Regulation (EU) 2019/816 is amended as follows:
(1)
in Article 1, the following point is added:
‘(d)
the conditions under which data in ECRIS-TCN may be used by the VIS designated authorities as referred to in Article 9d and Article 22b(13) of Regulation (EC) No 767/2008 of the European Parliament and of the Council ( *8 ) for the purpose of assessing whether an applicant for a visa, a long-stay visa or a residence permit could pose a threat to public policy or internal security as referred to in point (i) of Article 2(1) and point (a) of Article 2(2) of that Regulation.
( *8 ) Regulation (EC) No 767/2008 of the European Parliament and of the Council of 9 July 2008 concerning the Visa Information System (VIS) and the exchange of information between Member States on short-stay visas, long-stay visas and residence permits (VIS Regulation) ( OJ L 218, 13.8.2008, p. 60 ).’;"
(2)
in Article 2, the following paragraph is added:
‘This Regulation also supports the VIS objective of assessing whether the applicant for a visa, a long-stay visa or a residence permit could pose a threat to public policy or internal security, in accordance with Regulation (EC) No 767/2008.’;
(3)
in Article 3, point (6) is replaced by the following:
‘(6)
‘competent authorities’ means the central authorities, Eurojust, Europol and the EPPO, and the VIS designated authorities as referred to in Article 9d and Article 22b(13) of Regulation (EC) No 767/2008, which are competent to access or query ECRIS-TCN in accordance with this Regulation;’;
(4)
Article 5 is amended as follows:
(a)
in paragraph 1, the following point is added:
‘(c)
a flag indicating, for the purposes of Regulation (EC) No 767/2008, that the third-country national concerned has been convicted of a terrorist offence or any other criminal offence listed in the Annex to Regulation (EU) 2018/1240 if it is punishable by a custodial sentence or a detention order for a maximum period of at least three years under national law, including the code of the convicting Member State.’;
(b)
paragraph 1a is replaced by the following:
‘1a. The CIR shall contain the data referred to in point (b) of paragraph 1 and the following data of point (a) of paragraph 1: surname (family name), first names (given names), date of birth, place of birth (town and country), nationality or nationalities, gender, previous names, if applicable, where available pseudonyms or aliases, where available, the type and number of the person’s travel documents, as well as the name of the issuing authority.
The CIR may contain the data referred to in paragraph 3 as well as, in the cases referred to in point (c) of paragraph 1, the code of the convicting Member State. The remaining ECRIS-TCN data shall be stored in the central system.’;
(c)
the following paragraph is added:
‘7. Where hits are identified following the automated processing referred to in Article 27a of Regulation (EC) No 767/2008, the flags and the code of the convicting Member State referred to in point (c) of paragraph 1 of this Article shall be accessible and searchable only by the VIS Central System for the purposes of the verifications pursuant to Article 7a of this Regulation in conjunction with point (e) of Article 9a(4) or point (e) of Article 22b(3) of Regulation (EC) No 767/2008.
Without prejudice to the first subparagraph of this paragraph, the flags and the code of the convicting Member State referred to in point (c) of paragraph 1 shall not be visible to any authority other than the central authority of the convicting Member State having created the flagged record.’;
(5)
in Article 7, paragraph 7 is replaced by the following:
‘7. In the event of a hit, the central system or the CIR shall automatically provide the competent authority with information on the Member States holding criminal record information on the third-country national, along with the associated reference numbers referred to in Article 5(1) and any corresponding identity information. Such identity information shall be used only for the purpose of verifying the identity of the third-country national concerned. The result of a search in the central system shall be used only for the purpose of:
(a)
making a request pursuant to Article 6 of Framework Decision 2009/315/JHA;
(b)
making a request as referred to in Article 17(3) of this Regulation; or
(c)
assessing whether the applicant for a visa, a long-stay visa or a residence permit could pose a threat to public policy or internal security, in accordance with Regulation (EC) No 767/2008.’;
(6)
the following Article is inserted:
‘Article 7a
Use of ECRIS-TCN for VIS verifications
1. From the date of the start of operations of VIS pursuant to Article 11 of Regulation (EU) 2021/1134 of the European Parliament and of the Council ( *9 ) ECRIS-TCN shall be connected to the ESP to enable the automated processing pursuant to Articles 9a and 22b of Regulation (EC) No 767/2008 to query ECRIS-TCN and compare the relevant data in the VIS with the relevant ECRIS-TCN data in the CIR flagged pursuant to point (c) of Article 5(1) of this Regulation.
2. For the purpose of performing the tasks pursuant to Regulation (EC) No 767/2008, the VIS designated authorities as referred to in Article 9d and Article 22b(13) of that Regulation shall have the right to access only those ECRIS-TCN data in the CIR to which a flag has been added pursuant to point (c) of Article 5(1) of this Regulation.
( *9 ) Regulation (EU) 2021/1134 of the European Parliament and of the Council of 7 July 2021 amending Regulations (EC) No 767/2008, (EC) No 810/2009, (EU) 2016/399, (EU) 2017/2226, (EU) 2018/1240, (EU) 2018/1860, (EU) 2018/1861, (EU) 2019/817 and (EU) 2019/1896 of the European Parliament and of the Council and repealing Council Decisions 2004/512/EC and 2008/633/JHA, for the purpose of reforming the Visa Information System ( OJ L 248, 13.7.2021, p. 11 ).’;"
(7)
Article 8 is amended as follows:
(a)
paragraph 2 is replaced by the following:
‘2. Upon expiry of the retention period referred to in paragraph 1, the central authority of the convicting Member State shall erase the data record, including any fingerprint data, facial images or flags as referred to in point (c) of Article 5(1), from the central system and the CIR. In cases where the data related to a conviction for a terrorist offence or any other criminal offence as referred to in point (c) of Article 5(1) are erased from the national criminal record, but information on other convictions of the same person is retained, only the flag referred to in point (c) of Article 5(1) shall be removed from the data record. Where possible the erasure shall be done automatically, and in any event no later than one month after the expiry of the retention period.’;
(b)
the following paragraph is added:
‘3. By way of derogation from paragraphs 1 and 2, the flags referred to in point (c) of Article 5(1) shall be erased automatically 25 years after the creation of the flag as regards convictions related to terrorist offences, and 15 years after the creation of the flag as regards convictions related to other criminal offences.’;
(8)
in Article 24, paragraph 1 is replaced by the following:
‘1. The data entered into the central system and the CIR shall be processed only for the purposes of the identification of the Member States holding the criminal records information of third-country nationals, or to support the VIS objective of assessing whether the applicant for a visa, a long-stay visa or a residence permit could pose a threat to public policy or internal security in accordance with Regulation (EC) No 767/2008. The data entered into the CIR shall also be processed in accordance with Regulation (EU) 2019/818 for facilitating and assisting in the correct identification of persons registered in the ECRIS-TCN in accordance with this Regulation.’;
(9)
the following Article is inserted:
‘Article 31a
Keeping of logs for the purposes of interoperability with VIS
For the consultations referred to in Article 7a of this Regulation, a log of each ECRIS-TCN data processing operation carried out within the CIR and VIS shall be kept in accordance with Article 34 of Regulation (EC) No 767/2008.’.
