Shared biometric matching service
1. A shared biometric matching service (shared BMS) storing biometric templates obtained from the biometric data referred to in Article 13 that are stored in the CIR and SIS and enabling querying with biometric data across several EU information systems is established for the purposes of supporting the CIR and the MID and the objectives of the EES, VIS, Eurodac, SIS and ECRIS-TCN.
2. The shared BMS shall be composed of:
(a)
a central infrastructure, which shall replace the central systems of the EES, VIS, SIS, Eurodac and ECRIS-TCN respectively, to the extent that it shall store biometric templates and allow searches with biometric data;
(b)
a secure communication infrastructure between the shared BMS, Central SIS and the CIR.
3. eu-LISA shall develop the shared BMS and ensure its technical management.
Storing biometric templates in the shared biometric matching service
1. The shared BMS shall store the biometric templates, which it shall obtain from the following biometric data:
(a)
the data referred to in Article 16(1)(d), Article 17(1)(b) and (c) and Article 18(2)(a), (b) and (c) of Regulation (EU) 2017/2226;
(b)
the data referred to in point (6) of Article 9 of Regulation (EC) No 767/2008;
(c)
the data referred to in Article 20(2)(w) and (x), excluding data on palm prints, of Regulation (EU) 2018/1861;
(d)
the data referred to in Article 4(1)(u) and (v), excluding data on palm prints, of Regulation (EU) 2018/1860.
The biometric templates shall be stored in the shared BMS in logically separated form according to the EU information system from which the data originate.
2. For each set of data referred to in paragraph 1, the shared BMS shall include in each biometric template a reference to the EU information systems in which the corresponding biometric data are stored and a reference to the actual records in those EU information systems.
3. Biometric templates shall only be entered in the shared BMS following an automated quality check of the biometric data added to one of the EU information systems performed by the shared BMS to ascertain the fulfilment of a minimum data quality standard.
4. The storage of the data referred to in paragraph 1 shall meet the quality standards referred to in Article 37(2).
5. The Commission shall lay down, by means of an implementing act, the performance requirements and practical arrangements for monitoring the performance of the shared BMS in order to ensure that the effectiveness of biometric searches respect time-critical procedures such as border checks and identifications. That implementing act shall be adopted in accordance with the examination procedure referred to in Article 74(2).
Searching biometric data with the shared biometric matching service
In order to search the biometric data stored within the CIR and SIS, the CIR and SIS shall use the biometric templates stored in the shared BMS. Queries with biometric data shall take place in accordance with the purposes provided for in this Regulation and in Regulations (EC) No 767/2008, (EU) 2017/2226, (EU) 2018/1860, (EU) 2018/1861, (EU) 2018/1862 and (EU) 2019/816.
Data retention in the shared biometric matching service
The data referred to in Article 13(1) and (2) shall be stored in the shared BMS only for as long as the corresponding biometric data are stored in the CIR or SIS. The data shall be erased from the shared BMS in an automated manner.
Keeping of logs
1. Without prejudice to Article 46 of Regulation (EU) 2017/2226, Article 34 of Regulation (EC) No 767/2008 and Articles 12 and 18 of Regulation (EU) 2018/1861, eu-LISA shall keep logs of all data processing operations in the shared BMS. Those logs shall include the following:
(a)
the Member State or Union agency launching the query;
(b)
the history of the creation and storage of biometric templates;
(c)
the EU information systems queried with the biometric templates stored in the shared BMS;
(d)
the date and time of the query;
(e)
the type of biometric data used to launch the query;
(f)
the results of the query and date and time of the result.
2. Each Member State shall keep logs of queries that its authorities and the staff of those authorities duly authorised to use the shared BMS make. Each Union agency shall keep logs of queries that its duly authorised staff make.
3. The logs referred to in paragraphs 1 and 2 may be used only for data protection monitoring, including checking the admissibility of a query and the lawfulness of data processing, and for ensuring data security and integrity. Those logs shall be protected by appropriate measures against unauthorised access and erased one year after their creation. If, however, they are required for monitoring procedures that have already begun, they shall be erased once the monitoring procedures no longer require the logs.
Source: EUR-Lex (Publications Office of the EU), © European Union, reuse permitted under Commission Decision 2011/833/EU.
