Regulation (EU) No 603/2013 of the European Parliament and of the Council of 26 June 2013 on the establishment of 'Eurodac' for the comparison of fingerprints for the effective application of Regulation (EU) No 604/2013 establishing the criteria and mechanisms for determining the Member State responsible for examining an application for international protection lodged in one of the Member States by a third-country national or a stateless person and on requests for the comparison with Eurodac data by Member States' law enforcement authorities and Europol for law enforcement purposes, and amending Regulation (EU) No 1077/2011 establishing a European Agency for the operational management of large-scale IT systems in the area of freedom, security and justice (recast)
(a) "applicant for international protection" means a third-country national or a stateless person who has made an application for international protection as defined in Article 2(h) of Directive 2011/95/EU in respect of which a final decision has not yet been taken; (b) "Member State of origin" means: (i) in relation to a person covered by Article 9(1), the Member State which transmits the personal data to the Central System and receives the results of the comparison; (ii) in relation to a person covered by Article 14(1), the Member State which transmits the personal data to the Central System; (iii) in relation to a person covered by Article 17(1), the Member State which transmits the personal data to the Central System and receives the results of the comparison;
(c) "beneficiary of international protection" means a third-country national or a stateless person who has been granted international protection as defined in Article 2(a) of Directive 2011/95/EU; (d) "hit" means the existence of a match or matches established by the Central System by comparison between fingerprint data recorded in the computerised central database and those transmitted by a Member State with regard to a person, without prejudice to the requirement that Member States shall immediately check the results of the comparison pursuant to Article 25(4); (e) "National Access Point" means the designated national system which communicates with the Central System; (f) "Agency" means the Agency established by Regulation (EU) No 1077/2011; (g) "Europol" means the European Police Office established by Decision 2009/371/JHA; (h) "Eurodac data" means all data stored in the Central System in accordance with Article 11 and Article 14(2); (i) "law enforcement" means the prevention, detection or investigation of terrorist offences or of other serious criminal offences; (j) "terrorist offences" means the offences under national law which correspond or are equivalent to those referred to in Articles 1 to 4 of Framework Decision 2002/475/JHA; (k) "serious criminal offences" means the forms of crime which correspond or are equivalent to those referred to in Article 2(2) of Framework Decision 2002/584/JHA, if they are punishable under national law by a custodial sentence or a detention order for a maximum period of at least three years; (l) "fingerprint data" means the data relating to fingerprints of all or at least the index fingers, and if those are missing, the prints of all other fingers of a person, or a latent fingerprint.
(a) a computerised central fingerprint database ("Central System") composed of: (i) a Central Unit, (ii) a Business Continuity Plan and System;
(b) a communication infrastructure between the Central System and Member States that provides an encrypted virtual network dedicated to Eurodac data ("Communication Infrastructure").
(a) supervision; (b) security; (c) the coordination of relations between the Member States and the provider.
(a) the implementation of the budget; (b) acquisition and renewal; (c) contractual matters.
(a) the number of data sets transmitted on persons referred to in Articles 9(1), 14(1) and 17(1); (b) the number of hits for applicants for international protection who have lodged an application for international protection in another Member State; (c) the number of hits for persons referred to in Article 14(1) who have subsequently lodged an application for international protection; (d) the number of hits for persons referred to in Article 17(1) who had previously lodged an application for international protection in another Member State; (e) the number of fingerprint data which the Central System had to request more than once from the Member States of origin because the fingerprint data originally transmitted did not lend themselves to comparison using the computerised fingerprint recognition system; (f) the number of data sets marked, unmarked, blocked and unblocked in accordance with Article 18(1) and (3); (g) the number of hits for persons referred to in Article 18(1) for whom hits have been recorded under points (b) and (d) of this Article; (h) the number of requests and hits referred to in Article 20(1); (i) the number of requests and hits referred to in Article 21(1).
(a) when an applicant for international protection or another person as referred to in Article 18(1)(d) of Regulation (EU) No 604/2013 arrives in the Member State responsible following a transfer pursuant to a decision acceding to a take back request as referred to in Article 25 thereof, the Member State responsible shall update its data set recorded in conformity with Article 11 of this Regulation relating to the person concerned by adding his or her date of arrival; (b) when an applicant for international protection arrives in the Member State responsible following a transfer pursuant to a decision acceding to a take charge request according to Article 22 of Regulation (EU) No 604/2013, the Member State responsible shall send a data set recorded in conformity with Article 11 of this Regulation relating to the person concerned and shall include his or her date of arrival; (c) as soon as the Member State of origin establishes that the person concerned whose data was recorded in Eurodac in accordance with Article 11 of this Regulation has left the territory of the Member States, it shall update its data set recorded in conformity with Article 11 of this Regulation relating to the person concerned by adding the date when that person left the territory, in order to facilitate the application of Articles 19(2) and 20(5) of Regulation (EU) No 604/2013; (d) as soon as the Member State of origin ensures that the person concerned whose data was recorded in Eurodac in accordance with Article 11 of this Regulation has left the territory of the Member States in compliance with a return decision or removal order issued following the withdrawal or rejection of the application for international protection as provided for in Article 19(3) of Regulation (EU) No 604/2013, it shall update its data set recorded in conformity with Article 11 of this Regulation relating to the person concerned by adding the date of his or her removal or when he or she left the territory; (e) the Member State which becomes responsible in accordance with Article 17(1) of Regulation (EU) No 604/2013 shall update its data set recorded in conformity with Article 11 of this Regulation relating to the applicant for international protection by adding the date when the decision to examine the application was taken.
(a) fingerprint data; (b) Member State of origin, place and date of the application for international protection; in the cases referred to in Article 10(b), the date of application shall be the one entered by the Member State who transferred the applicant; (c) sex; (d) reference number used by the Member State of origin; (e) date on which the fingerprints were taken; (f) date on which the data were transmitted to the Central System; (g) operator user ID; (h) where applicable in accordance with Article 10(a) or (b), the date of the arrival of the person concerned after a successful transfer; (i) where applicable in accordance with Article 10(c), the date when the person concerned left the territory of the Member States; (j) where applicable in accordance with Article 10(d), the date when the person concerned left or was removed from the territory of the Member States; (k) where applicable in accordance with Article 10(e), the date when the decision to examine the application was taken.
(a) fingerprint data; (b) Member State of origin, place and date of the apprehension; (c) sex; (d) reference number used by the Member State of origin; (e) date on which the fingerprints were taken; (f) date on which the data were transmitted to the Central System; (g) operator user ID.
(a) the third-country national or stateless person has been issued with a residence document; (b) the third-country national or stateless person has left the territory of the Member States; (c) the third-country national or stateless person has acquired the citizenship of any Member State.
(a) the third-country national or stateless person declares that he or she has lodged an application for international protection but without indicating the Member State in which he or she lodged the application; (b) the third-country national or stateless person does not request international protection but objects to being returned to his or her country of origin by claiming that he or she would be in danger, or (c) the third-country national or stateless person otherwise seeks to prevent his or her removal by refusing to cooperate in establishing his or her identity, in particular by showing no, or false, identity papers.
national fingerprint databases; the automated fingerprinting identification systems of all other Member States under Decision 2008/615/JHA where comparisons are technically available, unless there are reasonable grounds to believe that a comparison with such systems would not lead to the establishment of the identity of the data subject. Such reasonable grounds shall be included in the reasoned electronic request for comparison with Eurodac data sent by the designated authority to the verifying authority; and the Visa Information System provided that the conditions for such a comparison laid down in Decision 2008/633/JHA are met;
(a) the comparison is necessary for the purpose of the prevention, detection or investigation of terrorist offences or of other serious criminal offences, which means that there is an overriding public security concern which makes the searching of the database proportionate; (b) the comparison is necessary in a specific case (i.e. systematic comparisons shall not be carried out); and (c) there are reasonable grounds to consider that the comparison will substantially contribute to the prevention, detection or investigation of any of the criminal offences in question. Such reasonable grounds exist in particular where there is a substantiated suspicion that the suspect, perpetrator or victim of a terrorist offence or other serious criminal offence falls in a category covered by this Regulation.
(a) the comparison is necessary to support and strengthen action by Member States in preventing, detecting or investigating terrorist offences or other serious criminal offences falling under Europol's mandate, which means that there is an overriding public security concern which makes the searching of the database proportionate; (b) the comparison is necessary in a specific case (i.e. systematic comparisons shall not be carried out); and (c) there are reasonable grounds to consider that the comparison will substantially contribute to the prevention, detection or investigation of any of the criminal offences in question. Such reasonable grounds exist in particular where there is a substantiated suspicion that the suspect, perpetrator or victim of a terrorist offence or other serious criminal offence falls in a category covered by this Regulation.
(a) fingerprints are taken lawfully; (b) fingerprint data and the other data referred to in Article 11, Article 14(2) and Article 17(2) are lawfully transmitted to the Central System; (c) data are accurate and up-to-date when they are transmitted to the Central System; (d) without prejudice to the responsibilities of the Agency, data in the Central System are lawfully recorded, stored, corrected and erased; (e) the results of fingerprint data comparisons transmitted by the Central System are lawfully processed.
(a) adopt measures ensuring that persons working with the Central System process the data recorded therein only in accordance with the purposes of Eurodac as laid down in Article 1; (b) take the necessary measures to ensure the security of the Central System in accordance with Article 34; (c) ensure that only persons authorised to work with the Central System have access thereto, without prejudice to the competences of the European Data Protection Supervisor.
(a) the identity of the controller within the meaning of Article 2(d) of Directive 95/46/EC and of his or her representative, if any; (b) the purpose for which his or her data will be processed in Eurodac, including a description of the aims of Regulation (EU) No 604/2013, in accordance with Article 4 thereof and an explanation in intelligible form, using clear and plain language, of the fact that Eurodac may be accessed by the Member States and Europol for law enforcement purposes; (c) the recipients of the data; (d) in relation to a person covered by Article 9(1) or 14(1), the obligation to have his or her fingerprints taken; (e) the right of access to data relating to him or her, and the right to request that inaccurate data relating to him or her be corrected or that unlawfully processed data relating to him or her be erased, as well as the right to receive information on the procedures for exercising those rights including the contact details of the controller and the national supervisory authorities referred to in Article 30(1).
(a) physically protect the data, including by making contingency plans for the protection of critical infrastructure; (b) deny unauthorised persons access to national installations in which the Member State carries out operations in accordance with the purposes of Eurodac (checks at entrance to the installation); (c) prevent the unauthorised reading, copying, modification or removal of data media (data media control); (d) prevent the unauthorised input of data and the unauthorised inspection, modification or erasure of stored personal data (storage control); (e) prevent the unauthorised processing of data in Eurodac and any unauthorised modification or erasure of data processed in Eurodac (control of data entry); (f) ensure that persons authorised to access Eurodac have access only to the data covered by their access authorisation, by means of individual and unique user IDs and confidential access modes only (data access control); (g) ensure that all authorities with a right of access to Eurodac create profiles describing the functions and responsibilities of persons who are authorised to access, enter, update, erase and search the data, and make those profiles and any other relevant information which those authorities may require for supervisory purposes available to the national supervisory authorities referred to in Article 28 of Directive 95/46/EC and in Article 25 of Framework Decision 2008/977/JHA without delay at their request (personnel profiles); (h) ensure that it is possible to verify and establish to which bodies personal data may be transmitted using data communication equipment (communication control); (i) ensure that it is possible to verify and establish what data have been processed in Eurodac, when, by whom and for what purpose (control of data recording); (j) prevent the unauthorised reading, copying, modification or erasure of personal data during the transmission of personal data to or from Eurodac or during the transport of data media, in particular by means of appropriate encryption techniques (transport control); (k) monitor the effectiveness of the security measures referred to in this paragraph and take the necessary organisational measures related to internal monitoring in order to ensure compliance with this Regulation (self-auditing) and to automatically detect within 24 hours any relevant events arising from the application of measures listed in points (b) to (j) that might indicate the occurrence of a security incident.
(a) the exact purpose of the request for comparison, including the concerned form of a terrorist offence or other serious criminal offence and, for Europol, the exact purpose of the request for comparison; (b) the reasonable grounds given not to conduct comparisons with other Member States under Decision 2008/615/JHA, in accordance with Article 20(1) of this Regulation; (c) the national file reference; (d) the date and exact time of the request for comparison by the National Access Point to the Central System; (e) the name of the authority having requested access for comparison, and the person responsible who made the request and processed the data; (f) where applicable, the use of the urgent procedure referred to in Article 19(3) and the decision taken with regard to the ex-post verification; (g) the data used for comparison; (h) in accordance with national rules or with Decision 2009/371/JHA, the identifying mark of the official who carried out the search and of the official who ordered the search or supply.
(1) Article 5 is replaced by the following: "Article 5 Tasks relating to Eurodac In relation to Eurodac, the Agency shall perform: (a) the tasks conferred on it by Regulation (EU) No 603/2013 of the European Parliament and of the Council of 26 June 2013 on the establishment of "Eurodac" for the comparison of fingerprints for the effective application of Regulation (EU) No 604/2013 establishing the criteria and mechanisms for determining the Member State responsible for examining an application for international protection lodged in one of the Member States by a third-country national or a stateless person), and on requests for the comparison with Eurodac data by Member States' law enforcement authorities and Europol for law enforcement purposesOJ L 180, 29.6.2013, p. 1 .";(b) tasks relating to training on the technical use of Eurodac.
----------------------OJ L 180, 29.6.2013, p. 1 .";(2) Article 12(1) is amended as follows: (a) points (u) and (v) are replaced by the following: "(u) adopt the annual report on the activities of the Central System of Eurodac pursuant to Article 40(1) of Regulation (EU) No 603/2013; (v) make comments on the European Data Protection Supervisor's reports on the audits pursuant to Article 45(2) of Regulation (EC) No 1987/2006, Article 42(2) of Regulation (EC) No 767/2008 and Article 31(2) of Regulation (EU) No 603/2013 and ensure appropriate follow-up of those audits;";
(b) point (x) is replaced by the following: "(x) compile statistics on the work of the Central System of Eurodac pursuant to Article 8(2) of Regulation (EU) No 603/2013;";
(c) point (z) is replaced by the following: "(z) ensure annual publication of the list of units pursuant to Article 27(2) of Regulation (EU) No 603/2013;";
(3) Article 15(4) is replaced by the following: "4. Europol and Eurojust may attend the meetings of the Management Board as observers when a question concerning SIS II, in relation to the application of Decision 2007/533/JHA, is on the agenda. Europol may also attend the meetings of the Management Board as observer when a question concerning VIS, in relation to the application of Decision 2008/633/JHA, or a question concerning Eurodac, in relation to the application of Regulation (EU) No 603/2013, is on the agenda."; (4) Article 17 is amended as follows: (a) in paragraph 5, point (g) is replaced by the following: "(g) without prejudice to Article 17 of the Staff Regulations, establish confidentiality requirements in order to comply with Article 17 of Regulation (EC) No 1987/2006, Article 17 of Decision 2007/533/JHA, Article 26(9) of Regulation (EC) No 767/2008 and Article 4(4) of Regulation (EU) No 603/2013;";
(b) in paragraph 6, point (i) is replaced by the following: "(i) reports on the technical functioning of each large-scale IT system referred to in Article 12(1)(t) and the annual report on the activities of the Central System of Eurodac referred to in Article 12(1)(u), on the basis of the results of monitoring and evaluation.";
(5) Article 19(3) is replaced by the following: "3. Europol and Eurojust may each appoint a representative to the SIS II Advisory Group. Europol may also appoint a representative to the VIS and Eurodac Advisory Groups.".
the exact purpose of the comparison, including the type of terrorist offence or serious criminal offence, grounds given for reasonable suspicion, the reasonable grounds given not to conduct comparison with other Member States under Decision 2008/615/JHA, in accordance with Article 20(1) of this Regulation, number of requests for comparison, the number and type of cases which have ended in successful identifications, and the need and use made of the exceptional case of urgency, including those cases where that urgency was not accepted by the ex post verification carried out by the verifying authority.
| Council Regulation (EC) No 2725/2000 | ( |
| Council Regulation (EC) No 407/2002 | ( |
| Regulation (EC) No 2725/2000 | This Regulation |
|---|---|
| Article 1(1) | Article 1(1) |
| Article 1(2), first subparagraph, points (a) and (b) | Article 3(1)(a) |
| Article 1(2), first subparagraph, point (c) | — |
| Article 1(2), second subparagraph | Article 3(4) |
| Article 1(3) | Article 1(3) |
| Article 2(1)(a) | — |
| Article 2(1)(b) to (e) | Article 2(1)(a) to (d) |
| — | Article 2(1)(e) to (j) |
| Article 3(1) | — |
| Article 3(2) | Article 3(3) |
| Article 3(3)(a) to (e) | Article 8(1)(a) to (e) |
| — | Article 8(1)(f) to (i) |
| Article 3(4) | — |
| Article 4(1) | Article 9(1) and Article 3(5) |
| Article 4(2) | — |
| Article 4(3) | Article 9(3) |
| Article 4(4) | Article 9(4) |
| Article 4(5) | Article 9(5) |
| Article 4(6) | Article 25(4) |
| Article 5(1), points (a) to (f) | Article 11, points (a) to (f) |
| — | Article 11, points (g) to (k) |
| Article 5(1), points (g) and (h) | — |
| Article 6 | Article 12 |
| Article 7 | Article 13 |
| Article 8 | Article 14 |
| Article 9 | Article 15 |
| Article 10 | Article 16 |
| Article 11(1) to (3) | Article 17(1) to (3) |
| Article 11(4) | Article 17(5) |
| Article 11(5) | Article 17(4) |
| Article 12 | Article 18 |
| Article 13 | Article 23 |
| Article 14 | — |
| Article 15 | Article 27 |
| Article 16 | Article 28(1) and (2) |
| — | Article 28(3) |
| Article 17 | Article 37 |
| Article 18 | Article 29(1), (2), (4) to (10) and (12) to (15) |
| — | Article 29(3) and (11) |
| Article 19 | Article 30 |
| — | Articles 31 to 36 |
| Article 20 | — |
| Article 21 | Article 39(1) and (2) |
| Article 22 | — |
| Article 23 | — |
| Article 24(1) and (2) | Article 40(1) and (2) |
| — | Article 40(3) to (8) |
| Article 25 | Article 41 |
| Article 26 | Article 42 |
| — | Articles 43 to 45 |
| Article 27 | Article 46 |
| Regulation 407/2002/EC | This Regulation |
|---|---|
| Article 2 | Article 24 |
| Article 3 | Article 25(1) to (3) |
| — | Article 25(4) and (5) |
| Article 4 | Article 26 |
| Article 5(1) | Article 3(3) |
| Annex I | Annex I |
| Annex II | — |