DNA reference data
1. Member States shall ensure the availability of DNA reference data from their national DNA databases for the purposes of automated searches by other Member States and Europol pursuant to this Regulation.
DNA reference data shall not contain any additional data from which an individual can be directly identified.
Unidentified DNA profiles shall be recognisable as such.
2. DNA reference data shall be processed in accordance with this Regulation and in compliance with the national law applicable to the processing of those data.
3. The Commission shall adopt an implementing act to specify the identification characteristics of a DNA profile which is to be exchanged. That implementing act shall be adopted in accordance with the examination procedure referred to in Article 77(2).
Automated searching of DNA profiles
1. For the investigation of criminal offences, Member States shall, at the time of initial connection to the router via their national contact points, conduct an automated search by comparing all the DNA profiles stored in their DNA databases with all the DNA profiles stored in all other Member States’ DNA databases and Europol data. Each Member State shall agree bilaterally with each other Member State and with Europol on the arrangements for those automated searches in accordance with the rules and procedures laid down in this Regulation.
2. For the investigation of criminal offences, Member States shall, via their national contact points, conduct automated searches by comparing all the new DNA profiles added to their DNA databases with all the DNA profiles stored in all other Member States’ DNA databases and Europol data.
3. Where searches as referred to in paragraph 2 could not take place, the Member State concerned may agree bilaterally with each other Member State and with Europol to conduct them at a later stage by comparing DNA profiles with all DNA profiles stored in all other Member States’ DNA databases and Europol data. The Member State concerned shall agree bilaterally with each other Member State and with Europol on the arrangements for those automated searches in accordance with the rules and procedures laid down in this Regulation.
4. Searches as referred to in paragraphs 1, 2 and 3 shall only be conducted in the framework of individual cases and in compliance with the national law of the requesting Member State.
5. Where an automated search shows that a supplied DNA profile matches DNA profiles stored in the requested Member State’s searched database or databases, the national contact point of the requesting Member State shall receive in an automated manner the DNA reference data with which a match has been found.
6. The national contact point of the requesting Member State may decide to confirm a match between two DNA profiles. Where it decides to confirm a match between two DNA profiles, it shall inform the requested Member State and shall ensure that at least one qualified member of staff conducts a manual review in order to confirm that match with DNA reference data received from the requested Member State.
7. Where relevant for the investigation of criminal offences, the national contact point of the requested Member State may decide to confirm a match between two DNA profiles. Where it decides to confirm a match between two DNA profiles, it shall inform the requesting Member State and shall ensure that at least one qualified member of staff conducts a manual review in order to confirm that match with DNA reference data received from the requesting Member State.
Reference numbers for DNA profiles
The reference numbers for DNA profiles shall be the combination of the following:
(a)
a reference number allowing Member States, in the event of a match, to retrieve further data and other information in their national DNA databases in order to supply them or it to one, several or all of the other Member States in accordance with Article 47 or to Europol in accordance with Article 49(6);
(b)
a reference number allowing Europol, in the event of a match, to retrieve further data and other information for the purposes of Article 48(1) of this Regulation in order to supply them or it to one, several or all Member States in accordance with Regulation (EU) 2016/794;
(c)
a code to indicate the Member State which holds the DNA profile;
(d)
a code to indicate whether the DNA profile is an identified DNA profile or an unidentified DNA profile.
Principles for the exchange of DNA profiles
1. Member States shall take appropriate measures to ensure the confidentiality and integrity of DNA reference data sent to other Member States or Europol, including their encryption. Europol shall take appropriate measures to ensure the confidentiality and integrity of DNA reference data sent to Member States, including their encryption.
2. Each Member State and Europol shall ensure that the DNA profiles it transmits are of sufficient quality for automated comparison. The Commission shall establish, by means of implementing acts, a minimum quality standard to allow for the comparison of DNA profiles.
3. The Commission shall adopt implementing acts specifying the relevant European or international standards to be used by Member States and Europol for the exchange of DNA reference data.
4. The implementing acts referred to in paragraphs 2 and 3 of this Article shall be adopted in accordance with the examination procedure referred to in Article 77(2).
Rules for requests and replies regarding DNA profiles
1. A request for an automated search of DNA profiles shall include only the following information:
(a)
the code of the requesting Member State;
(b)
the date and time of the request and the request number;
(c)
DNA reference data;
(d)
whether the DNA profiles transmitted are unidentified DNA profiles or identified DNA profiles.
2. A reply to a request as referred to in paragraph 1 shall contain only the following information:
(a)
an indication as to whether there were one or more matches or no matches;
(b)
the date and time of the request and the request number;
(c)
the date and time of the reply and the reply number;
(d)
the codes of the requesting and requested Member States;
(e)
the reference numbers of the DNA profiles from the requesting and requested Member States;
(f)
whether the DNA profiles transmitted are unidentified DNA profiles or identified DNA profiles;
(g)
the matching DNA profiles.
3. A match shall be automatically notified only where the automated search has resulted in a match of a minimum number of loci. The Commission shall adopt implementing acts specifying the minimum number of loci for that purpose in accordance with the examination procedure referred to in Article 77(2).
4. Where a search with unidentified DNA profiles results in a match, each requested Member State with matching data may insert a marking in its national database indicating that there has been a match for that DNA profile following another Member State’s search. The marking shall include the reference number of the DNA profile used by the requesting Member State.
5. Member States shall ensure that requests as referred to in paragraph 1 of this Article are consistent with notifications sent pursuant to Article 74. Those notifications shall be reproduced in the practical handbook referred to in Article 79.
Section 2 — Dactyloscopic data
Dactyloscopic reference data
1. Member States shall ensure the availability of dactyloscopic reference data from their national databases established for the prevention, detection and investigation of criminal offences.
2. Dactyloscopic reference data shall not contain any additional data from which an individual can be directly identified.
3. Unidentified dactyloscopic data shall be recognisable as such.
Automated searching of dactyloscopic data
1. For the prevention, detection and investigation of criminal offences, Member States shall allow national contact points of other Member States and Europol access to the dactyloscopic reference data in their national databases established for that purpose to conduct automated searches by comparing dactyloscopic reference data.
Searches as referred to in the first subparagraph shall only be conducted in the framework of individual cases and in compliance with the national law of the requesting Member State.
2. The national contact point of the requesting Member State may decide to confirm a match between two sets of dactyloscopic data. Where it decides to confirm a match between two sets of dactyloscopic data, it shall inform the requested Member State and shall ensure that at least one qualified member of staff conducts a manual review in order to confirm that match with dactyloscopic reference data received from the requested Member State.
Reference numbers for dactyloscopic data
The reference numbers for dactyloscopic data shall be the combination of the following:
(a)
a reference number allowing Member States, in the event of a match, to retrieve further data and other information in their databases referred to in Article 10 in order to supply them or it to one, several or all of the other Member States in accordance with Article 47 or to Europol in accordance with Article 49(6);
(b)
a reference number allowing Europol, in the event of a match, to retrieve further data and other information for the purposes of Article 48(1) of this Regulation in order to supply them or it to one, several or all Member States in accordance with Regulation (EU) 2016/794;
(c)
a code to indicate the Member State which holds the dactyloscopic data.
Principles for the exchange of dactyloscopic data
1. Member States shall take appropriate measures to ensure the confidentiality and integrity of dactyloscopic data sent to other Member States or Europol, including their encryption. Europol shall take appropriate measures to ensure the confidentiality and integrity of dactyloscopic data sent to Member States, including their encryption.
2. Each Member State and Europol shall ensure that the dactyloscopic data it transmits are of sufficient quality for automated comparison. The Commission shall establish, by means of implementing acts, a minimum quality standard to allow for the comparison of dactyloscopic data.
3. Dactyloscopic data shall be digitalised and transmitted to the other Member States or Europol in accordance with European or international standards. The Commission shall adopt implementing acts specifying the relevant European or international standards to be used by Member States and Europol for the exchange of dactyloscopic data.
4. The implementing acts referred to in paragraphs 2 and 3 of this Article shall be adopted in accordance with the examination procedure referred to in Article 77(2).
Search capacities for dactyloscopic data
1. Each Member State shall ensure that its search requests do not exceed the search capacities specified by the requested Member State or Europol to ensure system readiness and to avoid overloading the system. For the same purpose, Europol shall ensure that its search requests do not exceed the search capacities specified by the requested Member State.
Member States shall inform the other Member States, the Commission, eu-LISA and Europol about their maximum search capacities per day for identified and unidentified dactyloscopic data. Europol shall inform Member States, the Commission and eu-LISA about its maximum search capacities per day for identified and unidentified dactyloscopic data. Member States or Europol may temporarily or permanently raise those search capacities at any time, including in a case of urgency. Where a Member State raises those maximum search capacities, it shall notify the other Member States, the Commission, eu-LISA and Europol of the new maximum search capacities. Where Europol raises those maximum search capacities, it shall notify the Member States, the Commission and eu-LISA of the new maximum search capacities.
2. The Commission shall adopt implementing acts specifying the maximum numbers of candidates accepted for comparison per transmission and the distribution of unused search capacities between Member States in accordance with the examination procedure referred to in Article 77(2).
Rules for requests and replies regarding dactyloscopic data
1. A request for an automated search of dactyloscopic data shall include only the following information:
(a)
the code of the requesting Member State;
(b)
the date and time of the request and the request number;
(c)
dactyloscopic reference data.
2. A reply to a request as referred to in paragraph 1 shall contain only the following information:
(a)
an indication as to whether there were one or more matches or no matches;
(b)
the date and time of the request and the request number;
(c)
the date and time of the reply and the reply number;
(d)
the codes of the requesting and requested Member States;
(e)
the reference numbers of the dactyloscopic data from the requesting and requested Member States;
(f)
the matching dactyloscopic data.
3. Member States shall ensure that requests as referred to in paragraph 1 of this Article are consistent with notifications sent pursuant to Article 74. Those notifications shall be reproduced in the practical handbook referred to in Article 79.
Section 3 — Vehicle registration data
Automated searching of vehicle registration data
1. For the prevention, detection and investigation of criminal offences, Member States shall allow national contact points of other Member States and Europol access to the following national vehicle registration data to conduct automated searches in individual cases:
(a)
data relating to the owner or holder of the vehicle;
(b)
data relating to the vehicle.
2. Searches as referred to in paragraph 1 shall be conducted only with the following data:
(a)
a complete chassis number;
(b)
a complete registration number; or
(c)
where authorised by the national law of the requested Member State, data relating to the owner or holder of the vehicle.
3. Searches as referred to in paragraph 1 conducted with data related to the owner or holder of the vehicle shall only be conducted in the case of suspects or convicted persons. All of the following identification data shall be used for the purposes of such searches:
(a)
where the owner or holder of the vehicle is a natural person:
(i)
the first name or names of the natural person;
(ii)
the family name or names of the natural person; and
(iii)
the date of birth of the natural person;
(b)
where the owner or holder of the vehicle is a legal person, that legal person’s name.
4. Searches as referred to in paragraph 1 shall be conducted only in compliance with the national law of the requesting Member State.
Principles of automated searching of vehicle registration data
1. For automated searching of vehicle registration data, Member States shall use the European Vehicle and Driving Licence Information System (Eucaris).
2. Information exchanged via Eucaris shall be transmitted in encrypted form.
3. The Commission shall adopt implementing acts specifying the data elements of the vehicle registration data which can be exchanged and the technical procedure for Eucaris to query Member States’ databases. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 77(2).
Keeping of logs
1. Each Member State shall keep logs of queries that the staff of its competent authorities duly authorised to exchange vehicle registration data make and logs of queries requested by other Member States. Europol shall keep logs of queries that its duly authorised staff make.
Each Member State and Europol shall keep logs of all data processing operations concerning vehicle registration data. Those logs shall include the following:
(a)
whether it was a Member State or Europol that launched the request for a query; where it was a Member State that launched the request for a query, the Member State in question;
(b)
the date and time of the request;
(c)
the date and time of the reply;
(d)
the national databases to which a request for a query was sent;
(e)
the national databases that provided a positive reply.
2. The logs referred to in paragraph 1 shall be used only for the collection of statistics, for data protection monitoring, including checking the admissibility of a query and the lawfulness of data processing, and for ensuring data security and integrity. Those logs shall be protected by appropriate measures against unauthorised access and shall be erased three years after their creation. If, however, they are required for monitoring procedures that have already begun, they shall be erased once the monitoring procedures no longer require the logs.
3. For the purposes of data protection monitoring, including checking the admissibility of a query and the lawfulness of data processing, the data controllers shall have access to the logs for self-monitoring as referred to in Article 55.
Section 4 — Facial images
Facial image reference data
1. Member States shall ensure the availability of facial image reference data of suspects, convicted persons and, where permitted under national law, victims from their national databases established for the prevention, detection and investigation of criminal offences.
2. Facial image reference data shall not contain any additional data from which an individual can be directly identified.
3. Unidentified facial images shall be recognisable as such.
Automated searching of facial images
1. For the prevention, detection and investigation of criminal offences punishable by a maximum term of imprisonment of at least one year under the law of the requesting Member State, Member States shall allow national contact points of other Member States and Europol access to the facial image reference data in their national databases to conduct automated searches.
Searches as referred to in the first subparagraph shall only be conducted in the framework of individual cases and in compliance with the national law of the requesting Member State.
Profiling as referred to in Article 11(3) of Directive (EU) 2016/680 shall be prohibited.
2. The national contact point of the requesting Member State may decide to confirm a match between two facial images. Where it decides to confirm a match between two facial images, it shall inform the requested Member State and shall ensure that at least one qualified member of staff conducts a manual review in order to confirm that match with facial image reference data received from the requested Member State.
Reference numbers for facial images
The reference numbers for facial images shall be the combination of the following:
(a)
a reference number allowing Member States, in the event of a match, to retrieve further data and other information in their databases referred to in Article 19 in order to supply them or it to one, several or all of the other Member States in accordance with Article 47 or to Europol in accordance with Article 49(6);
(b)
a reference number allowing Europol, in the event of a match, to retrieve further data and other information for the purposes of Article 48(1) of this Regulation in order to supply them or it to one, several or all Member States in accordance with Regulation (EU) 2016/794;
(c)
a code to indicate the Member State which holds the facial images.
Principles for the exchange of facial images
1. Member States shall take appropriate measures to ensure the confidentiality and integrity of facial images sent to other Member States or Europol, including their encryption. Europol shall take appropriate measures to ensure the confidentiality and integrity of facial images sent to Member States, including their encryption.
2. Each Member State and Europol shall ensure that the facial images it transmits are of sufficient quality for automated comparison. The Commission shall establish, by means of implementing acts, a minimum quality standard to allow for the comparison of facial images. Where the report referred to in Article 80(7) shows a high risk of false matches, the Commission shall review those implementing acts.
3. The Commission shall adopt implementing acts specifying the relevant European or international standards to be used by Member States and Europol for the exchange of facial images.
4. The implementing acts referred to in paragraphs 2 and 3 of this Article shall be adopted in accordance with the examination procedure referred to in Article 77(2).
Search capacities for facial images
1. Each Member State shall ensure that its search requests do not exceed the search capacities specified by the requested Member State or Europol to ensure system readiness and to avoid overloading the system. For the same purpose, Europol shall ensure that its search requests do not exceed the search capacities specified by the requested Member State.
Member States shall inform the other Member States, the Commission, eu-LISA and Europol about their maximum search capacities per day for identified and unidentified facial images. Europol shall inform the Member States, the Commission and eu-Lisa about its maximum search capacities per day for identified and unidentified facial images. Member States or Europol may temporarily or permanently raise those search capacities at any time, including in a case of urgency. Where a Member State raises those maximum search capacities, it shall notify the other Member States, the Commission, eu-LISA and Europol of the new maximum search capacities. Where Europol raises those maximum search capacities, it shall notify the Member States, the Commission and eu-LISA of the new maximum search capacities.
2. The Commission shall adopt implementing acts specifying the maximum numbers of candidates accepted for comparison per transmission and the distribution of unused search capacities between Member States in accordance with the examination procedure referred to in Article 77(2).
Rules for requests and replies regarding facial images
1. A request for an automated search of facial images shall include only the following information:
(a)
the code of the requesting Member State;
(b)
the date and time of the request and the request number;
(c)
facial image reference data.
2. A reply to a request as referred to in paragraph 1 shall contain only the following information:
(a)
an indication as to whether there were one or more matches or no matches;
(b)
the date and time of the request and the request number;
(c)
the date and time of the reply and the reply number;
(d)
the codes of the requesting and requested Member States;
(e)
the reference numbers of the facial images from the requesting and requested Member States;
(f)
the matching facial images.
3. Member States shall ensure that requests as referred to in paragraph 1 of this Article are consistent with notifications sent pursuant to Article 74. Those notifications shall be reproduced in the practical handbook referred to in Article 79.
Section 5 — Police records
Police records
1. Member States may participate in the automated exchange of police records. For the purposes of such exchanges, participating Member States shall ensure the availability of national police record indexes which contain sets of biographical data of suspects and convicted persons from their national databases established for the prevention, detection and investigation of criminal offences. Those sets of data shall contain only the following data to the extent that they are available:
(a)
first name or names;
(b)
family name or names;
(c)
alias or aliases and previously used name or names;
(d)
date of birth;
(e)
nationality or nationalities;
(f)
country of birth;
(g)
gender.
2. The data referred to in paragraph 1, points (a), (b) and (c), shall be pseudonymised.
Automated searching of national police record indexes
For the prevention, detection and investigation of criminal offences punishable by a maximum term of imprisonment of at least one year under the law of the requesting Member State, Member States participating in the automated exchange of police records shall allow national contact points of other participating Member States and Europol access to data from their national police record indexes to conduct automated searches.
Searches as referred to in the first paragraph shall only be conducted in the framework of individual cases and in compliance with the national law of the requesting Member State.
Reference numbers for police records
The reference numbers for police records shall be the combination of the following:
(a)
a reference number allowing Member States, in the event of a match, to retrieve biographical data and other information in their national police record indexes referred to in Article 25 in order to supply them or it to one, several or all of the other Member States in accordance with Article 44;
(b)
a code to indicate the Member State which holds the police records.
Rules for requests and replies regarding police records
1. A request for an automated search of national police record indexes shall include only the following information:
(a)
the code of the requesting Member State;
(b)
the date and time of the request and the request number;
(c)
the data referred to in Article 25, in so far as they are available.
2. A reply to a request as referred to in paragraph 1 shall contain only the following information:
(a)
an indication as to the number of matches;
(b)
the date and time of the request and the request number;
(c)
the date and time of the reply and the reply number;
(d)
the codes of the requesting and requested Member States;
(e)
the reference numbers of the police records from the requested Member States.
3. Member States shall ensure that requests as referred to in paragraph 1 of this Article are consistent with notifications sent pursuant to Article 74. Those notifications shall be reproduced in the practical handbook referred to in Article 79.
Section 6 — Common provisions
Missing persons and unidentified human remains
1. Where a national authority has been so empowered by national legislative measures as referred to in paragraph 2, it may conduct automated searches using the Prüm II framework for the following purposes only:
(a)
searching for missing persons in the context of criminal investigations or on humanitarian grounds;
(b)
identifying human remains.
2. Member States wishing to avail themselves of the possibility provided for in paragraph 1 shall, by means of national legislative measures, designate the national authorities competent for the purposes laid down therein and lay down the procedures, conditions and criteria, including the humanitarian grounds on which it is permitted to conduct automated searches for missing persons as referred to in paragraph 1, point (a).
National contact points
Each Member State shall designate one or more national contact points for the purposes of Articles 6, 11, 16, 20 and 26.
Implementing measures
The Commission shall adopt implementing acts specifying the technical arrangements for the Member States with respect to the procedures set out in Articles 6, 11, 16, 20 and 26. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 77(2).
Availability of the automated exchange of data at national level
1. Member States shall take all necessary measures to ensure that automated searching of DNA profiles, dactyloscopic data, certain vehicle registration data, facial images and police records is possible 24 hours a day, 7 days a week.
2. National contact points shall immediately inform each other, the Commission, eu-LISA and Europol of any unavailability of the automated exchange of data, including, where applicable, of any technical faults causing that unavailability.
National contact points shall agree, in accordance with the applicable Union and national law, on temporary alternative information exchange arrangements to be used where the automated exchange of data is unavailable.
3. Where the automated exchange of data is unavailable, national contact points shall ensure that it is re-established by any means necessary and without delay.
Justification for the processing of data
1. Each Member State shall keep a record of the justifications for the queries that its competent authorities make.
Europol shall keep a record of the justifications for the queries it makes.
2. The justifications referred to in paragraph 1 shall include:
(a)
the purpose of the query, including a reference to the specific case or investigation and, where applicable, the criminal offence;
(b)
an indication as to whether the query concerns a suspect or a person convicted of a criminal offence, a victim of a criminal offence, a missing person or unidentified human remains;
(c)
an indication as to whether the query aims to identify a person or obtain more data on a known person.
3. The justifications referred to in paragraph 1 of this Article shall be traceable to the logs referred to in Articles 18, 40 and 45. Those justifications shall only be used for assessing whether the searches are proportionate and necessary for the purpose of preventing, detecting or investigating a criminal offence, for data protection monitoring, including checking the admissibility of a query and the lawfulness of data processing, and for ensuring data security and integrity. Those justifications shall be protected by appropriate measures against unauthorised access and shall be erased three years after their creation. If, however, they are required for monitoring procedures that have already begun, they shall be erased once the monitoring procedures no longer require the justification.
4. In order to assess the proportionality and necessity of searches for the purpose of preventing, detecting or investigating a criminal offence or for the purposes of data protection monitoring, including checking the admissibility of a query and the lawfulness of data processing, the data controllers shall have access to those justifications for self-monitoring as referred to in Article 55.
Use of the universal message format
1. The universal message format (UMF) standard established by Article 38 of Regulation (EU) 2019/818 shall be used in the development of the router referred to in Article 35 of this Regulation and the European Police Record Index System (EPRIS) in so far as possible.
2. Any automated exchange of data in accordance with this Regulation shall use the UMF standard in so far as possible.
Source: EUR-Lex (Publications Office of the EU), © European Union, reuse permitted under Commission Decision 2011/833/EU.
