Collection and transmission of biometric data
1. Each Member State shall take, in accordance with Article 13(2), the biometric data of every applicant for international protection of at least six years of age:
(a)
upon the registration of the application for international protection referred to in Article 27 of Regulation (EU) 2024/1348 and transmit them, as soon as possible and no later than 72 hours from that registration, together with the other data referred to in Article 17(1) of this Regulation, to Eurodac in accordance with Article 3(2) of this Regulation; or
(b)
upon the making of the application for international protection, where the application is made at external border crossing points or in transit zones by a person who does not fulfil the entry conditions set out in Article 6 of Regulation (EU) 2016/399, and transmit them, as soon as possible and no later than 72 hours after the biometric data have been taken, together with the data referred to in Article 17(1) of this Regulation, to Eurodac in accordance with Article 3(2) of this Regulation.
Non-compliance with the 72-hour time limit referred to in the first subparagraph, points (a) and (b), of this paragraph shall not relieve Member States of the obligation to take the biometric data and transmit them to Eurodac. Where the condition of the fingertips does not allow the taking of fingerprints of a quality ensuring appropriate comparison under Article 38, the Member State of origin shall retake the fingerprints of the applicant and retransmit them as soon as possible and no later than 48 hours after they have been successfully retaken.
2. By way of derogation from paragraph 1, where it is not possible to take the biometric data of an applicant for international protection on account of measures taken to ensure his or her health or the protection of public health, Member States shall take and transmit such biometric data as soon as possible and no later than 48 hours after those health grounds no longer prevail.
In the event of serious technical problems, Member States may extend the 72-hour time limits referred to in paragraph 1, the first subparagraph, points (a) and (b), by a maximum of a further 48 hours in order to carry out their national continuity plans.
3. Where requested by the Member State concerned, the biometric data, alphanumeric data and, where available, a scanned colour copy of an identity or travel document may also be taken and transmitted on behalf of that Member State by members of the European Border and Coast Guard Teams or experts of the asylum support teams specifically trained for that purpose, when exercising powers and performing their tasks in accordance with Regulations (EU) 2019/1896 and (EU) 2021/2303.
4. Each dataset collected and transmitted in accordance with this Article shall be linked with other datasets corresponding to the same third-country national or stateless person in a sequence as set out in Article 3(6).
Information on the status of the data subject
1. As soon as the Member State responsible has been determined in accordance with Regulation (EU) 2024/1351, the Member State that conducts the procedures for determining the Member State responsible shall update its dataset recorded in accordance with Article 17 of this Regulation regarding the person concerned by adding the Member State responsible.
Where a Member State becomes responsible because there are reasonable grounds to consider that the applicant poses a threat to internal security in accordance with Article 16(4) of Regulation (EU) 2024/1351, it shall update its dataset recorded in accordance with Article 17 of this Regulation regarding the person concerned by adding the Member State responsible.
2. The following information shall be sent to Eurodac in order to be stored in accordance with Article 29(1) for the purposes of transmission under Articles 27 and 28:
(a)
when an applicant for international protection arrives in the Member State responsible following a transfer pursuant to a decision acceding to a take charge request as referred to in Article 40 of Regulation (EU) 2024/1351, the Member State responsible shall send a dataset recorded in accordance with Article 17 of this Regulation relating to the person concerned and shall include his or her date of arrival;
(b)
when an applicant for international protection or another person as referred to in Article 36(1), point (b) or (c), of Regulation (EU) 2024/1351 arrives in the Member State responsible following a transfer pursuant to a take back notification as referred to in Article 41 of that Regulation, the Member State responsible shall update its dataset recorded in accordance with Article 17 of this Regulation relating to the person concerned by adding his or her date of arrival;
(c)
as soon as the Member State of origin establishes that the person concerned whose data were recorded in Eurodac in accordance with Article 17 of this Regulation has left the territory of the Member States, it shall update its dataset recorded in accordance with Article 17 of this Regulation relating to the person concerned by adding the date when that person left the territory, in order to facilitate the application of Article 37(4) of Regulation (EU) 2024/1351;
(d)
as soon as the Member State of origin ensures that the person concerned whose data were recorded in Eurodac in accordance with Article 17 of this Regulation has left the territory of the Member States in compliance with a return decision or removal order issued following the withdrawal or rejection of the application for international protection as provided for in Article 37(5) of Regulation (EU) 2024/1351, it shall update its dataset recorded in accordance with Article 17 of this Regulation relating to the person concerned by adding the date of his or her removal or when he or she left the territory.
3. Where responsibility shifts to another Member State, pursuant to Articles 37(1) and Article 68(3) of Regulation (EU) 2024/1351, the Member State that establishes that responsibility has shifted, or the Member State of relocation, shall indicate the Member State responsible.
4. Where paragraph 1 or 3 of this Article or Article 31(6) apply, Eurodac shall, as soon as possible and no later than 72 hours after receiving the data concerned, inform all Member States of origin of the transmission of such data by another Member State of origin having produced a hit with data which they transmitted relating to persons as referred to in Article 15(1), Article 18(2), Article 20(1), Article 22(1), Article 23(1), Article 24(1) or Article 26(1). Those Member States of origin shall also update the Member State responsible in the datasets corresponding to persons as referred to in Article 15(1).
Recording of data
1. Only the following data shall be recorded in Eurodac in accordance with Article 3(2):
(a)
fingerprint data;
(b)
a facial image;
(c)
surname(s) and forename(s), name(s) at birth and previously used names and any aliases, which may be entered separately;
(d)
nationality(ies);
(e)
date of birth;
(f)
place of birth;
(g)
Member State of origin, place and date of the application for international protection; in the cases referred to in Article 16(2), point (a), the date of application shall be the date entered by the Member State who transferred the applicant;
(h)
sex;
(i)
where available, the type and number of identity or travel document, the three letter code of the issuing country and the expiry date of that document;
(j)
where available, a scanned colour copy of an identity or travel document along with an indication of its authenticity or, where unavailable, another document which facilitates the identification of the third-country national or stateless person along with an indication of its authenticity;
(k)
the reference number used by the Member State of origin;
(l)
the date on which the biometric data were taken;
(m)
the date on which the data were transmitted to Eurodac;
(n)
operator user ID.
2. Additionally, where applicable and available, the following data shall be promptly recorded in Eurodac in accordance with Article 3(2):
(a)
the Member State responsible in the cases referred to in Article 16(1), (2) or (3);
(b)
the Member State of relocation in accordance with Article 25(1);
(c)
in the cases referred to in Article 16(2), point (a), the date of the arrival of the person concerned after a successful transfer;
(d)
in the cases referred to in Article 16(2), point (b), the date of the arrival of the person concerned after a successful transfer;
(e)
in the cases referred to in Article 16(2), point (c), the date when the person concerned left the territory of the Member States;
(f)
in the cases referred to in Article 16(2), point (d), the date when the person concerned was removed from or left the territory of the Member States;
(g)
in the cases referred to in Article 25(2), the date of arrival of the person concerned after a successful transfer;
(h)
the fact that a visa was issued to the applicant, the Member State which issued or extended the visa or on behalf of which the visa was issued and the visa application number;
(i)
the fact that the person could pose a threat to internal security following the security check referred to in Regulation (EU) 2024/1356 of the European Parliament and of the Council ( 37 ) or following an examination pursuant to Article 16(4) of Regulation (EU) 2024/1351 or to Article 9(5) of Regulation (EU) 2024/1348, if any of the following circumstances apply:
(i)
the person concerned is armed;
(ii)
the person concerned is violent;
(iii)
there are indications that the person concerned is involved in any of the offences referred to in Directive (EU) 2017/541;
(iv)
there are indications that the person concerned is involved in any of the offences referred to in Article 2(2) of the Framework Decision 2002/584/JHA;
(j)
the fact that the application for international protection has been rejected where the applicant has no right to remain and has not been allowed to remain in a Member State pursuant to Regulation (EU) 2024/1348;
(k)
the fact that, following an examination of an application in the border procedure pursuant to Regulation (EU) 2024/1348, a decision rejecting an application for international protection as inadmissible, unfounded or manifestly unfounded or a decision declaring an application as implicitly or explicitly withdrawn has become final;
(l)
the fact that assistance for voluntary return and reintegration (AVRR) has been granted.
3. Where all the data referred to in paragraph 1, points (a) to (f) and (h), of this Article relating to a person as referred to in Article 15 are recorded in Eurodac, they shall be considered to be a dataset transmitted to Eurodac for the purposes of Article 27(1), point (aa), of Regulation (EU) 2019/818.
4. The Member State of origin which has concluded that the threat to internal security identified following the screening referred to in Regulation (EU) 2024/1356 or following an examination pursuant to Article 16(4) of Regulation (EU) 2024/1351 or to Article 9(5) of Regulation (EU) 2024/1348 no longer applies shall delete the record of the security flag from the dataset, after having consulted any other Member States having registered a dataset of the same person. Eurodac shall, as soon as possible and no later than 72 hours after the deletion of the security flag by another Member State of origin having produced a hit with data which other Member States of origin transmitted relating to persons as referred to in Article 15(1), Article 22(1), Article 23(1) or Article 24(1) of this Regulation, inform those Member States of origin of that deletion. Those Member States of origin shall also delete the security flag in the corresponding dataset.
Source: EUR-Lex (Publications Office of the EU), © European Union, reuse permitted under Commission Decision 2011/833/EU.
