What changed between the draft committee report and the plenary report

Added:Recital 33: (33) In view of successfully preventing and monitoring unauthorised movements of third-country nationals or stateless persons who have no right to stay in the Union, and of taking the necessary measures for successfully enforcing effective return and readmission to third countries in accordance with Directive 2008/115/EC35 and the right to protection of personal data, a period of five years should be considered a necessary period for the storage of biometric and alphanumeric data.

Removed:Recital 50: (50) Transfers of personal data obtained by a Member State or Europol pursuant to this Regulation from the Central System to any third country or international organisation or private entity established in or outside the Union should be prohibited, in order to ensure the right to asylum and to safeguard applicants for international protection from having their data disclosed to a third country. This implies that Member States should not transfer information obtained from the Central System concerning: the name(s); date of birth; nationality; the Member State(s) of origin or Member State of allocation; the details of the identity or travel document; the place and date of application for international protection; the reference number used by the Member State of origin; the date on which the fingerprints were taken as well as the date on which the Member State(s) transmitted the data to Eurodac; the operator user ID; and any information relating to any transfer of the data subject under [Regulation (EU) No 604/2013]. That prohibition should be without prejudice to the right of Member States to transfer such data to third countries to which [Regulation (EU) No 604/2013] applies [in accordance with Regulation (EU) No […/2016] respectively with the national rules adopted pursuant to Directive [2016/…/EU] ], in order to ensure that Member States have the possibility of cooperating with such third countries for the purposes of this Regulation. That prohibition should be without preju…

Added:Recital 34: (34) The storage period should be shorter in certain special situations where there is no need to keep biometric data and all other personal data for that length of time. Biometric data and all other personal data belonging to a third-country national or a stateless person should be erased immediately and permanently once third-country nationals or stateless persons obtain citizenship of a Member State.

Removed:Amendment linked to Article1(1)(c) of proposal (non-codified) which provides that Eurodac will serve not only the purpose of implementation of the Dublin Regulation, but also law enforcement purposes. This provision foresees the possibility for Europol to transmit data obtained from Eurodac to third Parties, under specific conditions and in accordance with the applicable rules on external relations of the Europol Regulation. In fact, one of Europol’s added values is to create synergies between law enforcement information originating within and outside the EU. Internal and external dimensions of the security of the Union are very much interlinked.

Added:Recital 37: (37) It is necessary to lay down clearly the respective responsibilities of the Commission and eu-LISA, in respect of the Central System, the Communication Infrastructure and interoperability with other information systems, and of the Member States, as regards data processing, data security, access to, and correction of recorded data.

Removed:Recital 51: (51) In individual cases, information obtained from the Central System may be shared with a third-country in order to assist with the identification of a third-country national in relation to his/her return. Sharing of any personal data must be subject to strict conditions. Where such information is shared, no information shall be disclosed to a third-country relating to the fact that an application for international protection has been made by a third-country national or a stateless person where the country the individual is being readmitted to, is also the individual's country of origin or another third-country where they will be readmitted. Any transfer of data to a third-country for the identification of a third-country national or a stateless person must be in accordance with the provisions of Chapter V of Regulation (EU) No. [679/2016].

Added:Recital 42: (42) In addition, access should be allowed only on condition that a prior search in the national fingerprint and facial image databases of the Member State and in the automated fingerprinting identification systems of all other Member States under Council Decision 2008/615/JHA36 has been conducted. That condition requires the requesting Member State to conduct comparisons with the automated fingerprinting identification systems of all other Member States under Decision 2008/615/JHA which are technically available, unless that Member State can justify that there are reasonable grounds to believe that it would not lead to the establishment of the identity of the data subject. Such reasonable grounds exist in particular where the specific case does not present any operational or investigative link to a given Member State. That condition requires prior legal and technical implementation of Decision 2008/615/JHA by the requesting Member State in the area of fingerprint data, as it should not be permitted to conduct a Eurodac check for law enforcement purposes where those above steps have not been first taken.

Removed:Article 1 – paragraph 1 – point b: (b) assist with the control of illegal immigration and secondary movements within the Union and with the identification of illegally staying third-country nationals and stateless persons for determining the appropriate measures to be taken by Member States, including removal, repatriation and return measures for third-country nationals and stateless persons staying illegally.

Added:Recital 43: deleted / (deleted)

Removed:Article 1 – paragraph 1 – point c: (c) lay down the conditions under which Member States' designated authorities may request the comparison of biometric data and alphanumeric data with those stored in the Central System for law enforcement purposes for the prevention, detection or investigation of terrorist offences or of other serious criminal offences, as well as the conditions under which the European Police Office (Europol) may make comparisons against Eurodac data for the purpose of the performance of its tasks.

Added:Recital 50: (50) Transfers of personal data obtained by a Member State or Europol pursuant to this Regulation from the Central System to any third country or international organisation or private entity established in or outside the Union should be prohibited, in order to ensure the right to asylum and to safeguard applicants for international protection and resettled third-country nationals and stateless persons in accordance with [Regulation XXX/XXX] from having their data disclosed to a third country. This implies that Member States should not transfer information obtained from the Central System concerning: the name(s); date of birth; nationality; the Member State(s) of origin or Member State of allocation or the Member State of resettlement; the details of the identity or travel document; the place and date of resettlement or of the application for international protection; the reference number used by the Member State of origin; the date on which the fingerprints were taken as well as the date on which the Member State(s) transmitted the data to Eurodac; the operator user ID; and any information relating to any transfer of the data subject under [Regulation (EU) No 604/2013]. That prohibition should be without prejudice to the right of Member States to transfer such data to third countries to which [Regulation (EU) No 604/2013] applies [in accordance with Regulation (EU) No […/2016] respectively with the national rules adopted pursuant to Directive [2016/…/EU] ], in order to ensure…

Removed:The purpose allowing Europol to use Eurodac data for comparisons differ from the purpose of national law enforcement authorities. Europol does not have law enforcement coercive powers. Its mandate is not to prevent, detect and investigate terrorist and other serious criminal offences but to support the competent national authorities of MSs to do so. Therefore, a separate indication of the purpose for the processing of Eurodac data by Europol is needed.

Added:Recital 51: (51) In individual cases, information obtained from the Central System may be shared with a third-country in order to assist with the identification of a third-country national or a stateless person in relation to his/her return. Sharing of any personal data must be subject to strict conditions. Where such information is shared, no information shall be disclosed to a third-country relating to the fact that an application for international protection has been made by a third-country national or a stateless person where the country the individual is being readmitted to, is also the individual's country of origin or another third-country where they will be readmitted. Any transfer of data to a third-country for the identification of a third-country national or a stateless person must be in accordance with the provisions of Chapter V of Regulation (EU) No. [679/2016].

Removed:Article 2 – paragraph 2: 2. Taking biometric data of minors from the age of six shall be carried out in a child-friendly and child-sensitive manner by officials trained specifically to enrol minor's fingerprints and to capture facial images. The minor shall be informed in an age-appropriate manner, both orally and in writing, using leaflets and/or infographics and/or demonstrations specifically designed to explain the fingerprinting and facial image procedure to minors and they shall be accompanied by a responsible adult, guardian or legal representative at the time their biometric data are taken. At all times Member States must respect the dignity and physical integrity of the minor during the fingerprinting procedure and when capturing a facial image.

Added:Article 1 – paragraph 1 – point a a (new): (aa) assist with the identification of secondary movements of third-country nationals or stateless persons resettled in accordance with [Regulation XXX/XXX];

Removed:Article 2 – paragraph 3: 3. Member States shall introduce administrative sanctions, in accordance with their national law, for non-compliance with the fingerprinting process and capturing a facial image in accordance with paragraph 1 of this Article. These sanctions shall be effective, proportionate and dissuasive. In this context, detention should only be used as a means of last resort in order to determine or verify a third-country national's identity.

Added:Article 1 – paragraph 1 – point b: (b) assist with the control of illegal immigration to the Union and with the identification of secondary movements and of illegally staying third-country nationals and stateless persons for determining the appropriate measures to be taken by Member States, including as appropriate, removal and return of illegally staying third-country nationals and stateless persons, or granting permanent resident status;

Removed:Article 3 – paragraph 1 – point o a (new): (oa) "biometric data" means fingerprint data and facial image data;

Added:Article 1 – paragraph 1 – point c: (c) lay down the conditions under which Member States' designated authorities may request the comparison of biometric data and alphanumeric data with those stored in the Central System for law enforcement purposes for the prevention, detection or investigation of terrorist offences or of other serious criminal offences. This Regulation shall also lay down the conditions under which the European Police Office (Europol) may request comparisons with Eurodac data for the purpose of preventing, detecting or investigating terrorist offences or other serious criminal offences falling within its mandate.

Removed:Amendment relating to horizontal Amendment 2 and needed to ensure the internal logic of the text.

Added:Article 1 – paragraph 2: 2. Without prejudice to the processing of data intended for Eurodac by the Member State of origin in databases set up under the latter's national law, fingerprints and facial image data and other personal data may be processed in Eurodac only for the purposes set out in this Regulation and [Article 34(1) of Regulation (EU) ....]. The data of minors may be used by the Member States for the purposes of assisting them in the identification and tracing of missing children and of establishing family links of unaccompanied minors.

Removed:Article 3 – paragraph 1 – point o b (new): (ob) "alphanumeric data" means data represented by letters, digits, special characters, spaces and punctuation marks;

Added:Article 2 – paragraph 1: 1. The persons referred to in Articles 10(1), 13(1) and 14(1) shall be registered. Therefore, Member States shall take those person’s biometric data for the purposes of Article 1(1)(a) and (b) of this Regulation and shall impose on the data-subject the requirement to provide his or her biometric data and inform him or her as such in accordance with Article 30 of this Regulation. Member States shall, at all times, respect the dignity and physical integrity of the person during the fingerprinting procedure and when capturing his or her facial image.

Removed:Amendment relating to Amendment 9 and needed to ensure the internal logic of the text.

Added:Article 2 – paragraph 2: deleted

Removed:Article 3 – paragraph 1 – point o c (new): (oc) 'residence document' means a residence document as defined in point (...) of Article of Regulation ... [COD(2016)0133; Dublin IV];

Added:(See Amendment relating to Article 2 a paragraph 1)

Removed:New definition introduced to a term used in a non-codifed text (Art. 19(5)) to ensure the internal logic of the text

Added:Article 2 – paragraph 3: 3. In order to ensure that all the persons referred to in Articles 10(1), 13(1) and 14(1) are registered in accordance with paragraph 1, Member States may introduce, where appropriate, well-justified administrative sanctions, in accordance with their national law and with full respect for the Charter of Fundamental Rights of the European Union, for non-compliance with the process of taking biometric data. Member States shall ensure that an opportunity for counselling has been provided to those persons in order to persuade them to cooperate with the procedure and to inform them of the possible implications of non-compliance. The administrative sanctions shall be effective, proportionate and dissuasive. Detention shall only be used as a means of last resort and for as short a period as possible and necessary in order to determine or verify a third-country national's identity and, in particular, where there is a risk of absconding. Where a decision is taken to detain a third-county national or a stateless person, competent national authorities shall carry out an assessment in each individual case in order to verify whether the detention complies with all legal and procedural safeguards to prevent arbitrary detention.

Removed:Article 3 – paragraph 1 – point o d (new): (od) 'interface control document' means a technical document that specifies the necessary requirements to which the national access points referred to in Article 4(3) are to comply with in order to be able to communicate electronically with the Central System, in particular by detailing the form and possible content of the information to be exchanged between the Central System and the national access points.

Added:Article 2 – paragraph 4: 4. Without prejudice to paragraph 3 of this Article, where enrolment of the fingerprints or facial image is not possible from third-country nationals or stateless persons who are deemed to be vulnerable persons due to the conditions of the fingertips or face, the authorities of that Member State shall not use sanctions for non-compliance with the obligation to provide biometric data. A Member State may attempt to re-take the fingerprints or facial image of a vulnerable person who refuses to comply, where the reason for non-compliance is not related to the conditions of the fingertips or facial image or the health of the individual and where it is duly justified to do so.

Removed:New definition introduced to a term used in a non-codifed text (Article 23(2)) to ensure internal logic of the text.

Added:Article 2 – paragraph 5: 5. The procedure for taking fingerprints and a facial image shall be determined and applied in accordance with the national practice of the Member State concerned and in accordance with the safeguards laid down in the Charter of Fundamental Rights of the European Union and in the Convention for the Protection of Human Rights and Fundamental Freedoms.

Added:Article 2 a (new): Article 2a / Special provisions relating to minors / 1. The biometric data of minors from the age of six shall be taken by officials trained specifically to enrol minor's fingerprints and to capture facial images in full respect of the best interests of the child, the principles established by the United Nations Convention on the Rights of the Child in a child-friendly and child-appropriate and gender-appropriate manner. The minor shall be informed in an age-appropriate manner, both orally and in writing, using leaflets and infographics and demonstrations specifically designed to explain the fingerprinting and facial image procedure to minors in a language he or she can understand. The minor shall be accompanied by a responsible adult or legal guardian throughout the time his or her biometric data are taken. At all times Member States shall respect the dignity and physical integrity of the minor during the fingerprinting procedure and when capturing a facial image. Member States shall not use coercion to compel the taking of fingerprints of minors. Detention of minors shall be prohibited. / 2. Where the enrolment of the fingerprints or facial image of a minor is not possible due to the conditions of the fingertips or face, Article 2(3) shall apply. Where the fingerprints or facial image of a minor are retaken, the Member State concerned shall proceed in accordance with paragraph 1 of this Article. Where a minor, in particular an unaccompanied or separated minor, refuses to gi…

Added:(Paragraph 1 reproduces the substance of Article 2 paragraph 2)

Added:Article 3 – paragraph 1 – point a a (new): (aa) 'resettled third-country national or stateless person’ means a third-country national or stateless person who, following a resettlement procedure in accordance with national law or with [Regulation XXX/XXX], arrives on the territory of the Member State of resettlement.

Added:Article 3 – paragraph 1 – point b – subpoint i a (new): (ia) in relation to a person covered by Article 12a, the Member State which transmits the personal data to the Central System and receives the results of the comparison;

Added:Article 3 – paragraph 1 – point d: (d) 'illegal stay' means the presence on the territory of a Member State, of a third-country national or stateless person who does not fulfil, or no longer fulfils the conditions of entry as set out in Article 5 of the Schengen Borders Code or other conditions for entry, stay or residence in that Member State;

Added:Article 3 – paragraph 1 – point f: (f) 'hit' means the existence of a match or matches established by the Central System by comparison between biometric data recorded in the computerised central database and those transmitted by a Member State with regard to a person, without prejudice to the requirement that Member States shall immediately check the results of the comparison pursuant to Article 26(4);

Added:Article 3 – paragraph 1 – point j: (j) 'Eurodac data' means all data stored in the Central System in accordance with Article 12, Article 12a, Article 13(2) and Article 14(2);

Added:Article 3 – paragraph 1 – point k: (k) 'law enforcement' means the prevention, detection, investigation or prosecution of terrorist offences or of other serious criminal offences; / (This amendment applies throughout the text. Adopting it will necessitate corresponding changes throughout.)

Added:Article 3 – paragraph 1 – point l: (l) 'terrorist offences' means the offences referred to in Articles 3 to 12 of Directive (EU) 2017/... of the European Parliament and of the Council [on combating terrorism and replacing Council Framework Decision 2002/475/JHA and amending Council Decision 2005/671/JHA].

Added:Article 3 – paragraph 1 – point o a (new): (oa) ‘biometric data’ means fingerprint data and facial image data; / (This amendment applies throughout the text. Adopting it will necessitate corresponding changes throughout.)

Added:Article 3 – paragraph 1 – point o b (new): (ob) 'stateless person' means a person who is not considered to be a national of any State under the operation of its law.

Added:Article 3 – paragraph 1 – point o c (new): (oc) 'alphanumeric data' means data represented by letters, digits, special characters, spaces and punctuation marks;

Added:Article 3 – paragraph 1 – point o d (new): (od) 'residence document' means a residence document as defined in point (...) of Article of Regulation ... [COD(2016)0133; Dublin IV];

Added:Article 3 – paragraph 1 – point o e (new): (oe) 'interface control document' means a technical document that specifies the necessary requirements with which the national access points referred to in Article 4(3) are to comply in order to be able to communicate electronically with the Central System, in particular by detailing the form and possible content of the information to be exchanged between the Central System and the national access points.

Article 4 – paragraph 2: 2. The EURODAC Communication Infrastructure will be using the existing 'Secure Trans European Services for Telematics between Administrations' (TESTA) network. In order to ensure confidentiality, personal data transmitted to or from Eurodac shall be encrypted.

Change 5

Removed:The amendment aims to ensure data confidentiality (as is the case today, but this is made more explicit) without the need to move to a dedicated virtual private network. The initial paragraph was admitted by COM as contradicting with the intentions of COM, as technical discussions on the topic are ongoing between COM and eu-LISA. The amendment allows to either stay on the Eurodomain network over Testa, or migrate to a dedicated network over Testa as is the case for SIS II, VIS (upon readiness and impact assessment by eu-LISA, but this is not to be tackled in this Regulation.

Added:Article 4 – paragraph 3: 3. Each Member State shall have a single National Access Point. Europol shall have its own access point.

Removed:Article 5 – paragraph 2 – subparagraph 2: In such cases, the security measures, access control and logging activities at the testing environment shall be equal to the ones for the Eurodac production system. Real personal data adopted for testing shall be rendered anonymous in such a way that the data-subject is no longer identifiable. After the testing purpose is achieved, such real personal data shall be permanently erased from the testing environment.

Added:Article 4 – paragraph 4: 4. Data on persons covered by Articles 10(1), 12a, 13(1) and 14(1) which are processed in the Central System shall be processed on behalf of the Member State of origin under the conditions set out in this Regulation and separated by appropriate technical means.

Removed:Article 5 – paragraph 5: deleted

Added:Article 5 – paragraph 2 – subparagraph 1 – introductory part: Eu-LISA shall be permitted to use real personal data of the Eurodac production system for testing purposes, in accordance with Regulation (EU)2016/679, and in strict compliance with Article 17 of the Staff Regulations1a in respect of every person involved in the testing only in the following circumstances: / 1a Council Regulation (EEC, Euratom, ECSC) No 259/68 of the Council of 29 February 1968 laying down the Staff Regulations of Officials of the European Union and the Conditions of Employment of Other Servants of the European Union (OJ L 56, 4.3.1968, p.1).

Removed:The proposal has included DubliNet and the operational responsibility of eu-LISA in Article 5 (5) which provides for the operational management of Eurodac , which was not entirely correct (see also relevant Amendments 58). The relevant text with additional provisions on the operational responsibility is tabled as amendment to Regulation 1077/2011(see Amendment 59).

Added:Article 5 – paragraph 2 – subparagraph 2: In such cases, the security measures, access control and logging activities at the testing environment shall be equal to the ones for the Eurodac production system. Real personal data adopted for testing shall be subject to stringent conditions and rendered anonymous in such a way that the data-subject is no longer identifiable. Once the purpose for which the testing was carried out has been achieved or the tests have been completed, such real personal data shall be immediately and permanently erased from the testing environment. Eu-LISA shall ensure that relevant guarantees are provided in respect of the accessing of data by external contractors, in accordance with Articles 24 to 28 of Regulation (EU) 2016/679.

Removed:Article 7 – paragraph 2 – subparagraph 1: 2. The verifying authority shall ensure that the conditions for requesting comparisons of biometric or alphanumeric data with Eurodac data are fulfilled.

Added:Article 5 – paragraph 3 – point c a (new): (ca) interoperability with other information systems.

Removed:Under the proposal, national law enforcement authorities and Europol cannot request comparison with specific alphanumeric data, which is highly detrimental to investigations, especially in the counter-terrorism field, trying to establish the places and dates of entry in the EU of suspects for which a used identity is known, but no fingerprint is available. In this context, and given that Art.1.1(c) of the proposal, extends its scope of Eurodac to law enforcement purposes, it would be essential for national law enforcement authorities and Europol to have access to all data contained in Eurodac in order to properly carry out their tasks.

Added:Article 6 – paragraph 1: 1. For the purposes laid down in Article 1(1)(c), Member States shall designate the authorities that are authorised to request comparisons with Eurodac data pursuant to this Regulation. Designated authorities shall be authorities of the Member States which are responsible for the prevention, detection or investigation of terrorist offences or of other serious criminal offences.