dactyloscopic data, facial images, police records and certain vehicle registration data and the rules regarding the exchange of core data following a confirmed match on biometric data.match.

Change 14

ChangedArticle 2 – paragraph 1: The purpose of Prüm II shall be to step up cross-border cooperation in matters covered by Part III, Title V, Chapter 5 of the Treaty on the Functioning of the European Union, particularly by facilitating the exchange of information between Member States’ competent law enforcement authorities.authorities, in full respect for the fundamental rights of natural persons, including the right to respect for one’s private life, and for the protection of personal data, in accordance with the Charter of Fundamental Rights of the European Union.

Change 15

ChangedArticle 2 – paragraph 2: The purpose of Prüm II shall also be to allow for the search for missing persons and the identification of unidentified human remains by Member States’ competent law enforcement authorities,authorities in the context of a criminal investigation, provided that those authorities have beenare empowered to conduct such searches and to carry out such identificationsidentification under national law.

Change 16

ChangedArticle 3 – paragraph 1: This Regulation applies to the databases, established in accordance with national databaseslaw and in compliance with, as applicable, Directive (EU) 2016/680, Regulation (EU) 2018/1725 or Regulation (EU) 2016/794, used for the automated transfer of the data categories of DNA profiles, dactyloscopic data, facial images, police records and certain vehicle registration data.

▸4 unchanged paragraphs

Article 4 – paragraph 1 – point 1: (1) ‘loci’ means DNA locations which contain identification characteristics of an analysed human DNA sample;

Article 4 – paragraph 1 – point 2: (2) ‘DNA profile’ means a letter or number code which represents a set of loci, or the particular molecular structure at the various loci;

Article 4 – paragraph 1 – point 3: deleted

Article 4 – paragraph 1 – point 5: (5) ‘identified DNA profile’ means the DNA profile of an identified person;

Change 17

ChangedArticle 4 – paragraph 1 – point 8 ba (new): (8b)(8a) ‘unidentified dactyloscopic data’ means the dactyloscopic data obtained from traces collected during the investigation of a criminal offence which belongsbelong to a person not yet identified;

Change 18

ChangedArticle 4 – paragraph 1 – point 10 a (new): (10a) ‘facial image reference data’ means thea facial image and theits reference number referred to in Article 23;

Change 19

ChangedArticle 4 – paragraph 1 – point 10 cb (new): (10c)(10b) ‘unidentified facial image’ means a facial image collected during the investigation of a criminal offence which belongs to a person not yet identified;

Article 4 – paragraph 1 – point 11 a (new): (11a) ‘alphanumeric data’ means data represented by letters, digits, special characters, spaces and punctuation marks;

Article 4 – paragraph 1 – point 12: (12) ‘match’ means the existence of a correspondence as a result of an automated comparison between personal data held by the requesting Member State and personal data recorded in a database of the requested Member State;

Article 4 – paragraph 1 – point 15: (15) ‘requested Member State’ means the Member State in whose databases the search is conducted through Prüm II by the requesting Member State;

Change 20

ChangedArticle 4 – paragraph 1 – point 16: (16) ‘police records’ means biographicbiographical information on suspectsregarding andpersons convicted personsor suspected of having committed a serious criminal offence available in the national databases established for the prevention, detection and investigation of criminal offences;

Change 21

ChangedArticle 4 – paragraph 1 – point 17: (17) ‘pseudonymisation’ means pseudonymisation as defined in Article 2,3, point (5), of Directive (EU) 2016/680;

Change 22

RemovedArticle 4 – paragraph 1 – point 17 a (new): (17a) ‘victim of serious crime or terrorism’ means a person that is adversely affected by an offence under national law which corresponds or is equivalent to one of the offences referred to in Directive (EU) 2017/541 of the European Parliament and of the Council or an offence which corresponds or is equivalent to one of the offences referred to in Article 2(2) of Council Framework Decision 2002/584/JHA, if it is punishable under national law by a custodial sentence or a detention order for a maximum period of at least three years;

AddedArticle 4 – paragraph 1 – point 17 a (new): (17a) ‘suspect’ means a person referred to in Article 6, point (a), of Directive (EU) 2016/680;

RemovedArticle 4 – paragraph 1 – point 17 b (new): “(17b) ‘designated authorities’ means the designated authorities as defined in Article 3(1), point (26), of Regulation (EU) 2017/2226 of the European Parliament and of the Council1a, Article 2(1), point (e), of Council Decision 2008/633/JHA1b, and Article 3(1), point (21), of Regulation (EU) 2018/1240 of the European Parliament and of the Council1c; / 1a Regulation (EU) 2017/2226 of the European Parliament and of the Council of 30 November 2017 establishing an Entry/Exit System (EES) to register entry and exit data and refusal of entry data of third-country nationals crossing the external borders of the Member States and determining the conditions for access to the EES for law enforcement purposes, and amending the Convention implementing the Schengen Agreement and Regulations (EC) No 767/2008 and (EU) No 1077/2011 (OJ L 327, 9.12.2017, p. 20). / 1b Council Decision 2008/633/JHA of 23 June 2008 concerning access for consultation of the Visa Information System (VIS) by designated authorities of Member States and by Europol for the purposes of the prevention, detection and investigation of terrorist offences and of other serious criminal offences (OJ L 218, 13.8.2008, p. 129). / 1c Regulation (EU) 2018/1240 of the European Parliament and of the Council of 12 September 2018 establishing a European Travel Information and Authorisation System (ETIAS) and amending Regulations (EU) No 1077/2011, (EU) No 515/2014, (EU) 2016/399, (EU) 2016/1624 and (EU) 2017/2226 (OJ L 236, 19.9.2018,…

AddedArticle 4 – paragraph 1 – point 17 b (new): (17b) ‘serious criminal offence’ means an offence referred to in Article 2(2) of Council Framework Decision 2002/584/JHA1a or in Article 3 of Regulation (EU) 2016/794, which is punishable in the requesting Member State by a custodial sentence or a detention order for a maximum period of at least three years; / 1a Council Framework Decision 2002/584/JHA of 13 June 2002 on the European arrest warrant and the surrender procedures between Member States (OJ L 190, 18.7.2002, p. 1).

AddedArticle 4 – paragraph 1 – point 17 c (new): (17c) ‘victim of serious crime or terrorism’ means a person that is adversely affected by an offence which corresponds or is equivalent to one of the offences referred to in Article 2(2) of Framework Decision 2002/584/JHA, if that offence is punishable under national law by a custodial sentence or a detention order for a maximum period of at least three years or an offence under national law which corresponds or is equivalent to one of the offences referred to in Directive (EU) 2017/541 of the European Parliament and of the Council1a; / 1a Directive (EU) 2017/541 of the European Parliament and of the Council of 15 March 2017 on combating terrorism and replacing Council Framework Decision 2002/475/JHA and amending Council Decision 2005/671/JHA (OJ L 88, 31.3.2017, p. 6).

AddedArticle 4 – paragraph 1 – point 17 d (new): (17d) ‘personal data’ means personal data as defined in Article 3, point (1), of Directive (EU) 2016/680;

AddedArticle 4 – paragraph 1 – point 17 e (new): (17e) ‘designated authorities’ means designated authorities as defined in Article 3(1), point (26), of Regulation (EU) 2017/2226 of the European Parliament and of the Council1a, Article 2(1), point (e), of Council Decision 2008/633/JHA1b, or Article 3(1), point (21), of Regulation (EU) 2018/1240 of the European Parliament and of the Council1c; / 1a Regulation (EU) 2017/2226 of the European Parliament and of the Council of 30 November 2017 establishing an Entry/Exit System (EES) to register entry and exit data and refusal of entry data of third-country nationals crossing the external borders of the Member States and determining the conditions for access to the EES for law enforcement purposes, and amending the Convention implementing the Schengen Agreement and Regulations (EC) No 767/2008 and (EU) No 1077/2011 (OJ L 327, 9.12.2017, p. 20). / 1b Council Decision 2008/633/JHA of 23 June 2008 concerning access for consultation of the Visa Information System (VIS) by designated authorities of Member States and by Europol for the purposes of the prevention, detection and investigation of terrorist offences and of other serious criminal offences (OJ L 218, 13.8.2008, p. 129). / 1c Regulation (EU) 2018/1240 of the European Parliament and of the Council of 12 September 2018 establishing a European Travel Information and Authorisation System (ETIAS) and amending Regulations (EU) No 1077/2011, (EU) No 515/2014, (EU) 2016/399, (EU) 2016/1624 and (EU) 2017/2226 (OJ L 236, 19.9.2018, p. 1)…

Article 4 – paragraph 1 – point 18: (18) ‘Europol data’ means any operational personal data processed by Europol in accordance with Regulation (EU) 2016/794;

Change 23

ChangedArticle 4 – paragraph 1 – point 18 a (new): (18a) 'competent law enforcement authority' means any police, customs or other authority of athe Member StateStates competent under national law to exercise authority and to take coercive measures for the purpose of preventing, detecting or investigating criminal offences;

Change 24

ChangedArticle 4 – paragraph 1 – point 20: (20) ‘SIENA’ means the secure information exchange network application, managed by Europol in accordance with Regulation (EU) 2016/794, aimed at facilitating the exchange and ensuring the secure transmission of operational and strategic crime-related information;information between Member States and Europol;

▸4 unchanged paragraphs

Article 4 – paragraph 1 – point 21: (21) ‘significant incident’ means significant incident as defined in Article 3, point (7), of Regulation (EU) .../... of the European Parliament and of the Council1a [2022/0085(COD)]; / 1a Regulation (EU) .../... of the European Parliament and of the Council laying down measures for a high common level of cybersecurity at the institutions, bodies, offices and agencies of the Union (OJ...).

Article 4 – paragraph 1 – point 22: (22) ‘significant cyber threat’ means significant cyber threat as defined in Article 3, point (11), of Regulation (EU) .../... [2022/0085(COD];

Article 4 – paragraph 1 – point 23: (23) ‘significant vulnerability’ means significant vulnerability as defined in Article 3, point (13) of Regulation (EU) .../... [2022/0085(COD];

Article 5 – title: Establishment of national DNA databases

Change 25

ChangedArticle 5 – paragraph 1 – introductorysubparagraph part:1: 1. Member States shall open and keep national DNA databases for the prevention, detection and investigation of criminal offences.

Change 26

ChangedArticle 5 – paragraph 1 – subparagraph 1:2: Processing of data kept in those databases, under this Regulation, shall be carried out in accordance with this Regulation and in compliance with the national law of the Member States applicable to the processing of those data.

Change 27

ChangedArticle 5 – paragraph 2 – introductorysubparagraph part:1: 2. Member States shall ensure the availability of DNA reference data from their national DNA databases as referred to in paragraph 1 for the purposes of automated searches by other Member States pursuant to this Regulation.

Change 28

ChangedArticle 5 – paragraph 2 – subparagraph 1:2: DNA reference data shall not contain any additional nominal data from which an individual can be directly identified.

Change 29

ChangedArticle 5 – paragraph 2 – subparagraph 2:3: Unidentified DNA profiles shall be recognisable as such.

Change 30

ChangedArticle 5 – paragraph 2 a2a (new): 2a. The Commission shall adopt an implementing act to specify the identification characteristics of a DNA profile which is to be exchanged and the minimum requirements for a match, taking into account international and European standards. That implementing act shall be adopted in accordance with the procedure referred to in Article76(2).Article 75(2).

Change 31

ChangedArticle 6 – paragraph 1 – introductory part:subparagraph 1.1: For the prevention, detection and investigation of criminal offences, Member States shall allow national contact points of other Member States and Europol to conduct automated searchesaccess ofto the DNA profilesreference data in their DNA databases established for that purpose in order to conduct automated searches of the DNA profiles in those databases and to compare those DNA profiles with their DNA profiles.

Change 32

ChangedArticle 6 – paragraph 1 – subparagraph 1:2: Searches shall only be conducted in individual cases, where they are proportionate and necessary for the purposesinvestigation of preventing, detecting or investigating a criminal offence, and in compliance with the national law of the requesting Member State.

Change 33

ChangedArticle 6 – paragraph 2 – introductory part:subparagraph 2.1: Should an automated search show that a supplied DNA profile matches DNA profiles stored in the requested Member State's searched database or databases, the national contact point of the requesting Member State shall receive in an automated way the DNA reference data with which a match has been found.

Change 34

ChangedArticle 6 – paragraph 2 – subparagraph 1:2: deleted

Change 35

ChangedArticle 6 – paragraph 3: 3. The national contact point of the requesting Member State shall manuallyensure that a human review by a forensic expert is conducted in order to confirm a match of DNA profile data with DNA reference data held by the requested Member State following the automated supply of the DNA reference data required for confirming a match.

Article 7 – paragraph 1: 1. Member States may, via their national contact points, compare the DNA profiles of their unidentified DNA profiles with all DNA profiles from other national DNA databases for the investigation of criminal offences. Profiles shall be supplied and compared in an automated manner.

Change 36

ChangedArticle 7 – paragraph 2: 2. Should a requested Member State, as a result of the comparison referred to in paragraph 1, find that any DNA profiles supplied match any of those in its DNA databases, it shallshall, ,withoutwithout delay, supply the national contact point of the requesting Member State with the DNA reference data with which a match has been found.

Change 37

ChangedArticle 7 – paragraph 3: 3. TheA confirmationhuman ofreview by a forensic expert to confirm a match of DNA profiles with DNA reference data held by the requested Member State shall be carried out manually by the national contact point of the requesting Member State following the automated supply of the DNA reference data required for confirming a match.

Change 38

ChangedArticle 8:8 – paragraph 1: deleted / (deleted) / (deleted)

Article 9 – paragraph 1 – point a: (a) a reference number allowing Member States, in case of a match, to retrieve further data and other information in their databases referred to in Article 5 in order to supply it to one, several or all of the other Member States in accordance with Article 47 or to Europol in accordance with Article 50(6);

Change 39

ChangedArticle 9 – paragraph 1 – point a a (new): (aa) a reference number allowing Europol, in case of a match, to retrieve further data and other information for the purposes of Article 49(1) of this Regulation in order to supply them or it to one, several or all Member States in accordance with Regulation (EU) 2016/794;

Article 9 – paragraph 1 – point c: (c) a code to indicate the type of DNA profile (identified DNA profiles or unidentified DNA profiles).

Change 40

ChangedArticle 10 – paragraph 1: 1. Member States and, where applicable, Europol shall take all appropriate measures to ensure confidentiality and integrity for DNA reference data being sent to other Member States or Europol, including their encryption.

Change 41

ChangedArticle 10 – paragraph 2: 2. Member States and Europol shall take the necessary measures to guarantee the integrity and minimum quality standards of the DNA profiles made available or sent for comparison to the other Member States and to ensure that those measures comply with the relevant European or international standards for DNA data exchange.

Change 42

ChangedArticle 10 – paragraph 3: 3. The Commission shall adopt an implementing act to establish minimum quality requirements to be met by DNA reference data and toacts specifyspecifying the relevant European or international standards that are to be used by Member States and Europol for DNA reference data exchange.exchange, Thatincluding the minimum quality standard to be met by DNA profiles. Those implementing actacts shall be adopted in accordance with the procedure referred to in Article 76(2).75(2).

Article 11 – paragraph 1 – point d: (d) the types of DNA profiles transmitted (unidentified DNA profiles or identified DNA profiles).

Article 11 – paragraph 2 – point f: (f) the type of DNA profiles transmitted (unidentified DNA profiles or identified DNA profiles);

Change 43

ChangedArticle 11 – paragraph 3: 3. Automated notification of a match shall only be provided if the automated search or comparison has resulted in a match of a minimum number of loci. The CommissionCommission, after consulting the European Data Protection Board in accordance with Article 42(2) of Regulation (EU) 2018/1725, shall adopt an implementing actacts to specify this minimum number of loci, in accordance with the procedure referred to in Article 76(2).75(2) of this Regulation.

Change 44

ChangedArticle 11 – paragraph 5: 5. Member States shall ensure that requests are consistent with notifications sent pursuant to Article 73(2a).72(2a). Those notifications shall be reproduced in the practical handbook referred to in Article 78.77.

Article 12 – paragraph 1: 1. Member States shall ensure the availability of dactyloscopic reference data from their national database or databases established for the prevention, detection and investigation of criminal offences.

Change 45

ChangedArticle 12 – paragraph 2: 2. Dactyloscopic reference data shall not contain any additional nominal data from which an individual can be directly identified.

Change 46

ChangedArticle 12 – paragraph 3: 3. Unidentified dactyloscopic data shall be recognisable as such.such

Change 47

ChangedArticle 13 – paragraph 1 – introductory part:subparagraph 1.1: For the prevention, detection and investigation of criminal offences, Member States shall allow national contact points of other Member States and Europol access to the dactyloscopic reference data in their national databases established for that purpose, to conduct automated searches by comparing dactyloscopic reference data.