Costs
1. The costs incurred in connection with the establishment and operation of Eurodac and the Communication Infrastructure shall be borne by the general budget of the Union.
2. The costs incurred by National Access Points and the Europol Access Point and their costs for connection to Eurodac shall be borne by each Member State and Europol respectively.
3. Each Member State and Europol shall set up and maintain at their expense the technical infrastructure necessary to implement this Regulation, and shall be responsible for bearing its costs resulting from requests for comparison with Eurodac data for law enforcement purposes.
Committee procedure
1. The Commission shall be assisted by a committee. That committee shall be a committee within the meaning of Regulation (EU) No 182/2011.
2. Where reference is made to this paragraph, Article 5 of Regulation (EU) No 182/2011 shall apply.
3. Where the Committee delivers no opinion, the Commission shall not adopt the draft implementing act and Article 5(4), third subparagraph, of Regulation (EU) No 182/2011 shall apply.
Reports, monitoring and evaluation
1. eu-LISA shall submit to the European Parliament, to the Council, to the Commission and to the European Data Protection Supervisor an annual report on the activities of Eurodac, including on its technical functioning and security. The annual report shall include information on the management and performance of Eurodac against pre-defined quantitative indicators for the objectives relating to output, cost-effectiveness and quality of service.
2. eu-LISA shall ensure that procedures are in place to monitor the functioning of Eurodac against the objectives referred to in paragraph 1.
3. For the purposes of technical maintenance, reporting and statistics, eu-LISA shall have access to the necessary information relating to the processing operations performed in Eurodac.
4. By 12 June 2027, eu-LISA shall conduct a study on the technical feasibility of adding facial recognition software to Eurodac for the purpose of comparing facial images, including of minors. The study shall evaluate the reliability and accuracy of the results produced from facial recognition software for the purposes of Eurodac and shall make any necessary recommendations prior to the introduction of the facial recognition technology to Eurodac.
5. By 12 June 2029 and every four years thereafter, the Commission shall produce an overall evaluation of Eurodac, examining the results achieved against objectives and the impact on fundamental rights, in particular data protection and privacy rights including whether the access for law enforcement purposes has led to indirect discrimination against persons covered by this Regulation, and assessing the continuing validity of the underlying rationale including the use of facial recognition software, and any implications for future operations, and shall make any necessary recommendations. That evaluation shall also include an assessment of the synergies between this Regulation and Regulation (EU) 2018/1862. The Commission shall transmit the evaluation to the European Parliament and to the Council.
6. Member States shall provide eu-LISA and the Commission with the information necessary to draft the annual report referred to in paragraph 1.
7. eu-LISA, Member States and Europol shall provide the Commission with the information necessary to draft the overall evaluation provided for in paragraph 5. That information shall not jeopardise working methods or include information that reveals sources, staff members or investigations of the designated authorities.
8. While respecting the provisions of national law on the publication of sensitive information, each Member State and Europol shall prepare reports every two years on the effectiveness of the comparison of biometric data with Eurodac data for law enforcement purposes, containing information and statistics on:
(a)
the exact purpose of the comparison, including the type of terrorist offence or other serious criminal offence;
(b)
grounds given for substantiated suspicion;
(c)
the reasonable grounds given in accordance with Article 33(1), point (a), of this Regulation for not conducting comparisons with other Member States under Decision 2008/615/JHA;
(d)
the number of requests for comparison;
(e)
the number and type of cases which have ended in successful identifications; and
(f)
the need and use made of the exceptional case of urgency, including those cases where that urgency was not accepted by the ex post verification carried out by the verifying authority.
The reports by Member States and Europol referred to in the first subparagraph shall be transmitted to the Commission by 30 June of the subsequent year.
9. On the basis of the reports by Member States and Europol referred to in paragraph 8, and in addition to the overall evaluation provided for in paragraph 5, the Commission shall compile a report every two years on the access to Eurodac for law enforcement purposes and shall transmit it to the European Parliament, to the Council and to the European Data Protection Supervisor.
Assessment
1. By 12 June 2028, the Commission shall assess the functioning and the operational efficiency of any IT system used to exchange the data of beneficiaries of temporary protection for the purposes of the administrative cooperation referred to in Article 27 of Directive 2001/55/EC.
2. The Commission shall also assess the expected impact of applying Article 26 of this Regulation in the event that Directive 2001/55/EC is activated, taking into consideration:
(a)
the nature of data subject to processing;
(b)
the expected impact of providing access to the data listed in Article 26(2) to the designated authorities referred to in Articles 5(1) and 9(1); and
(c)
the safeguards provided for in this Regulation.
3. Depending on the outcome of the assessments referred to in paragraphs 1 and 2 of this Article, the Commission shall make a legislative proposal amending or repealing Article 26, if appropriate.
Penalties
Member States shall take the necessary measures to ensure that any processing of data recorded in Eurodac contrary to the purposes of Eurodac as laid down in Article 1 is punishable by penalties, including administrative or criminal penalties, or both, in accordance with national law, that are effective, proportionate and dissuasive.
Territorial scope
The provisions of this Regulation shall not be applicable to any territory to which Regulation (EU) 2024/1351 does not apply, with the exception of the provisions related to data collected to assist with the application of Regulation (EU) 2024/1350 under the conditions set out in this Regulation.
Notification of designated authorities and verifying authorities
1. By 12 September 2024, each Member State shall notify the Commission of its designated authorities, of the operating units referred to in Article 5(3) and of its verifying authority and shall notify it without delay of any amendment thereto.
2. By 12 September 2024, Europol shall notify the Commission of its designated authority and of its verifying authority and shall notify it without delay of any amendment thereto.
3. The Commission shall publish the information referred to in paragraphs 1 and 2 in the Official Journal of the European Union on an annual basis and via an electronic publication that shall be available online and updated without delay.
Repeal
Regulation (EU) No 603/2013 of the European Parliament and of the Council ( 38 ) is repealed with effect from 12 June 2026.
References to the repealed Regulation shall be construed as references to this Regulation and shall be read in accordance with the correlation table in Annex II.
Entry into force and applicability
1. This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union .
2. This Regulation shall apply from 12 June 2026.
However, Article 26 shall apply from 12 June 2029.
3. This Regulation shall not apply to persons enjoying temporary protection pursuant to Implementing Decision (EU) 2022/382 and any other equivalent national protection pursuant thereto, any future amendments to Implementing Decision (EU) 2022/382, and any extensions to that temporary protection.
4. The Interface Control Document shall be agreed between Member States and eu-LISA no later than 12 December 2024.
5. Comparisons of facial images with the use of facial recognition software as set out in Articles 15 and 16 of this Regulation shall apply from the date upon which the facial recognition technology has been introduced into Eurodac. Facial recognition software shall be introduced into Eurodac within one year of the conclusion of the study on the introduction of facial recognition software referred to in Article 57(4). Until that date, facial image shall be stored in Eurodac as part of the data subject’s datasets and transmitted to a Member State following the comparison of fingerprints where there is a hit result.
6. Member States shall notify the Commission and eu-LISA as soon as they have made the technical arrangements to transmit data to Eurodac, no later than 12 June 2026.
Source: EUR-Lex (Publications Office of the EU), © European Union, reuse permitted under Commission Decision 2011/833/EU.
