Explanatory Memorandum to COM(2018)302 - Amending a range of regulations in light of the revision of the VIS Regulation and of the Visa Code

Please note

This page contains a limited version of this dossier in the EU Monitor.

dossier COM(2018)302 - Amending a range of regulations in light of the revision of the VIS Regulation and of the Visa Code .
source COM(2018)302 EN
date 16-05-2018


1. CONTEXT OF THE PROPOSAL

• Background of the proposal

Since 2011, the Visa Information System (VIS)1 has served as the technology solution facilitating the short-stay visa procedure and helping visa, border, asylum and migration authorities to rapidly and effectively check the necessary information on third - cou ntry nationals who need a visa to travel

to the EU. The VIS connects Member States’ consulates around the world and all their external

border crossing points. The system performs biometric matching, primarily of fingerprints, for identification and verification purposes.

As stated in the Communication on adapting the common visa policy to new challenges , the EU common visa policy is an essential part of the Schengen acquis. Visa policy is, and should remain, a tool to facilitate tourism and business, while preventing security risks and the risk of irregular migration to the EU. While the fundamental principles of visa processing have not been reviewed since the entry into force of the Visa Code in 2010 and the VIS in 2011, the environment in which visa policy operates has changed drastically. The migration and security challenges faced in recent years have shifted the political debate about the area without internal border control in general, and about visa policy in particular, and prompted the EU to reassess the balance between migration and security concerns, economic considerations and general external relations.

In the Communication on preserving and strengthening Schengen5 the Commission already stated that in an area without controls at internal borders, cross-border threats affecting public policy or the internal security are a matter of common interest. The absence of internal border controls has been accompanied by measures on external borders, visa policy, the Schengen Information System, data protection, police cooperat ion, j udic ial cooperation in criminal matters and drugs policies.

At the same time, significant technological developments are providing new opportunities to make visa processing easier for both applicants and consulates. Since VIS is an important component of the framework underpinning visa policy, thisproposal complements the recent proposal amending the Visa Code presented by the Commission on 14 March 20186. The VIS is an integral part of the

Commission’s approach to managing data for borders, migration and security. It seeks to ensure that

border guards, law enforcement officers, immigration officials and judicial authorities have the information they need to better protect the EUs external borders, manage migration and improve internal security forall citizens. In December 2017 the Commission proposed the rules on

As established by Regulation (EC) No 767/2008 of the European Parliament and of the Council of 9 July 2008

(VIS Regulation), OJ L 218, 13.8.2008, p. 60.

COM(2018) 251 final.

The common visa policy is a set of harmonised rules governing different aspects: (i) the common ‘visa lists’ of

countries whose nationals require a visa to travel to the EU and those who are exempt from that requirement;

(ii) the Visa Code establishing the procedures and conditions for issuing short-stay visas; (iii) the uniform

format for the visa sticker; and (iv) the Visa Information System (VIS), in which all visa applications and

Member States’ decisions are recorded, including applicants’ personal data, photographs and fingerprints.

Contents

1.

Regulation (EC) No 810/2009 of the European Parliament and of the Council of 13 July 2009 establishing a


Community Code on Visas (Visa Code), OJ L243 of 15.9.2009.

COM(2017)570 final.

COM(2018)252 final of 14 March 2018.

4

interoperability between EU information systems7 to make them work together in a smarter and more efficient way.

In 2016 the Entry/Exit Sytem (EES) Regulation8 established that that the EES and VIS systems can be fully interoperable in order to provide a full picture of the visa application history of third-country nationals by adding information on how they used their visas. The proposal on establishing a framework for interoperability between EU information systems on boders and visa amends the VIS Regulation to establish the VIS as part of the single platform, together with EES and the European Travel Information and Authorisation System (ETIAS), on which the interoperability will be built. The multiple-identity detector introduced by the interoperability proposal will make it easier to detect multiple identities and counter identity fraud. The detector will automatically notify the visa authority processing an application if the applicant is known under different identities so that the authority can take the appropriate course of action. Once the new information systems have become operational and interoperability between them has been ensured, the possibilities for visa processing officers to perform quick background checks on applicants will be greatly increased. The European search portal (ESP) will enable single searches to receive results from different systems. This will help increase the security of the area without internal border controls. The legislation on visa processing needs amending to achieve this objective. The amendments should, in particular, includethe obligation on visa authorities to automatically consult the multiple-identity detector as well as other databases when conducting security and migratory assessments of third country nationals applying for a short-stay visa.

An information gap at EU level was identified concerning the documents that allow third-country nationals to stay for a period of time of more than 90/180 days in the Schengen area: long-stay visas, residence permits and residence cards (Final Report of the high-level expert group on information systems and interoperability - HLEG9 - of May 201710). The Council11 invited the Commission to undertake a feasibility study on the establishment of a central EU repository containing information on long-stay visas, residence cards and residence permits. The study12 was finalised in September 2017 and concluded that a repository as part of the VIS would provide the most feasible solution in terms of IT security, ease of implementation and cost-effectiveness. A follow-up study was carried out on the necessity and the proportionality of extending the VIS to include data on long stay visas and residence documents13.

In addition to the interoperability work launched since April 2016 to create stronger and smarter information systems for borders and security, an overall evaluation of the VIS was carried out in 201614. The evaluation looked specifically into the system’s fitness for purpose, efficiency, effectiveness and added value for the EU. It found that the VIS meets its objectives and functions and remains one of the most advanced systems of its kind, but that new challenges in visa, border and migration management meant it needed further development in a number of specific areas.

COM(2017)793 final.

Regulation (EU) 2226/2017 establishing an Entry/Exit System (EES) of 9 December 2017, OJ L 327, p. 20. The High-level expert group was set up by the Commission in June 2017 as an advisory body to improve the EU’s data management architecture for border control and security. Its final report was adopted on 11 May 2017.

ec.europa.eu/transparency/regexpert data.consilium.europa.eu/doc/document https://ec.europa.eu/home-affairs/sites/homeaffairs/files/docs/pages/201709_ibm_feasibility_study_final_report_en.pdf

Supporting study Legal analysis on the necessity and proportionality of extending the scope of the Visa Information System (VIS) to include data on long stay visas and residence documents'' (2018). COM (2016) 655.

10


12

3

4

On 17 April 2018, the Commission presented a proposal15 on strengthening the security of residence cards of third country nationals who are family members of EU citizens. In view of this proposal, including such residence cards in the VIS is not necessary.

Existing provisions in

the area of the proposal

The VIS was established by Decision 2004/512/EC and its purpose, functionalities and responsibilities are set out in Regulation (EC) No 767/2008 (the VIS Regulation). Regulation (EC) No 810/2009 of 13 July 2009 (the Visa Code) sets out the rules on the registration of biometric identifiers in the VIS. Council Decision 2008/633/JHA of 23 June 2008 lays down the conditions under which Member States’ designated authorities and Europol may obtain access to consult the VIS for the purposes of preventing, detecting and investigating terrorist offences and other serious criminal offences.

This proposal is without prejudice to Directive 2004/38/EC16. The proposal does not in any respect amend Directive 2004/38.

• Objectives

of the proposal

The general objectives of this initiative correspond to the Treaty based objectives of improving security within the EU and at its borders, facilitating the right of legitimate travellers to cross the external border, and freely move and stay within the area without internal border controls, and facilitating the management of the Schengen external borders. These objectives are further elaborated in the European Agenda on Migration and in subsequent communications, including the Communication on preserving and strengthening Schengen17, the European Agenda on Security18, the Commission’s progress reports towards an effective and genuine Security Union and the Communication on adapting the common visa policy to new challenges19.

The specific objectives of this proposal are to:

facilitate the visa application procedure;

(2)

facilitate and strengthen checks at external border crossing points and within the territory of the Member States;

enhance the internal security of the Schengen area by facilitating the exchange of information among Member States on third country nationals holders of long stay visas and residence permits.

A number of ancillary objectives are also pursued:

facilitate identity checks of third-country nationals, on the territory of a Member State, by migration and law enforcement authorities;

make it easier to identify missing persons;

2.

15 16


3.

17 18 19


COM (2018) 212 final.

Directive 2004/38/EC of the European Parliament and of the Council of 29 April 2004 on the right of citizens of the Union and their family members to move and reside freely within the territory of the Member States amending Regulation (EEC) No 1612/68 and repealing Directives 64/221/EEC, 68/360/EEC, 72/194/EEC, 73/148/EEC, 75/34/EEC, 75/35/EEC, 90/364/EEC, 90/365/EEC and 93/96/EEC (OJ L 158, 30.4.2004, p. 77). COM(2017)570 final. COM(2015)185 final. COM(2018) 251 final.


assist in the process of identifying and returning any person who may not or no longer fulfil the conditions for entry to, stay or residence in the Member States;

help law enforcement authorities access data of applicants for and holders of short-stay visas (which is already possible under current rules), and extend this access to holders long-stay visas and residence permits, where necessary for the prevention, investigation, detection or prosecution of serious crime and terrorism, while ensuring high standards of data protection and privacy;

gather statistics to support evidence-based European Union migration policy making.

2. RESULTS OF EX-POST EVALUATIONS, STAKEHOLDER CONSULTATIONS

AND IMPACT ASSESSMENTS

• Ex-post evaluations/fitness checks of existing legislation

A REFIT evaluation of the VIS was carried out in 2016 and led to a number of recommendations to improve the functioning of the system. These recommendations provided a basis for this proposal .

Overall, the VIS evaluation showed that the system is effective in meeting its objectives. However, it demonstrated a need to further develop the VIS to better respond to new challenges in visa, border and security policies. This could be done by interconnecting with existing and upcoming IT systems and exploring ways to have information on long-stay visas, including biometrics, registered in the VIS. The evaluation also showed the need for improvements, in particular in relation to the monitoring of data quality and the production of statistics.

Most of the issues identified by the evaluation were of a technical nature and serve to further align the system with the new legislative proposals in this area. T hey mainly concern:

1) improving data quality;

2) integrating the VISM ai l functionality into the VIS;

3) centralising the consultation and representation functions;

4.

4) providing support for facia image recognition or use of atent fingerprints; and


5) setting up a reporting and statistics engine based on VIS data.

Between October 2016 and July 2017, eu - LISA carried out a study on all envisaged technical impacts resulting from the VIS evaluation. A detailed assessment of the impact of these technical improvements was therefore not needed.

However, several issues identified in the evaluation required not only a technical analysis, but also further analysis of the possible solutions that would address them and their im pacts:

• the difficulties in completing procedures to return irregular migrants to their countries of origin if travel documents are missing;

COM(2016) 655, SWD (2016) 327, SWD (2016) 328.

20

• the risks of irregular migration and visa fraud, in particular trafficking in human beings and other abuse involving children under 12 years old, when applying for a visa;

• the difficulties for border or migration authorities in verifying long-stay visas and residence permits and their holders;

• the information gap on checks for irregular migration and security risks when processing visa applications.

• the need to consider the possibility when processing visas to automatically consult other databases in the area of security and borders. This should take into account developments since the 2016 evaluation regarding EU information systems for border management and security and ensure compliance with recently adopted Commission proposals (EES) and proposed new developments and systems (recast Eurodac proposal, ETIAS, ECRIS-TCN, interoperability).

• Consultation of interested parties

Annex 2 of the accompanying impact assessment sets out a d etailed description of the sta keholder consultation. The Commission contracted three independent studies: one on the feasibility, necessity and proportionality of lowering the fingerprinting age for children in the visa procedure and on storing a copy of the travel document of the visa applicants in the VIS, and two studies on the feasiblity and on the necessity and proportionality of extending the VIS to include data on long-stay visas and residence documents (i.e. residence permits and residence cards). These studies also involved targeted consultations of all concerned stakeholders, including national authorities that have access to enter, amend, delete or consult data in the VIS, national authorities responsible for migration, return, child protection authorities, police and anti-traff icking authorities, authorities responsible for consular affairs, and national authorities responsible for checks at external border crossing points. Various non-EU authorities and non - gover nm ental organisations involved in

children’s rights were also consulted.

In 2017-201 8 the Commission carried out two open public consultations, the first from 17 August 2017 to 9 November 2017 on the issue of lowering the fingerprinting age for children in the visa procedure and the second one from 17 November 2017 to 9 December 2018 on extending the VIS to include data on long-stay visas and residence documents.

The European Data Protection Supervisor provided its views on the issue of lowering the fingerprinting age for children on 9 November 2017 and on the issue of extending the VIS to include data on long stay visas and residence documents on 9 February 2018.

The EDPS and the Fundamental Rights Agency have provi d ed the ir views on var io us aspects of the proposal during targeted interviews as part of the stakeholder consultations conducted in the preparation of the impact assessment.

• Im pact assessment

5.

An impact assessment was carried out in 2018, focusing on those issues needing further


assessment to draft this proposal. It was based on three independent studies contracted out by the Commission and carried out in 2017 and 2018. The findings of eu-LISA’s study on the technical feasibility of all possible VIS developments, which was carried out in November 2016 and February

SWD(2018) 195.

21

2017, and the feasibility study on integrated border management for people not recorded in the EES (ETIAS study) were also taken into account.

The impact assessment looked into alternative options for:

• including a digi tal copy of the travel document in the VIS (in a centralised or decentralised manner), considering two sub-options: storing only the biographical page or storing all

used pages of the applicant’s travel document;

• lowering the fingerprinting age of children, considering two sub-options: lowering the fingerprinting age to six years or lowering the fingerprinting age to include all ages;

• including data on long-stay visas and residence documents in the VIS, with legislative options including further harmonising and securing long-stay and residence documents; creating an interconnection between national databases that would allow all Member States

to search each other’s relevant national databases; integrating documents in the VIS with

or without data on rejected applications;


ensuring automated migration and security checks against available databases.

This proposal follows the preferred options of the impact assessment as regards the first (storing a copy of the biographical page of the travel document), the second (lowering the fingerprinting age to 6 years) and the fourth measure above. As regads the inclusion of long-stay visas and residence documents in the VIS, information on residence cards issued to the family members of EU citizens with the right of free movement under Union law is not included in this proposal given the rights of these third country nationals ste mming from their family relationship with an EU citizen. Moreover, the proposal presented by the Commission on 17 April 2018 strengthened the security of such res dence cards.

The Regulatory Scrutiny Board reviewed the draft impact assessment and delivered a positive opinion on 23 April 2018.

3. LEGAL BASIS, SUBSIDIARITY AND PROPORTIONALITY

• Summary of the proposed act ions

The purpose, functionalities and responsibilities of the VIS must be further defined to take into account the expansion of the system to include data related to holders of long-stay visas and residence permits. This VIS must also be expanded so that the categories of data on applications for short-stay visas include storing copies of travel documents, and must integrate new functionalities such as the repository for reporting and statistics or the VISMail . his means that the rules setting out the procedure for processing visa applications in the Visa Code must be amended. Access of law enforcement authorities of the Member States and of Europol to VIS has been established by Council Decision 2008/633/JHA. This Decision, which predates the Lisbon Treaty, regulated law enforcement access in the framework of the former so called third pillar of the Treaty on European Union. As this 'third pillar' no longer exists as such in the current Treaties, the Commission considers that the current proposal provides the opportunity to integrate the content of this Decision into the VIS Regulation. As the VIS will be expanded to contain information on long-

Under Article 16 of Regulation (EC) No 767/2008, VISMail is a mechanism for information exchange and consultation between Member States central authorities, based on VIS infrastructure.

22

stay visas and residence permits, the required further development and operational management of the system will be entrusted to the Agency for the operational management of large-scale IT systems in the area of freedom, security and justice (eu-LISA).

Consequently, amendments will need to be made to Regulation (EC) No 810/2009 (the Visa Code), Regulation (EC) No 767/2008, Regulation (EU) 2017/2226 (the EES Regulation), Regulation (EU) XX [the Interoperability Regulation] and Regulation (EU) 2016/399 (the Schengen Borders Code).

The main objectives of the proposal can be summarised as follows:

Closing remaining information gaps for borders and security: include long-stay visas and residence documents in the VIS

The final report of the High-level expert group23 identified an information gap at EU level concerning the documents that allow third country nationals to stay on the territory of a given EU Member State for longer than 90 days in any 180 days24. Data on these documents and their holders are currently not collected and the data cannot be verified through any of the EU large-scale IT systems in the area of border and security (except SIS, to a limited extent). Member States consider that the current management of these documents can hamper the border crossing of third country nationals and their subsequent free movement in the area without internal border controls.

Third country nationals who are coming to the EU for a long stay are the only category of third country nationals not covered by any of the EU large-scale IT systems (as illustrated in the figure below). Including long-stay visas and residence permits in the VIS would ensure that information about these documents and their holders is included in one of the large-scale EU IT systems, and under the same rules as for documents issued to them either under visa-free conditions (data already in ETIAS and EES) and visa-required (third country nationals coming for a short stay, whose data are already in VIS and EES). This will enable Member State authorities other than the issuing authority to check that document and its holder at the borders or within the territory of the Member

States.

The High-level expert group was set up by the Commission in June 2017 as an advisory body to improve the EU’s data management architecture for border control and security. Its final report was adopted on 11 May 2017.

6.

For


example, long-stay visas and residence

documents (including both

residence permits and residence

cards).

23

24

By facilitating a systematic and better exchange of information among Member States on third country nationals holding long-stay visas and residence permits, the VIS would help improve the internal security of the Schengen area. If records of long-stay or residence permits are placed in a central system and made accessible to all relevant Member State authorities, each Member State will be able to make a more precise and impartial assessment of the security risk, based on the records found in the system when checking the document holders at border crossing points and in the territory of the Member States.

Moreover, including these documents in a centralised system will help detect fraud linked to obtaining authentic documents on the basis of false breeder documents.

Facilitating a better and systematic exchange of information among Member States would also minimise administrative burden and overcome the language barrier when contacting another Member State to verify the authenticity of a document presented by a third country national.

When deciding whether to issue or extend a long-stay visa or residence permit, a number of automated checks will be launched using the interoperability components (the ESP) to detect whether an EU or Interpol database contains any evidence that the person could pose a threat to the security of one of the Member States. The Member State issuing the document will have to follow up on any hit in accordance with existing EU and national law.

Enhancing

checks in visa processing using interoperability

Under the current rules, consulates are only obliged to check travellers under a visa obligation in the Schengen Information System to determine whether a visa applicant is subject to an entry ban. There is currently no obligation to check visa applicants against any other available EU databases (e.g. EURODAC), or against Interpol’s Stolen and Lost Travel Documents database and Travel Documents Associated with Notices database25.

Once in place, the European Search Portal will allow competent authorities — including visa processing authorities — to carry out a single search and receive results from all systems they are authorised to access (including EURODAC, EES and the European Criminal Records Information System — Third Country Nationals) rather than searching in each system individually. The European Search Portal will make it easier to detect security and irregular migration risks in the visa procedure by enabling visa officers to perform quick and efficient background checks on visa applicants.

The interoperability proposal also aims to make it easier to detect multiple identities and counter identity fraud. Using this interoperability feature, the visa authority processing an application will be notified automatically if the applicant is known under different identities and will be able to take the appropriate course of action.

Since the VIS is also part of the legal framework setting up interoperability, technical possibilities have opened up to ensure the practical communication between various databases in a fast, seamless and systematic manner by authorised users. Enabling the visa authorities to carry out automated checks against other databases using the European Search Portal makes this is the first time that the interoperability framework has been applied in practice.

25

Interpol’s Stolen and Lost Travel Documents database (SLTD) and the Travel Documents Associated with Notices (TDAWN) database contain information on travel documents linked to individuals who are subject to an Interpol notice.

When verifying and assessing the information submitted by applicants, the VIS will automatically query each application against each of the above systems.

zoom

Common Identity Repository

Short stay-visa identities

Long stay visa

& Residence

Permit

identities

7.

European Search Portal


X^~

In addition to automated queries of other databases, visa processing will benefit from specific risk indicators. The indicators will contain data analytics rules, as well as specific values provided by Member States and statistics generated from other relevant border management and security databases. This would improve risk assessments and allow the data-analytics method to be applied. The risk indicators would not contain any personal data and would be based on statistics and information provided by Member States on threats, abnormal rates of refusal or overstay by certain categories of third country nationals, and public health risks.

The introduction of systematic checks for security and migration in connection to VIS data builds on the benefits opened up by the interoperability framework.

Making

it easier to identify missing persons

Situations may occur where persons need to be identified in their own interest – because they were lost, missing, or identified as victims of trafficking. The possibility for the police authority to identify a person with the biometric data of that person taken during an identity check has been provided within the interoperability framework, where the national law allows. However, such access would not be sufficiently effective in the specific circu m sta nces as the ones described above. For this purpose, quick access should be given for law enforcement authorities to VIS data to enable a fast and reliable identification of the person, without the need to fulfill all the preconditions and additional safeguards for law enforcement access.

Addressing remaining information gaps in short-stay visa processing: lowering the fingerprinting age of applicants and storing copies of travel documents in the VIS to support return procedures

• Loweri ng the fingerprinting age for child applicants from 12 years to 6 years

This measure will allow officials to verify a child’s identity in the visa application procedure, and

8.

will enable checks when crossing an external border. Furthermore, by making it possible to unambiguously identify children, the measure will better protect children and help fight against


trafficking and irregular migration while keeping the child’s best interests at the fore. Additional

9.

safeguards are introduced in law in order to ensure that the best inte rests of the child are preserved


throughout the visa processing procedure and in any subsequent use of children’s data.

Fingerprints will be taken from every visa applicant from 6 years of age and above, thereby increasing the group of applicants for short-stay visas by adding the 6 to 11 year-old age-group.

When Regulation (EC) No 810/2009 was adopted, it was recognised that the issue of the sufficient reliability for identification and verification purposes of the fingerprints of children under 12 and, in particular, how fingerprints evolve with age, would have to be addressed at a later stage. In 2013, the European Commission’s Joint Research Centre (JRC)26 therefore carried out a study into whether or not automated fingerprint recognition for children can produce recognition rates similar to those of adults. The J RC study concluded that fingerprint recognition of children aged between 6 and 12 years is achievable with a satisfactory level of accuracy under certain conditions. One such condition would, for example, be to ensure that operators receive an appropriate level of training to acquire high quality images.

10.

A second study confirmed this finding and provided further insight into the effect of aging on fingerprint quality. The Commission conducted a further study looking into the necessity and


proportionality of lowering the fingerprinting age for children in the visa procedure. This study found that lowering the fingerprinting age would help better achieve the VIS objectives, in particular in relation to facilitating the fight against identity fraud and streamlining checks at external border crossing points. It also found that lowering the fingerprinting age could bring

additional benefits by strengthening the prevention and fight against abuses of children’s rights, in

particular by making it possible to identify or verify the identity of third country national children who are found in the territory of the Member States in a situation where their rights may be or have been violated (e.g. child victims of human trafficking, missing children and unaccompanied minors applying for asylum).

• Storing a copy of the bio-page of the applicants travel document in the VIS to

support return procedures

11.

The proposal introduces a new category of data to be stored in the VIS when submitting a visa


application. Currently Member States take copies of the applicant’s travel document. However,

there are no EU rules laying down uniform conditions for retaining or exchanging this information among Member States. Retaining a copy of the travel document will make it possible to run better checks of these documents and increase the efficiency of return procedures. Using the VIS to

implement this measure would support the EU’s return policy.

The competent authorities for identification (and/or verification within the territory) and return – namely migration and return authorities – which already have access to search the system using the fingerprints of the third country national, would be able to retrieve this copy, subject to strict access rules.

Under Article 2(e) of the VIS Regulation, one of the objectives of VIS is ‘to assist in the

12.

identification of any person who may not, or may no longer, fulfil the conditions for entry to, stay


or residence on the territory of the Member States’. Article 31 i enables the Member States to

13.

transfer or to make available a limited set of these data to a third country for the purpose of proving


14.

26 27 28


JRC (2013). Fingerprint Recognition for Children.

"Automatic fingerprint recognition: from children to elderly" (2018 – JRC).

15.

''Feasibility and implications of lowering the fingerprinting age for children and on storing a scanned copy of


the visa applicant's travel document in the Visa Information System (VIS)'' (2018).

16.

the identity of third country nationals for the purpose of return. The VIS has been further


enhanced with this measure to help identify and return irregular migrants.

Upgrading other technical components of the VIS

The VISMail mechanism for consultations is integrated in the VIS in order to streamline the exchanges between the VIS central system and the national systems. The configuration of the central system is adapted to better respond to the need to rapidly and efficiently ensure availability in periods of disruption (i.e. back-up system turned into an active/active configuration).

To improve the quality of the data recorded in the VIS, indicators on data quality defects have been introduced at application level. Eu-LISA has been entrusted with the role of managing data quality checks in the VIS. A functionality has been included to ensure that the VIS refuses to launch a request for prior consultation until all appropriate information has been properly filled in. Another functionality makes it possible to distinguish between the cases where fingerprints are not required for legal reasons and the cases where they cannot be provided. To address problems in collecting biom etrics, in particular those affecting the quality of facial images, alternative sta ndards will be put in place, such as a direct collection of photographs (i.e. facial image taken live). A centralised technical solution is envisaged for prior consultation, representation and subsequent notification, enabling Member States to manage and update their own information regarding these funct ions.

• Legal basis

The legal basis consists of this Regulation consists of the following articles of the Treaty on the Functioning of the European Union: Article 16 i, Article 77(2)(a), (b), (d) and (e), Article 78(2)(d), (e) and (g), Article 79(2)(c) and (d), Article 87(2)(a) and Article 88(2)(a).

Under Article 77 i, (a), (b), (d) and (e) TFEU respectively, the European Parliament and the Council can adopt measures concerning the common policy on visas and other short-stay residence permits, the checks to which persons crossing external borders are subject, and any measure necessary for the gradual establishment of an integrated management system for external borders and the absence of any controls on persons, whatever their nationality, when crossing internal borders. This is the main legal basis for this proposed Regulation.

Under Article 16 i TFEU, the Union has the power to adopt measures relating to the protection of individuals with regard to the processing of personal data by Union institutions, bodies, offices and agencies and by Member States when carrying out activities which fall within the scope of Union law, and the rules relating to the free movement of such data. This Treaty provision is also an im portant legal basis for this proposal.

An ancillary objective of this proposal is to allow, under strict conditions, national law enforcement authorities and to Europol to access VIS data for law enforcement purposes. The proposal therefore also relies on Article 87(2)(a) and Article 88(2)(a) TFEU respectively. Both these additional legal bases command the same ordinary legislative procedure which is applicable under Article 77 i.

The Regulation allows the designated competent authorities to transfer the following data from the visa application file: first name, surname and former surname (if applicable); sex, data, place and country of birth; current nationality and nationality at birth; type and number of the travel document, the authority which issued it and the date of issue and of expiry; residence; and in the case of minors, the surname and first name(s) of the applicant’s father and mother.

EMN Ad-Hoc Query on COM AHQ on Member States’ Experiences with the use of the Visa Information System (VIS) for Return Purposes. Requested by the Commission on 18th March 2016. 24 responses were provided.

29

30

This proposal pursues a number of further ancillary objectives, such as contributing to the Dublin and asylum examination procedure, which are measures developed under Article 78(2)(d), (e) and (g) TFEU; helping identify and return third country nationals as part of the measures developed under Article 79(2)(c) T FEU, and supporting the identification of victims and combat trafficking in persons as part of the measures developed under Article 79(2)(d) TFEU. Those additional legal bases are also compatible with the main ones.

• Subsidiarity principle

Article 77(2)(a) TFEU empowers the Union to develop measures concerning ‘the common policy on visas and other short-stay residence permits.’ This proposal is within the limits set by this

provision. T he objective is to further develop and improve the rules on the electronic processing of applications for intended stays in the territory of Member States not exceeding 90 days in any 1 80-day period. This cannot be sufficiently achieved by the Member States acting alone, because only the Union can amend an existing Union Act (the VIS Regulation).

Freedom of movement within the area without internal border controls requires that its external borders are effectively managed to ensure security. Member States have therefore agreed to address these challenges collectively, especially by sharing information through centralised EU systems in the area of justice and home affairs. This is confirmed by the various conclusions that have been adopted by both the European Council and the Council, especially since 2015.

The absence of internal border controls requires sound management of the external borders, where each Member State or associated country has to control the external border on behalf of the others. No Member State can cope on its own with irregular migration and cross-border crime. Third country nationals who enter the area without internal border controls are able to travel freely within this area. In an area without internal borders, common action against irregular immigration and international crime and terrorism, including through the detection of identity fraud, should be taken and can only be successfully addressed at EU level.

Under Article 77(2)(b) of the Treaty on the Functioning of the European Union, the Union has the power to adopt measures relating to the checks on persons and efficient monitoring of the crossing of external borders of the Member States. Current EU law on the visa procedure needs to be modified to take into account the travel movements of third country nationals applying for a short-stay visa, in particular the recent EES provisions doing away with the stamping obligation and instituting an entry and exit record for the third country nationals admitted for a short stay, thus

allowing Members States’ authorities to assess the lawful use of previous short stays in an area

without internal border controls.

As regards long-stay visas and residence permits, Article 21 of the Schengen Convention provides for their mutual recognition as documents allowing their holders to move freely within the Schengen area for 90 days in any 180 days (i.e. similar to a short-stay visa), provided they fulfil the conditions in Article 6(1)(a), (c) and (e) of Regulation (EU) 2016/399 (the Schengen Borders Code). Various Council conclusions have called for new measures to fill the information gaps for border management and law enforcement in relation to border crossings by holders of long-stay visas and residence permits, possibly by creating an EU repository of such data. Including data on

these documents so that the data can be shared among Member States and the holder’s documents

17.

be verified at external borders or within the EU by Member States other than the one that issued a


Conclusions of 9 June 2017 on the way forward to improve information exchange and ensure the interoperability of EU information systems (ST/10151/17); Conclusions of June 2016 endorsing a roadmap to enhance information exchange and information management (9368/1/16 REV 1).

3

document and in order to verify whether the person could pose a threat to the security of one of the Member States responds to objectives set under Article 77 of the Treaty on the Functioning of the European Union.

Therefore, this objective of the proposal cannot be sufficiently achieved by the Member States acting alone and is better achieved at Union level.

• Proportionality principle

As explained in the impact assessment accompanying this proposal for a revised Regulation, the policy choices made in this proposal are considered proportionate. They do not go beyond what is necessary to achieve the agreed objectives.

Article 5 of the Treaty on the European Union states that action by the Union must not go beyond what is necessary to achieve the objectives of the Treaty. The form chosen for this EU action must enable the proposal to achieve its objective and be implemented as effectively as possible. T he proposed initiative constitutes a further development of the rules on border-free travel in order to ensure that common rules at external borders are applied in the same way in all the Member States which have abolished controls at internal borders. It further builds on an instrument providing to the European Union information on third country nationals. It codifies and improves existing law enforcement authorities access to the VIS information on these categories of third country nationals, which is a timely, accurate, secure and cost-eff icient way to identify third country nationals suspected (or victims) of terrorism or a serious crime and to enable the authorities to consult the application history of third country nationals who are suspects (or victims) of such crim es.

The proposal has been designed around the ‘data protection by design’ principles and is

proportionate in terms of the right to protection of personal data because it does not require the collection and storage of more data for a longer period than is absolutely necessary to allow the system to function and meet its objectives. In addition, the proposal will provide for and implement all the safeguards and mechanisms required for the effective protection of the fundamental rights of travellers, particularly their private life and personal data.

No further processes or har m onisation will be necessary at EU level to make the system work. The envisaged measure is therefore proportionate because it does not go beyond what is necessary in terms of action at EU level to meet the defined objectives.

The preferred option is also proportionate in terms of costs, taking into account the benefits the system will provide to all Member States in managing the common external border and progressing towards a common EU migration policy.

The proposal therefore complies with the proportionality principle.

• Choice of instrument

This proposal builds on an existing centralised syste m through which Member States cooperate with each other, and which requires a common architecture and operating rules. Moreover, it lays down rules on border checks at the external borders and on access to the system, including for the purpose of law enforcement, which are uniform for all Member States. As a consequence, only a Regulation can be chosen as a legal instrument.

• Fundamental rights

The proposed Regulation has an impact on fundamental rights, notably on the right to dignity (Article 1 of the Charter of Fundamental Rights of the EU); the right to liberty and security (Article 6 of the Charter), respect for private and family life (Article 7 of the Charter), the protection of personal data (Article 8 of the Charter), the right to asylum and protection of the principle of non - refoule m ent (Articles 18 and 19 of the Charter) and protection in the event of removal, expulsion or extradition (Article 19 of the Charter), the right to non - discri m ination (Article 21 of the Charter), the rights of the child (Article 24 of the Charter) and the right to an effective remedy (Article 47 of the Charter).

The 2008 VIS Regulation establishes strict rules on access to the VIS and the necessary safeguards.

It also provides for individuals’ rights of access, correction, deletion and redress (i.e. rectification,

erasure and remedies in the terms of the General Data Protection Regulation32) in particular the right to a judicial remedy and the supervision of processing operations by public independent authorities. Additional safeguards are introduced by this proposal to cover the specific needs of the new categories of data, data processing and data subjects that will be covered by the VIS. Therefore, the proposal fully complies with the Charter of Fundamental Rights of the European Union, in particular as regards the right to the protection of personal data, and is also in line with Article 16 T FEU which guarantees everyone the right to protection of personal data concerning the m .

4. BUDGETARYIMPLICATIONS

Following the technical study carried out by eu-LISA in 2016 on the technical modification to the VIS resulting from the REFIT exercise and the impact assessment, this proposal follows the option of extending the VIS to include data on long-stay visas and residence permits, to carry out automated checks against EU and Interpol databases for security and, as applicable, irregular migration checks, and to lower the fingerprinting age for children and store a copy of the bio-page of the travel document of the applicants in the VIS. The study assessed that this will require EUR 182 million. The development phase is expected between 2021 and 2023, so the necessary funds will be covered from the allocated amount under the next EU budget. If the proposal is adopted before the next financial framework, the necessary resources (estimated at EUR 1.5 million) will be financed from the ISF-Borders and Visa budget line and the amounts will be deducted from the money earmarked for 2021-2023. The EUR 1.5 million would be used to launch the preparatory work leading to the implementation of the measures set out in this proposal, such as those related to preparing the implementing acts and launching public procurement contracts. Should political agreement on this proposal be reached by March 2019 (i.e. under current legislature) the objective is to implement the proposal by end 2021.

The resources required for this proposal (both for the Border Management Fund and for each of the agencies concerned) are compatible with the Commission proposal for the 2021-2027 Multiannual Financial Framework of 2 May 2018. The costs linked to the implementation of this proposal are allocated as follows:

– EUR 105 million to eu-LISA (indirect management);

Regulation (EU) 2016/679 of the European Parliament and of the Councilof 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p.

1).

32

– EUR 45 million to the Member States, earmarked in their National Programmes

(shared management);

– EUR 2 million to the European Border and Coast Guard Agency (EBCGA) (indirect

management);

– EUR 30 million to Europol (indirect management).

The cost model applied is explained in Annex 3 - 'Who is affected and how', Section 2 on 'Summary of costs and benefits' and in Annex 4 'REFIT' of the Impact Assessment, as well as analysed more in-depth in the study on 'Feasibility and Implications of Lowering the Fingerprinting age for Children', the study on "Storing a scanned copy of the visa applicants' travel document in the Visa Information System", the 'Feasibility study to include in a repository documents for Long-Stay visas, Residence and Local Border Traffic Permits' and the 'Legal Analysis on the Necessity and Proportionality of Extending the Scope of the Visa Information System (VIS) to Include Data on Long Stay Visas and Residence Documents', suporting the Impact Assessment.

5. ADDITIONAL INFORMATION

18.

Implementation


plans and monitoring, evaluation and reporting arrangements

The Commission will ensure the monitoring of the functioning of the VIS and evaluate its main policy objectives. Four years after the start of the application of the revised VIS Regulation and every four years thereafter, the Commission will submit a report to the European Parliament and to the Council. The report will present an overall evaluation of the functioning of the system, including its direct and indirect impacts and practical implementation on fundamental rights. It should examine results achieved against objectives, assess the progress with respect to the four main problem areas, and assess the continuing validity of the underlying rationale and any implications for future options. The implementation of the VIS is also evaluated through the Schengen evaluation mechanism in accordance with Council Regulation (EU) No 1053/201333, without prejudice to the Commission's role as guardian of the Treaties (Article 17(1) TEU).

Variable

geometry

This proposal builds upon and develops the Schengen acquis regarding external borders and visas in that it concerns the crossing of external borders and the granting of short-stay visas.

This has the following consequences in relation to the Treaty protocols and the agreements regarding association with the development of the Schengen acquis:

Denmark: In accordance with Articles 1 and 2 of the Protocol (No 22) on the position of Denmark, annexed to the Treaty on European Union (TEU) and the Treaty on the Functioning of the European Union (TFEU), Denmark does not take part in the adoption by the Council of measures pursuant to Title V of part Three of the TFEU.

Council Regulation (EU) No 1053/2013 of 7 October 2013 establishing an evaluation and monitoring mechanism to verify the application of the Schengen acquis and repealing the Decision of the Executive Committee of 16 September 1998 setting up a Standing Committee on the evaluation and implementation of the Schengen acquis, OJ L 295, 6.11.2013, p. 27.


33

Given that this Regulation builds upon the Schengen acquis, Denmark must, in accordance with Article 4 of that Protocol decide within a period of six months after the Council has decided on this Regulation whether it will implement it in its national law.

United Kingdom and Ireland: In accordance with Articles 4 and 5 of the Protocol integrating the Schengen acquis into the framework of the European Union and Council Decision 2000/365/EC of 29 May 2000 concerning the request of the United Kingdom of Great Britain and Northern Ireland, and Council Decision 2002/192/EC of 28 February 2002 concerning Ireland's request to take part in some of the provisions of the Schengen acquis, the United Kingdom and Ireland do not take part in Regulation (EC) No 767/2008 (the VIS Regulation) nor in any other of the legal instruments which are commonly known as the 'Schengen acquis', i.e. the legal instruments organising and supporting the abolition of controls at internal borders and the flanking measures regarding the controls at external borders.

This Regulation constitutes a development of this acquis, and therefore, the United Kingdom and Ireland are not taking part in the adoption of this Regulation and are not bound by it or subject to its application.

In line with the judgment of the Court of Justice in case C-482/08, United Kingdom v. Council34, the circumstance that this Regulation has Articles 87(2)(a) and Article 88(2)(a) as legal bases alongside Article 77(2)(b) and (d) TFEU does not affect the above conclusion, as the access for law enforcement purposes is ancillary to the establishment of the Visa Information System.

Iceland and Norway: The procedures laid down in the Association Agreement concluded by the Council and the Republic of Iceland and the Kingdom of Norway concerning the latter's association with the implementation, application and development of the Schengen acquis are applicable, since this proposal builds on the Schengen acquis as defined in Annex A to this Agreement35.

Switzerland: This Regulation constitutes a development of the provisions of the Schengen acquis, as provided for by the Agreement between the European Union, the European Community and the Swiss Confederation on the latter's association with the implementation, application and development of the Schengen acquis36.

Liechtenstein: This Regulation constitutes a development of the provisions of the Schengen acquis, as provided for by the Protocol between the European Union, the European Community, the Swiss Confederation and the Principality of Liechtenstein on the accession of the Principality of Liechtenstein to the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation's association with the implementation, application and development of the Schengen acquis37.

Croatia, Cyprus, Bulgaria and Romania: The visa policy including the VIS is part of the Schengen acquis not yet applicable by Member States not yet fully applying this acquis according to their Acts of Accesions. A simplified regime for controls of persons at the external borders was introduced in accordance with Decision No 565/2014/EU of the European Parliament and of the

19.

34 35 36 37


ECLI:EU:C:2010:631. OJ L 176, 10.7.1999, p. 36. OJ L 53, 27.2.2008, p. 52. OJ L 160, 18.6.2011, p. 19.

Council38. That regime is based on the unilateral recognition by Bulgaria, Croatia, Cyprus and Romania of certain documents, notably Schengen visas issued by the Member States applying the Schengen acquis in full as equivalent to their national visas for transit through or intended stays on their territories, not exceeding 90 days in any 180-day period. Council Decision (EU) 2017/1908 further allows Bulgaria and Romania access to consult, in a read-only mode, the VIS data without the right to enter, amend or delete data in the VIS, in order to facilitate their national visa application procedure and prevent fraud and any abuse of Schengen visas by verifying their validity and authenticity against the data stored in the VIS; to facilitate — with regard to third country nationals holding a short stay visa — checks at border crossing points at external borders and within the territory of the Member States; to facilitate the determination of the Member State responsible for applications for international protection; to facilitate the examination of such applications, and to increase the level of internal security in the territory of the Member States by facilitating the fight against serious crime and terrorism.

Since this Regulation constitutes a development of this acquis, in the sense of extending the VIS consultation and exchange of information to long-stay visas and residence permits, which are also recognised by these Member States as equivalent to their national visas for transit through or intended stays on their territories, Bulgaria and Romania should have access to consult the long-stay visas and residence permits for the same purposes as defined in Council Decision (EU) 2017/1908.

Decision No 565/2014/EU of the European Parliament and of the Council of 15 May 2014 introducing a simplified regime for the control of persons at the external borders based on the unilateral recognition by Bulgaria, Croatia, Cyprus and Romania of certain documents as equivalent to their national visas for transit through or intended stays on their territories not exceeding 90 days in any 180-day period and repealing Decisions No 895/2006/EC and No 582/2008/EC (OJ L 157, 27.5.2014, p. 23).

38