Changes from report parliamentary committee draft to plenary report

Change 82

RemovedArticle 34 – paragraph 1: 1. To the extent it is applicable, the universal message format (UMF) standard referred to in Article 38 of Regulation (EU)2019/817 shall be used in the development of the router referred to in Article 35 and EPRIS.

AddedArticle 33 – paragraph 3 – subparagraph 2: Those justifications shall be protected by appropriate measures against unauthorised access and erased three years after their creation. If, however, they are required for monitoring procedures that have already begun, they shall be erased once the monitoring procedures no longer require the justification.

Change 83

ChangedArticle 3533 – paragraph 1:4: 1.4. AFor routerthe ispurposes establishedof forfundamental therights purposesand ofdata facilitatingprotection monitoring, including checking the establishmentadmissibility of connectionsa betweenquery Memberand Statesthe andlawfulness withof Europoldata forprocessing, queryingthe with,data retrievingcontrollers andshall scoringhave biometricunrestricted dataaccess andto forthose retrievingjustifications alphanumericfor dataself-monitoring inas accordancereferred withto thisin Regulation.Article 56.

Change 84

RemovedArticle 35 – paragraph 2 – point b: (b) a secure communication channel between the central infrastructure, Member States’ competent law enforcement authorities authorised to use the router in accordance with Article 36 and Europol;

AddedArticle 34 – paragraph 1: 1. The universal message format (UMF) standard established under Article 38 of Regulation (EU)2019/818 shall be used in the development of the router referred to in Article 35 of this Regulation and EPRIS, to the extent it is applicable.

Change 85

ChangedArticle 3635 – paragraph 1: The1. useA ofrouter theis routerestablished shallfor bethe reservedpurposes toof thefacilitating Memberthe States’establishment competentof lawconnections enforcementbetween authoritiesMember thatStates, areand authorisedbetween toMember accessStates and exchangeEuropol, DNAfor profiles,querying dactyloscopicwith, dataretrieving and facial imagesscoring inbiometric accordancedata withand thisfor Regulationretrieving andalphanumeric Europoldata in accordance with Regulation (EU)this 2016/794.Regulation.

Change 86

RemovedArticle 37 – paragraph 1: 1. The competent law enforcement authorities authorised to access the router in accordance with Article 36 shall request a query by submitting biometric data to the router. The router shall dispatch the request for a query to the databases of the requested Member States and Europol data simultaneously with the data submitted by the user in accordance with his or her access rights.

AddedArticle 35 – paragraph 2 – point a: (a) a central infrastructure, including a search tool enabling the simultaneous querying of Member States’ databases referred to in Articles 5, 12 and 21 and Europol data;

AddedArticle 35 – paragraph 2 – point b: (b) a secure communication channel between the central infrastructure, Member States’ competent law enforcement authorities authorised to use the router in accordance with Article 36, and Europol;

AddedArticle 36 – paragraph 1: The use of the router shall be reserved to the Member States’ competent law enforcement authorities that are authorised to access and exchange DNA profiles, dactyloscopic data and facial images in accordance with this Regulation, and Europol in accordance with this Regulation and Regulation (EU) 2016/794 where they have a demonstrable need for such access. Member States and Europol shall ensure that their authorised staff have completed relevant training, including on data protection, confidentiality, detection of biases, as well as the accurate review of matches under the relevant data category.

AddedArticle 37 – paragraph 1: 1. The competent law enforcement authorities authorised to access the router pursuant to Article 36 shall request a query by submitting biometric data to the router. The router shall dispatch the request for a query to the databases of the requested Member States and Europol data simultaneously with the data submitted by the user in accordance with his or her access rights.

Article 37 – paragraph 2: 2. Upon receipt of a request for a query from the router, each requested Member State and Europol shall launch a query of their databases in an automated manner and without delay.

Change 87

ChangedArticle 37 – paragraph 3: 3. Any candidates resulting from queries as referred to in paragraph 2 shall be sent back in an automated manner to the router. The requesting Member State shall be notified in an automated manner where there is no match.

Article 37 – paragraph 4: 4. The router shall rank the replies in accordance with the score of the correspondence between the biometric data used for querying and the biometric data supplied by the requested Member States’ databases and Europol data.

Change 88

ChangedArticle 37 – paragraph 5: 5. The router shall return the list of matching biometric data and their scores to the requestingrouter Memberuser. State.That list shall be limited to the maximum number of candidates set out in the implementing act adopted pursuant to paragraph 6.

Change 89

ChangedArticle 37 – paragraph 6: 6. The CommissionCommission, after consulting the European Data Protection Board in accordance with Article 42(2) of Regulation 2018/1725, shall adopt an implementing actacts to specify the technical procedure for the router to query Member States’ databases and Europol data, the format of the router replies andreplies, the technical rules for scoring the correspondence between biometric data.data Thatand the relevant thresholds, as well as the maximum number of candidates that can be returned per search, with a view to ensuring accuracy, minimising the risk of misidentification and preventing discrimination. Those implementing actacts shall be adopted in accordance with the procedure referred to in Article 76(2).75(2).

Change 90

ChangedArticle 38 – paragraph 2:1: The requested Member State shall informcheck the requesting Member State, without delay,quality viaof the router where thetransmitted data areby unsuitablemeans forof an automated comparison.procedure.

Change 91

RemovedArticle 39 – paragraph 1: 1. Where designated authorities are authorised to use the router in accordance with Article 36, they may launch a query to Member States’ databases and Europol data simultaneously with a query to the Common Identity Repository, provided that the relevant conditions under Union law are fulfilled and that the query is launched in accordance with their access rights. For this purpose, the router shall query the Common Identity Repository via the European Search Portal.

AddedArticle 38 – paragraph 2: The requested Member State shall, without delay, inform the requesting Member State via the router where the data are unsuitable for an automated comparison.

RemovedArticle 39 – paragraph 2 – subparagraph 1: deleted

AddedArticle 39 – paragraph 1: 1. Where designated authorities are authorised to use the router pursuant to Article 36, they may launch a query to Member States’ databases and Europol data simultaneously with a query to the Common Identity Repository, provided that the relevant conditions under Union law are fulfilled and that the query is launched in accordance with their access rights. For this purpose, the router shall query the Common Identity Repository via the European Search Portal.

RemovedArticle 39 – paragraph 2 – subparagraph 2: Simultaneous queries of the Member States’ databases and Europol data and the Common Identity Repository may only be launched where there are reasonable grounds to believe that data on a suspect, perpetrator or victim of serious crime or terrorism are stored in the Common Identity Repository.

AddedArticle 39 – paragraph 2 – subparagraph 2: deleted

RemovedArticle 40 – paragraph 2 – introductory part: 2. Each Member State shall keep logs of queries that the staff of its competent law enforcement authorities duly authorised to use the router make as well as logs of queries requested by other Member States.

AddedArticle 39 – paragraph 2 – subparagraph 3: Simultaneous queries of the Member States’ databases and Europol data and the Common Identity Repository may only be launched where there are reasonable grounds to believe that data on a suspect, perpetrator or victim of a terrorist offence or other serious criminal offences as defined respectively in Article 4, points 21 and 22, of Regulation (EU) 2019/817 and Article 4, points 21 and 22, of Regulation (EU) 2019/818 are stored in the Common Identity Repository.

RemovedArticle 40 – paragraph 3 – subparagraph 1: Those logs shall be protected by appropriate measures against unauthorised access and erased two years after their creation. If, however, they are required for monitoring procedures that have already begun, they shall be erased once the monitoring procedures no longer require the logs.

AddedArticle 40 – title: Keeping of logs of all data processing operations in the router

RemovedArticle 41 – paragraph 1: 1. Where it is technically impossible to use the router to query one or several national databases or Europol data because of a failure of the router, the competent law enforcement authorities referred to in Article 36 and Europol shall be notified in an automated manner by eu-LISA. eu-LISA shall take measures to address the technical impossibility to use the router without delay.

AddedArticle 40 – paragraph 2 – subparagraph 1: Each Member State shall keep logs of queries that the staff of its competent law enforcement authorities duly authorised to use the router make as well as logs of queries requested by other Member States.

AddedArticle 40 – paragraph 3 – subparagraph 2: Those logs shall be protected by appropriate measures against unauthorised access and erased three years after their creation. If, however, they are required for monitoring procedures that have already begun, they shall be erased once the monitoring procedures no longer require the logs.

AddedArticle 41 – paragraph 1: 1. Where it is technically impossible to use the router to query one or several national databases or Europol data because of a failure of the router, the competent law enforcement authorities referred to in Article 36, and Europol shall be notified in an automated manner by eu-LISA. eu-LISA shall take measures to address the technical impossibility to use the router without delay.

▸4 unchanged paragraphs

Article 41 – paragraph 2: 2. Where it is technically impossible to use the router to query one or several national databases because of a failure of the national infrastructure in a Member State, that Member State shall notify the other Member States, Europol, eu-LISA and the Commission in an automated manner. The Member State concerned shall take appropriate measures to address the technical impossibility to use the router without delay.

Article 41 – paragraph 3: 3. Where it is technically impossible to use the router to query Europol data because of a failure of the infrastructure of Europol, Europol shall notify the Member States, eu-LISA and the Commission in an automated manner. Europol shall take appropriate measures to address the technical impossibility to use the router without delay.

Article 42 – paragraph 1: 1. For the automated searching of national police records indexes referred to in Article 26, Member States and Europol shall use the European Police Records Index System (EPRIS).

Article 43 – paragraph 1 – introductory part: 1. For the purposes of searching national police records indexes via EPRIS, at least two of the following sets of data shall be used:

Change 92

ChangedArticle 43 – paragraph 2 – point a: (a) alias(es) and previously used name(s);name or names;

Change 93

ChangedArticle 44 – paragraph 1 – subparagraph 1:2: EPRIS shall dispatch the request for a query to the Member States’ national police records indexes with the data submitted by the requesting Member State or Europol and in accordance with this Regulation.

Change 94

ChangedArticle 44 – paragraph 3: 3. Any matches resulting from the query in each requested Member State’s police recordrecords indexindexes shall be sent back in an automated manner to EPRIS.

Change 95

ChangedArticle 44 – paragraph 4: 4. The list of matches shall be returned to the requesting Member State and Europol by EPRIS. The list of matches shall indicate the quality of the matchesmatch as well as the Member State or Member States whose database or databases contain data that resulted in the matches.match or matchees.

Change 96

ChangedArticle 44 – paragraph 6 – subparagraph 1:2: Upon confirmation, the requested Member State or Member StatesState(s) shall share the data referred to in Article 43 where available. This exchange of data shall take place via SIENA.

Change 97

RemovedArticle 44 – paragraph 7: 7. The Commission shall adopt an implementing act to specify the technical procedure for EPRIS to query Member States’ databases and the format of the replies. That implementing act shall be adopted in accordance with the procedure referred to in Article 76(2).

Article 45 – paragraph 2: 2. Each participating Member State shall keep logs of the requests for queries that the staff of its competent law enforcement authorities duly authorised to use EPRIS make. Europol shall keep logs of requests for queries that its duly authorised staff make.

Change 98

ChangedArticle 45 – paragraph 3 – subparagraph 1:2: Those logs shall be protected by appropriate measures against unauthorised access and erased twothree years after their creation.

Change 99

ChangedArticle 46 – paragraph 1: 1. Where it is technically impossible to use EPRIS to query one or several national police records indexes because of a failure of the infrastructure of Europol, Member States shall be notified in an automated manner by Europol. Europol shall take measures to address the technical impossibility to use EPRIS withoutin delay.a timely manner.

Change 100

ChangedArticle 46 – paragraph 2: 2. Where it is technically impossible to use EPRIS to query one or several national police records indexesdatabases because of a failure of the national infrastructure in a Member State, that Member State shall notify other participating Member States, Europol and the Commission in an automated manner. Member States shall take measures to address the technical impossibility to use EPRIS withoutin delay.a timely manner.

Change 101

ChangedArticle 47 – paragraph 1:1 1.– introductory part: Where the procedures referred to in Article 6, 7, 13 or 22 show a match between the data used for the search or comparison and data held in the database of the requested Member State(s), and upon manual confirmation of this match by qualified staff of the requesting Member State, the requested Member State shall return a set of core data via the router within 24 hours. Where a judicial authorisation is required under national law, the set of core data shall be returned within 72 hours. / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted)

Change 102

RemovedArticle 47 – paragraph 1 a (new): 1a. Where the confirmed match concerns identified data of a person, that set of core data, if available, shall contain the following data: / (a) first name(s); / (b) family name(s); / (c) alias(es) and previous used name(s); / (d) date of birth; / (e) nationality or nationalities; / (f) place and country of birth; / (g) gender; / (h) the date when and place where the biometric data were acquired; / (i) the criminal offence for which the biometric data were acquired; / (j) the criminal case number; / (k) the competent law enforcement authority responsible for the criminal case.

AddedArticle 47 – paragraph 1 – point a: deleted

RemovedArticle 47 – paragraph 1 b (new): 1b. Where the confirmed match concerns unidentified data or traces, that set of core data, if available, shall contain the following data: / (a) the date when and place where the biometric data were acquired; / (b) the criminal offence for which the biometric data were acquired; / (c) the criminal case number; / (d) the competent law enforcement authority responsible for the criminal case.

AddedArticle 47 – paragraph 1 – point b: deleted

RemovedArticle 47 – paragraph 1 c (new): 1c. The release of core data by the requested Member State shall not take place in an automated manner but be subject to the decision of a human, as required by Article 11 of Directive (EU) 2016/680.

AddedArticle 47 – paragraph 1 – point c: deleted

AddedArticle 47 – paragraph 1 – point d: deleted

AddedArticle 47 – paragraph 1 – point e: deleted

AddedArticle 47 – paragraph 1 – point f: deleted

AddedArticle 47 – paragraph 1 a (new): Where the confirmed match concerns identified data of a person, the set of core data referred to in paragraph 1 shall, to the extent available, contain the following data: / (a) first name or names; / (b) family name or names; / (c) alias or aliases and previously used name or names; / (d) date of birth; / (e) nationality or nationalities; / (f) place and country of birth; / (g) gender; / (h) the date on which and the place where the biometric data were acquired; / (i) the criminal offence for which the biometric data were acquired; / (j) the criminal case number; / (k) the competent law enforcement authority responsible for the criminal case.

AddedArticle 47 – paragraph 1 b (new): Where the confirmed match concerns unidentified data or traces, the set of core data referred to in paragraph 1 shall, to the extent available, contain the following data: / (a) the date on which and the place where the biometric data were acquired; / (b) the criminal offence for which the biometric data were acquired; / (c) the criminal case number; / (d) the competent law enforcement authority responsible for the criminal case.

AddedArticle 47 – paragraph 1 c (new): The release of core data by the requested Member State shall be subject to the decision of a human.

AddedArticle 47 – paragraph 1 d (new): The requested Member State or States shall only refuse to share the core data where: / (a) the judicial authorisation required under the national law of the requested Member State was refused; / (b) there are objective reasons to believe sharing core data would disproportionately infringe the fundamental rights of the data subject; or / (c) there are objective reasons to believe sharing core data would jeopardise the success of an ongoing investigation of a criminal offence. / The justification for such refusals shall be provided promptly to the requesting Member State and in any event within the time limits provided in paragraph 1.

Article 48: deleted / (deleted) / (deleted)