Reporting and statistics
1. The duly authorised staff of the competent authorities of Member States, the Commission and eu-LISA shall have access to consult, solely for the purposes of reporting and statistics, the number of queries per ESP user profile.
It shall not be possible to identify individuals from the data.
2. The duly authorised staff of the competent authorities of Member States, the Commission and eu-LISA shall have access to consult the following data related to the CIR, solely for the purposes of reporting and statistics:
(a)
number of queries for the purposes of Articles 20, 21 and 22;
(b)
nationality, gender and year of birth of the person;
(c)
the type of the travel document and the three-letter code of the issuing country;
(d)
the number of searches conducted with and without biometric data.
It shall not be possible to identify individuals from the data.
3. The duly authorised staff of the competent authorities of Member States, the Commission and eu-LISA shall have access to consult the following data related to the MID, solely for the purposes of reporting and statistics:
(a)
the number of searches conducted with and without biometric data;
(b)
the number of each type of link and the EU information systems containing the linked data;
(c)
the period of time for which a yellow and red link remained in the system.
It shall not be possible to identify individuals from the data.
4. The duly authorised staff of the European Border and Coast Guard Agency shall have access to consult the data referred to in paragraphs 1, 2 and 3 of this Article for the purpose of carrying out risk analyses and vulnerability assessments as referred to in Articles 11 and 13 of Regulation (EU) 2016/1624 of the European Parliament and of the Council ( 38 ) .
5. The duly authorised staff of Europol shall have access to consult the data referred to in paragraphs 2 and 3 of this Article for the purpose of carrying out strategic, thematic and operational analyses as referred to in Article 18(2)(b) and (c) of Regulation (EU) 2016/794.
6. For the purpose of paragraphs 1, 2 and 3, eu-LISA shall store the data referred to in those paragraphs in the CRRS. It shall not be possible to identify individuals from the data included in the CRRS, but the data shall allow the authorities listed in paragraphs 1, 2 and 3 to obtain customisable reports and statistics to enhance the efficiency of border checks, to help authorities processing visa applications and to support evidence-based policy-making on migration and security in the Union.
7. Upon request, relevant information shall be made available by the Commission to the European Union Agency for Fundamental Rights in order to evaluate the impact of this Regulation on fundamental rights.
Transitional period for the use of the European search portal
1. For a period of two years from the date the ESP commences operations, the obligations referred to in Article 7(2) and (4) shall not apply and the utilisation of the ESP shall be optional.
2. The Commission is empowered to adopt a delegated act in accordance with Article 69 in order to amend this Regulation by extending the period referred to in paragraph 1 of this Article once, by no longer than one year, when an assessment of the implementation of the ESP has shown that such an extension is necessary, especially in view of the impact that bringing the ESP into operation would have on the organisation and length of border checks.
Transitional period applicable to the provisions on access to the common identity repository for the purposes of preventing, detecting or investigating terrorist offences or other serious criminal offences
Article 22 shall apply from the date of the start of operations of the CIR referred to in Article 68(3).
Transitional period for multiple-identity detection
1. For a period of one year following notification by eu-LISA of the completion of the test of the MID referred to in Article 68(4)(b) and before the start of operations of the MID, the ETIAS Central Unit shall be responsible for carrying out multiple-identity detection using the data stored in the EES, VIS, Eurodac and SIS. The multiple-identity detections shall be carried out using only biometric data.
2. Where the query reports one or several matches and the identity data in the linked files are the same or similar, a white link shall be created in accordance with Article 33.
Where the query reports one or several matches and the identity data in the linked files cannot be considered to be similar, a yellow link shall be created in accordance with Article 30 and the procedure referred to in Article 29 shall apply.
Where several matches are reported, a link shall be created between each piece of data triggering the match.
3. Where a yellow link is created, the MID shall grant access to the identity data present in the different EU information systems to the ETIAS Central Unit.
4. Where a link is created to an alert in SIS other than an alert created under Article 3 of Regulation (EU) 2018/1860, Articles 24 and 25 of Regulation (EU) 2018/1861, or Article 38 of Regulation (EU) 2018/1862, the MID shall grant access to the identity data present in the different information systems to the SIRENE Bureau of the Member State that created the alert.
5. The ETIAS Central Unit or, in the cases referred to in paragraph 4 of this Article the SIRENE Bureau of the Member State that created the alert, shall have access to the data contained in the identity confirmation file and shall assess the different identities and shall update the link in accordance with Articles 31, 32 and 33 and add it to the identity confirmation file.
6. The ETIAS Central Unit shall notify the Commission in accordance with Article 67(3) only once all yellow links have been manually verified and their status updated as either green, white or red links.
7. Member States shall assist the ETIAS Central Unit where necessary in carrying out multiple-identity detection under this Article.
8. The Commission is empowered to adopt a delegated act in accordance with Article 69 in order to amend this Regulation by extending the period referred to in paragraph 1 of this Article by six months, renewable twice by six months each time. Such an extension shall only be granted following an assessment of the estimated completion time for multiple-identity detection under this Article, which demonstrates that the multiple-identity detection cannot be completed before expiry of the period remaining either under paragraph 1 of this Article or any ongoing extension, for reasons independent of the ETIAS Central Unit, and that no corrective measures can be applied. The assessment shall be carried out no later than three months before the expiry of such period or ongoing extension.
Costs
1. The costs incurred in connection with the establishment and operation of the ESP, the shared BMS, the CIR and the MID shall be borne by the general budget of the Union.
2. Costs incurred in connection with the integration of the existing national infrastructures and their connection to the national uniform interfaces as well as in connection with hosting the national uniform interfaces shall be borne by the general budget of the Union.
The following costs shall be excluded:
(a)
Member States' project management office (meetings, missions, offices);
(b)
hosting of national IT systems (space, implementation, electricity, cooling);
(c)
operation of national IT systems (operators and support contracts);
(d)
design, development, implementation, operation and maintenance of national communication networks.
3. Without prejudice to further funding for this purpose from other sources of the general budget of the European Union, an amount of EUR 32 077 000 shall be mobilised from the envelope of EUR 791 000 000 foreseen under Article 5(5)(b) of Regulation (EU) No 515/2014 to cover the costs of implementation of this Regulation, as foreseen under paragraphs 1 and 2 of this Article.
4. From the envelope referred to in paragraph 3, EUR 22 861 000 shall be allocated to eu-LISA, EUR 9 072 000 shall be allocated to Europol and EUR 144 000 shall be allocated to the European Union Agency for Law Enforcement Training (CEPOL) to support these agencies in performing their respective under this Regulation. Such funding shall be implemented under indirect management.
5. The costs incurred by the designated authorities shall be borne by the designating Member States respectively. The costs of connecting each designated authority to the CIR shall be borne by each Member State.
The costs incurred by Europol, including of connection to the CIR, shall be borne by Europol.
Notifications
1. The Member States shall notify eu-LISA of the authorities referred to in Articles 7, 20, 21 and 26 that may use or have access to the ESP, the CIR and the MID respectively.
A consolidated list of those authorities shall be published in the Official Journal of the European Union within a period of three months from the date on which each interoperability component commenced operations in accordance with Article 68. Where there are amendments to the list, eu-LISA shall publish an updated consolidated list once a year.
2. eu-LISA shall notify the Commission of the successful completion of the tests referred to in Article 68(1)(b), (2)(b), (3)(b), (4)(b), (5)(b) and (6)(b).
3. The ETIAS Central Unit shall notify the Commission of the successful completion of the transitional period laid down in Article 65.
4. The Commission shall make the information notified pursuant to paragraph 1 available to the Member States and to the public, via a constantly updated public website.
Start of operations
1. The Commission shall determine the date from which the ESP is to start operations by means of an implementing act once the following conditions have been met:
(a)
the measures referred to in Articles 8(2), 9(7) and 43(5) have been adopted;
(b)
eu-LISA has declared the successful completion of a comprehensive test of the ESP, which it has conducted in cooperation with the Member States authorities and the Union agencies that may use the ESP;
(c)
eu-LISA has validated the technical and legal arrangements to collect and transmit the data referred to in Article 8(1) and has notified them to the Commission.
The ESP shall only query the Interpol databases once the technical arrangements allow compliance with Article 9(5). Any impossibility of complying with Article 9(5) shall have the result that the ESP does not query the Interpol databases but shall not delay the start of operations of the ESP.
The Commission shall set the date referred to in the first subparagraph to be within 30 days from adoption of the implementing act.
2. The Commission shall determine the date from which the shared BMS is to start operations by means of an implementing act once the following conditions have been met:
(a)
the measures referred to in Articles 13(5) and 43(5) have been adopted;
(b)
eu-LISA has declared the successful completion of a comprehensive test of the shared BMS, which it has conducted in cooperation with the Member States authorities;
(c)
eu-LISA has validated the technical and legal arrangements to collect and transmit the data referred to in Article 13 and has notified them to the Commission;
(d)
eu-LISA has declared the successful completion of the test referred to in paragraph 5(b).
The Commission shall set the date referred to in the first subparagraph to be within 30 days from adoption of the implementing act.
3. The Commission shall determine the date from which the CIR is to start operations by means of an implementing act once the following conditions have been met:
(a)
the measures referred to in Articles 43(5) and 74(10) have been adopted;
(b)
eu-LISA has declared the successful completion of a comprehensive test of the CIR, which it has conducted in cooperation with the Member States authorities;
(c)
eu-LISA has validated the technical and legal arrangements to collect and transmit the data referred to in Article 18 and has notified them to the Commission;
(d)
eu-LISA has declared the successful completion of the test referred to in paragraph 5(b).
The Commission shall set the date referred to in the first subparagraph to be within 30 days from adoption of the implementing act.
4. The Commission shall determine the date from which the MID is to start operations by means of an implementing act once the following conditions have been met:
(a)
the measures referred to in Articles 28(5) and (7), 32(5), 33(6), 43(5) and 49(6) have been adopted;
(b)
eu-LISA has declared the successful completion of a comprehensive test of the MID, which it has conducted in cooperation with the Member States authorities and the ETIAS Central Unit;
(c)
eu-LISA has validated the technical and legal arrangements to collect and transmit the data referred to in Article 34 and has notified them to the Commission;
(d)
the ETIAS Central Unit has notified the Commission in accordance with Article 67(3);
(e)
eu-LISA has declared the successful completion of the tests referred to in paragraphs 1(b), 2(b), 3(b) and 5(b).
The Commission shall set the date referred to in the first subparagraph to be within 30 days from adoption of the implementing act.
5. The Commission shall determine by means of implementing acts the date from which the automated data quality control mechanisms and procedures, the common data quality indicators and the minimum data quality standards are to be used, once the following conditions have been met:
(a)
the measures referred to in Articles 37(4) have been adopted;
(b)
eu-LISA has declared the successful completion of a comprehensive test of the automated data quality control mechanisms and procedures, the common data quality indicators and the minimum data quality standards, which it has conducted in cooperation with the Member States authorities.
The Commission shall set the date referred to in the first subparagraph to be within 30 days from adoption of the implementing act.
6. The Commission shall determine the date from which the CRRS is to start operations by means of an implementing act once the following conditions have been met:
(a)
the measures referred to in Articles 39(5) and 43(5) have been adopted;
(b)
eu-LISA has declared the successful completion of a comprehensive test of the CRRS, which it has conducted in cooperation with the Member States authorities;
(c)
eu-LISA has validated the technical and legal arrangements to collect and transmit the data referred to in Article 39 and has notified them to the Commission.
The Commission shall set the date referred to in the first subparagraph to be within 30 days from adoption of the implementing act.
7. The Commission shall inform the European Parliament and the Council of the results of the tests carried out pursuant to paragraphs 1(b), 2(b), 3(b), 4(b), 5(b) and 6(b).
8. Member States, the ETIAS Central Unit and Europol shall start using each of the interoperability components from the date determined by the Commission in accordance with paragraphs 1, 2, 3 and 4 respectively.
Exercise of the delegation
1. The power to adopt delegated acts is conferred on the Commission subject to the conditions laid down in this Article.
2. The power to adopt delegated acts referred to in Articles 28(5), 39(5), 49(6), 63(2) and 65(8) shall be conferred on the Commission for a period of five years from 11 June 2019. The Commission shall draw up a report in respect of the delegation of power not later than nine months before the end of the five-year period. The delegation of power shall be tacitly extended for periods of an identical duration, unless the European Parliament or the Council opposes such extension not later than three months before the end of each period.
3. The delegation of power referred to in Articles 28(5), 39(5), 49(6), 63(2) and 65(8) may be revoked at any time by the European Parliament or by the Council. A decision to revoke shall put an end to the delegation of the power specified in that decision. It shall take effect the day following the publication of the decision in the Official Journal of the European Union or at a later date specified therein. It shall not affect the validity of any delegated acts already in force.
4. Before adopting a delegated act, the Commission shall consult experts designated by each Member State in accordance with the principles laid down in the Interinstitutional Agreement of 13 April 2016 on Better Law-Making.
5. As soon as it adopts a delegated act, the Commission shall notify it simultaneously to the European Parliament and to the Council.
6. A delegated act adopted pursuant to Articles 28(5), 39(5), 49(6), 63(2) and 65(8) shall enter into force only if no objection has been expressed either by the European Parliament or the Council within a period of two months of notification of that act to the European Parliament and the Council or if, before the expiry of that period, the European Parliament and the Council have both informed the Commission that they will not object. That period shall be extended by two months at the initiative of the European Parliament or of the Council.
Committee procedure
1. The Commission shall be assisted by a committee. That committee shall be a committee within the meaning of Regulation (EU) No 182/2011.
2. Where reference is made to this paragraph, Article 5 of Regulation (EU) No 182/2011 shall apply.
Where the committee delivers no opinion, the Commission shall not adopt the draft implementing act and the third subparagraph of Article 5(4) of Regulation (EU) No 182/2011 shall apply.
Advisory Group
An Interoperability Advisory Group shall be established by eu-LISA. During the design and development phase of the interoperability components, Article 54(4), (5) and (6) shall apply.
Training
eu-LISA shall perform tasks related to the provision of training on the technical use of the interoperability components in accordance with Regulation (EU) 2018/1726.
Member States authorities and Union agencies shall provide their staff authorised to process data using the interoperability components, with appropriate training programmes concerning data security, data quality, data protection rules, the procedures applicable to data processing and the obligations to inform under Articles 32(4), 33(4) and 47.
Where appropriate, joint training courses on these topics shall be organised at Union level to enhance cooperation and the exchange of best practices between the staff of Member States authorities and Union agencies who are authorised to process data using the interoperability components. Particular attention shall be paid to the process of multiple-identity detection, including the manual verification of different identities and the accompanying need to maintain appropriate safeguards of fundamental rights.
Practical handbook
The Commission shall, in close cooperation with the Member States, eu-LISA and other relevant Union agencies, make available a practical handbook for the implementation and management of the interoperability components. The practical handbook shall provide technical and operational guidelines, recommendations and best practices. The Commission shall adopt the practical handbook in the form of a recommendation.
Monitoring and evaluation
1. eu-LISA shall ensure that procedures are in place to monitor the development of the interoperability components and their connection to the national uniform interface in light of objectives relating to planning and costs and to monitor the functioning of the interoperability components in light of objectives relating to the technical output, cost-effectiveness, security and quality of service.
2. By 12 December 2019 and every six months thereafter during the development phase of the interoperability components, eu-LISA shall submit a report to the European Parliament and to the Council on the state of play of the development of the interoperability components, as well as their connection to the national uniform interface. Once the development is finalised, a report shall be submitted to the European Parliament and to the Council explaining in detail how the objectives, in particular relating to planning and costs, were achieved as well as justifying any divergences.
3. Four years after the start of operations of each interoperability component in accordance with Article 68 and every four years thereafter, eu-LISA shall submit to the European Parliament, to the Council and to the Commission a report on the technical functioning of the interoperability components, including their security.
4. In addition, one year after each report from eu-LISA, the Commission shall produce an overall evaluation of the interoperability components, including:
(a)
an assessment of the application of this Regulation;
(b)
an examination of the results achieved against the objectives of this Regulation and its impact on fundamental rights, including in particular an assessment of the impact of the interoperability components on the right to non-discrimination;
(c)
an assessment of the functioning of the web portal, including figures regarding the use of the web portal and the number of requests that were resolved;
(d)
an assessment of the continuing validity of the underlying rationale of the interoperability components;
(e)
an assessment of the security of the interoperability components;
(f)
an assessment of the use of the CIR for identification;
(g)
an assessment of the use of the CIR for preventing, detecting or investigating terrorist offences or other serious criminal offences;
(h)
an assessment of any practical implications, including any disproportionate impact on the flow of traffic at border crossing points and those with a budgetary impact on the general budget of the Union;
(i)
an assessment of the search of the Interpol databases via the ESP, including information on the number of matches against Interpol databases and information on any problems encountered.
The overall evaluation under the first subparagraph of this paragraph shall include any necessary recommendations. The Commission shall transmit the evaluation report to the European Parliament, to the Council, to the European Data Protection Supervisor and to the European Union Agency for Fundamental Rights.
5. By 12 June 2020 and every year thereafter until the implementing acts of the Commission referred to in Article 68 have been adopted, the Commission shall submit a report to the European Parliament and to the Council on the state of play of preparations for the full implementation of this Regulation. That report shall contain also detailed information about the costs incurred and information as to any risks which may impact the overall costs.
6. Two years after the start of operations of the MID in accordance with Article 68(4), the Commission shall produce an examination of the impact of the MID on the right to non-discrimination. Following this first report, the examination of the impact of the MID on the right to non-discrimination shall be part of the examination referred to in paragraph 4(b) of this Article.
7. The Member States and Europol shall provide eu-LISA and the Commission with the information necessary to draft the reports referred to in paragraphs 3 to 6. This information shall not jeopardise working methods or include information that reveals sources, staff members or investigations of the designated authorities.
8. eu-LISA shall provide the Commission with the information necessary to produce the overall evaluation referred to in paragraph 4.
9. While respecting the provisions of national law on the publication of sensitive information, and without prejudice to limitations necessary to protect security and public order, prevent crime and guarantee that no national investigation will be jeopardised, each Member State and Europol shall prepare annual reports on the effectiveness of access to data stored in the CIR for the purposes of preventing, detecting or investigating terrorist offences or other serious criminal offences, containing information and statistics on:
(a)
the exact purposes of the consultation including the types of terrorist offences or other serious criminal offences;
(b)
the reasonable grounds given for a substantiated suspicion that a suspect, perpetrator or victim is covered by Regulation (EU) No 603/2013;
(c)
the number of requests for access to the CIR for the purposes of preventing, detecting or investigating terrorist offences or other serious criminal offences;
(d)
the number and types of cases that have ended in successful identifications;
(e)
the need and use made of the exceptions for cases of urgency including those cases where that urgency was not accepted by the ex post verification carried out by the central access point.
The annual reports prepared by the Member State and Europol shall be transmitted to the Commission by 30 June of the subsequent year.
10. A technical solution shall be made available to Member States in order to manage user access requests referred to in Article 22 and to facilitate the collection of the information under paragraphs 7 and 9 of this Article for the purpose of generating reports and statistics referred to in those paragraphs. The Commission shall adopt implementing acts to lay down the specifications of the technical solution. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 70(2).
Entry into force and applicability
This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union .
The provisions of this Regulation related to the ESP shall apply from the date determined by the Commission in accordance with Article 68(1).
The provisions of this Regulation related to the shared BMS shall apply from the date determined by the Commission in accordance with Article 68(2).
The provisions of this Regulation related to the CIR shall apply from the date determined by the Commission in accordance with Article 68(3).
The provisions of this Regulation related to the MID shall apply from the date determined by the Commission in accordance with Article 68(4).
The provisions of this Regulation related to the automated data quality control mechanisms and procedures, the common data quality indicators and the minimum data quality standards shall apply respectively from the dates determined by the Commission in accordance with Article 68(5).
The provisions of this Regulation related to the CRRS shall apply from the date determined by the Commission in accordance with Article 68(6).
Articles 6, 12, 17, 25, 38, 42, 54, 56, 58, 66, 67, 69, 70, 71, 73 and 74(1) shall apply from 11 June 2019.
This Regulation shall apply in relation to Eurodac from the date the recast of Regulation (EU) No 603/2013 becomes applicable.
Source: EUR-Lex (Publications Office of the EU), © European Union, reuse permitted under Commission Decision 2011/833/EU.
