Commission Implementing Decision (EU) 2019/328 of 25 February 2019 laying down measures for keeping and accessing the logs in the Entry/Exit System (EES)
Data as of 2026-07-04 · Compiled from an official source version. Later amendments or repeals may not be reflected; the official text prevails. · Read the official text ↗
The measures necessary for the technical implementation of the EES in relation to the procedures for keeping and accessing the logs in accordance with Article 46 of the Regulation (EU) 2017/2226 shall be as set out in the Annex to this Decision.
This Decision shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union .
ANNEX 1. KEEPING THE LOGS OF DATA PROCESSING OPERATIONS In this Annex, no distinction is made regarding the logs that could be stored at Entry/Exit Central System (CS-EES) level or at NUI level as all logs will be consolidated at CS-EES level. Each data processing operation within the EES shall be recorded as a log entry. The log entry shall have a specific field allowing for the identification of the operation performed including the purpose of access in accordance with Article 46(1) (a) of Regulation (EU)2017/2226. All data transmitted shall be logged; in case of VIS consultations, provisions laid down in Article 34 of Regulation (EC)767/2008 of the European Parliament and of the Council ( 1 ) shall also be applied. The log entry shall be recorded with the qualified electronic timestamp with the time and date the data was received. This timestamp shall later be used to identify the log entries to be deleted as per the retention period for each type of log in accordance with Article 46(4) of Regulation (EU) 2017/2226. For all data processing operations, a unique ID of the authority entering or retrieving the data shall be stored in the log entry. The authority and the central EES shall be specified in the log entry either as a sender or as a recipient. The data transmitted or used for interrogation referred to in Article 46(1) (c) and (d) of Regulation (EU) 2017/2226 shall be archived in the log. In the case of consultation of the overstayer report, the data referred to in Article 46(1) (a), (b) (d) and (e) of Regulation (EU) 2017/2226 shall be logged. Logs as referred to in Article 46 of Regulation (EU) 2017/2226, shall be recorded in the CS-EES. The CS-EES shall proceed daily to the deletion of log entries in accordance with Article 46(4) of Regulation (EU) 2017/2226. All logs pertaining to the same third-country national and corresponding to an operation ‘delete Files or Entry/Exit/Refusal Records’ or ‘automatic deletion’ shall be deleted one year after that deletion, unless identified as to be kept for data-protection monitoring purposes, in accordance with Article 46(4) of Regulation (EU) 2017/2226. Provisions for avoiding the deletion of the latter logs shall be created in a way as to flag each individual log and any associated log. Logs of data processing operations shall neither be modified nor deleted before one year after the expiration of the retention period referred to in Article 34 of Regulation (EU) 2017/2226. 2. ACCESSING THE LOGS OF DATA PROCESSING OPERATIONS Access to the logs kept by eu-LISA in accordance with Article 46 of Regulation (EU) 2017/2226 shall be restricted to duly authorised eu-LISA administrators of the EES, the European Data Protection Supervisor and the national supervisory authorities. Access to these logs shall likewise be traceable. This provision shall apply to logs recording access to the logs mutatis mutandis. ( 1 ) Regulation (EC) No 767/2008 of the European Parliament and of the Council of 9 July 2008 concerning the Visa Information System (VIS) and the exchange of data between Member States on short-stay visas (VIS Regulation) ( OJ L 218, 13.8.2008, p. 60 ).
Source: EUR-Lex (Publications Office of the EU), © European Union, reuse permitted under Commission Decision 2011/833/EU.