Reporting and statistics
1. Where needed, the duly authorised staff of the Member States’ competent authorities, the Commission, eu-LISA and Europol shall have access to the following data related to the router, solely for the purposes of reporting and statistics:
(a)
the number of queries per Member State and the number of queries by Europol per category of data;
(b)
the number of queries to each of the connected databases;
(c)
the number of matches against each Member State’s database per category of data;
(d)
the number of matches against Europol data per category of data;
(e)
the number of confirmed matches where there were exchanges of core data;
(f)
the number of confirmed matches where there were no exchanges of core data;
(g)
the number of queries to the Common Identity Repository via the router; and
(h)
the number of matches per type as follows:
(i)
identified data (person) – unidentified data (trace);
(ii)
unidentified data (trace) – identified data (person);
(iii)
unidentified data (trace) – unidentified data (trace);
(iv)
identified data (person) – identified data (person).
It shall not be possible to identify individuals from the data set out in the first subparagraph.
2. The duly authorised staff of the Member States’ competent authorities, the Commission and Europol shall have access to the following data related to Eucaris, solely for the purposes of reporting and statistics:
(a)
the number of queries per Member State and the number of queries by Europol;
(b)
the number of queries to each of the connected databases; and
(c)
the number of matches against each Member State’s database.
It shall not be possible to identify individuals from the data set out in the first subparagraph.
3. The duly authorised staff of the Member States’ competent authorities, the Commission and Europol shall have access to the following data related to EPRIS, solely for the purposes of reporting and statistics:
(a)
the number of queries per Member State and the number of queries by Europol;
(b)
the number of queries to each of the connected indexes; and
(c)
the number of matches against each Member State’s database.
It shall not be possible to identify individuals from the data set out in the first subparagraph.
4. eu-LISA shall store the data set out in paragraph 1 of this Article in the central repository for reporting and statistics established by Article 39 of Regulation (EU) 2019/818. Europol shall store the data set out in paragraph 3. Those data shall allow the Member States’ competent authorities, the Commission, eu-LISA and Europol to obtain customisable reports and statistics to enhance the efficiency of law enforcement cooperation.
Costs
1. Costs incurred in connection with the establishment and operation of the router and EPRIS shall be borne by the general budget of the Union.
2. Costs incurred in connection with the integration of existing national infrastructure and its connection to the router and EPRIS and costs incurred in connection with the establishment of national facial image databases and national police record indexes for the prevention, detection and investigation of criminal offences shall be borne by the general budget of the Union.
The following costs shall be excluded:
(a)
Member States’ project management office (meetings, missions, offices);
(b)
hosting of national IT systems (space, implementation, electricity, cooling);
(c)
operation of national IT systems (operators and support contracts);
(d)
design, development, implementation, operation and maintenance of national communication networks.
3. Each Member State shall bear the costs arising from the administration, use and maintenance of Eucaris.
4. Each Member State shall bear the costs arising from the administration, use and maintenance of their connections to the router and EPRIS.
Notifications
1. Member States shall notify eu-LISA of the competent authorities referred to in Article 36. Those authorities may use or have access to the router.
2. eu-LISA shall notify the Commission of the successful completion of the test referred to in Article 75(1), point (b).
3. Europol shall notify the Commission of the successful completion of the test referred to in Article 75(3), point (b).
4. Each Member State shall notify the other Member States, the Commission, eu-LISA and Europol of the content of its national DNA databases and the conditions for automated searches to which Articles 5 and 6 apply.
5. Each Member State shall inform the other Member States, the Commission, eu-LISA and Europol of the content of its national dactyloscopic databases and the conditions for automated searches to which Articles 10 and 11 apply.
6. Each Member State shall inform the other Member States, the Commission, eu-LISA and Europol of the content of its national facial image databases and the conditions for automated searches to which Articles 19 and 20 apply.
7. Member States participating in automated exchanges of police records pursuant to Articles 25 and 26 shall notify the other Member States, the Commission and Europol of the content of their national police record indexes and of the national databases used for the establishment of those indexes and the conditions for automated searches.
8. Member States shall notify the Commission, eu-LISA and Europol of their national contact point designated pursuant to Article 30. The Commission shall compile a list of the national contact points notified to it and make it available to all Member States.
Start of operations
1. The Commission shall determine the date from which the Member States and Europol can start using the router by means of an implementing act once the following conditions have been met:
(a)
the measures referred to in Article 5(3), Article 8(2) and (3), Article 13(2) and (3), Article 17(3), Article 22(2) and (3), Article 31 and Article 37(6) have been adopted;
(b)
eu-LISA has declared the successful completion of a comprehensive test of the router, which it has conducted in cooperation with the Member States’ competent authorities and Europol.
The Commission shall determine, by means of the implementing act referred to in the first subparagraph, the date from which the Member States and Europol are to start using the router. That date shall be one year after the date determined in accordance with the first subparagraph.
The Commission may postpone the date from which the Member States and Europol are to start using the router by one year at most where an assessment of the implementation of the router has shown that such a postponement is necessary.
2. Member States shall ensure, two years after the start of operations of the router, the availability of facial images as referred to in Article 19 for the purposes of automated searching of facial images as referred to in Article 20.
3. The Commission shall determine the date from which the Member States and Europol are to start using EPRIS by means of an implementing act once the following conditions have been met:
(a)
the measures referred to in Article 44(6) have been adopted;
(b)
Europol has declared the successful completion of a comprehensive test of EPRIS, which it has conducted in cooperation with the Member States’ competent authorities.
4. The Commission shall determine the date from which Europol is to make available third country-sourced biometric data to Member States in accordance with Article 48 by means of an implementing act once the following conditions have been met:
(a)
the router is in operation;
(b)
Europol has declared the successful completion of a comprehensive test of its connection to the router, which it has conducted in cooperation with the Member States’ competent authorities and eu-LISA.
5. The Commission shall determine the date from which Europol is to have access to data stored in Member States’ databases in accordance with Article 49 by means of an implementing act once the following conditions have been met:
(a)
the router is in operation;
(b)
Europol has declared the successful completion of a comprehensive test of its connection to the router, which it has conducted in cooperation with the Member States’ competent authorities and eu-LISA.
6. The implementing acts referred to in this Article shall be adopted in accordance with the examination procedure referred to in Article 77(2).
Transitional provisions and derogations
1. Member States and the Union agencies shall start applying Articles 19 to 22, Article 47 and Article 49(6) from the date determined in accordance with Article 75(1), first subparagraph, with the exception of Member States which have not started using the router.
2. Member States and the Union agencies shall start applying Articles 25 to 28 and Article 49(4) from the date determined in accordance with Article 75(3).
3. Member States and the Union agencies shall start applying Article 48 from the date determined in accordance with Article 75(4).
4. Member States and the Union agencies shall start applying Article 49(1), (2), (3), (5) and (7) from the date determined in accordance with Article 75(5).
Committee procedure
1. The Commission shall be assisted by a committee. That committee shall be a committee within the meaning of Regulation (EU) No 182/2011.
2. Where reference is made to this paragraph, Article 5 of Regulation (EU) No 182/2011 shall apply. Where the committee delivers no opinion, the Commission shall not adopt the draft implementing act and Article 5(4), the third subparagraph, of Regulation (EU) No 182/2011 shall apply.
Interoperability Advisory group
The responsibilities of the Interoperability Advisory Group, established by Article 75 of Regulation (EU) 2019/817 and Article 71 of Regulation (EU) 2019/818, shall be extended to cover the router. That Interoperability Advisory Group shall provide eu-LISA with expertise related to the router, in particular in the context of the preparation of its annual work programme and its annual activity report.
Practical handbook
The Commission shall, in close cooperation with the Member States, eu-LISA, Europol and the European Union Agency for Fundamental Rights, make available a practical handbook for the implementation and management of this Regulation. The practical handbook shall provide technical and operational guidelines, recommendations and best practices. The Commission shall adopt the practical handbook in the form of a recommendation before the start of operations of both the router and EPRIS. The Commission shall update the practical handbook regularly and where necessary.
Monitoring and evaluation
1. eu-LISA shall ensure that procedures are in place to monitor the development of the router in light of objectives relating to planning and costs and to monitor its functioning in light of objectives relating to the technical output, cost-effectiveness, security and quality of service.
Europol shall ensure that procedures are in place to monitor the development of EPRIS in light of objectives relating to planning and costs and to monitor its functioning in light of objectives relating to the technical output, cost-effectiveness, security and quality of service.
2. By 26 April 2025 and every year thereafter during the development phase of the router, eu-LISA shall submit a report to the European Parliament and to the Council on the state of play of the development of the router. Those reports shall contain detailed information about the costs incurred and information as to any risks which could impact the overall costs to be borne by the general budget of the Union pursuant to Article 73.
Once the development of the router is finalised, eu-LISA shall submit a report to the European Parliament and to the Council explaining in detail how the objectives, in particular relating to planning and costs, were achieved and justifying any divergences.
3. By 26 April 2025 and every year thereafter during the development phase of EPRIS, Europol shall submit a report to the European Parliament and to the Council on the state of play of the development of EPRIS. Those reports shall contain detailed information about the costs incurred and information as to any risks which could impact the overall costs to be borne by the general budget of the Union pursuant to Article 73.
Once the development of EPRIS is finalised, Europol shall submit a report to the European Parliament and to the Council explaining in detail how the objectives, in particular relating to planning and costs, were achieved and justifying any divergences.
4. For the purposes of technical maintenance, eu-LISA shall have access to the necessary information relating to the data processing operations performed in the router. For the purposes of technical maintenance, Europol shall have access to the necessary information relating to the data processing operations performed in EPRIS.
5. Two years after the start of operations of the router and every two years thereafter, eu-LISA shall submit to the European Parliament, to the Council and to the Commission a report on the technical functioning, including the security, of the router.
6. Two years after the start of operations of EPRIS and every two years thereafter, Europol shall submit to the European Parliament, to the Council and to the Commission a report on the technical functioning, including the security, of EPRIS.
7. Three years after the start of operations of the router and EPRIS as referred to in Article 75 and every four years thereafter, the Commission shall produce a report on the overall evaluation of the Prüm II framework.
One year after the start of operations of the router and every two years thereafter, the Commission shall produce a report evaluating the use of facial images under this Regulation.
The reports referred to in the first and second subparagraphs shall include the following:
(a)
an assessment of the application of this Regulation, including its use by each Member State and Europol;
(b)
an examination of the results achieved against the objectives of this Regulation and its impact on fundamental rights;
(c)
the impact, effectiveness and efficiency of the performance of the Prüm II framework and its working practices in light of its objectives, mandate and tasks;
(d)
an assessment of the security of the Prüm II framework.
The Commission shall transmit those reports to the European Parliament, to the Council, to the European Data Protection Supervisor and to the European Union Agency for Fundamental Rights.
8. In the reports referred to in the first subparagraph of paragraph 7, the Commission shall pay special attention to the following new categories of data: facial images and police records. The Commission shall include in such reports the use made by each Member State and Europol of those new categories of data and their impact, effectiveness and efficiency. In the reports referred to in the second subparagraph of paragraph 7, the Commission shall pay special attention to the risk of false matches and to data quality.
9. The Member States and Europol shall provide eu-LISA and the Commission with the information necessary to draft the reports referred to in paragraphs 2 and 5. That information shall not jeopardise working methods or reveal the sources, staff members or investigations of the Member States’ competent authorities.
10. The Member States shall provide the Commission and Europol with the information necessary to draft the reports referred to in paragraphs 3 and 6. That information shall not jeopardise working methods or reveals the sources, staff members or investigations of the Member States’ competent authorities.
11. Without prejudice to confidentiality requirements, Member States, eu-LISA and Europol shall provide the Commission with the information necessary to produce the reports referred to in paragraph 7. Member States shall also provide the Commission with the number of confirmed matches against each Member State’s database per category and per type of data. That information shall not jeopardise working methods or reveal the sources, staff members or investigations of the Member States’ competent authorities.
Entry into force and applicability
This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union .
Source: EUR-Lex (Publications Office of the EU), © European Union, reuse permitted under Commission Decision 2011/833/EU.
