An assessment of the proposals of regulation and decision which define the purpose, functionality and responsibilities of the future SIS II

IP/C/LIBE/FWC/2005-08

«Management of the European External Borders»

DG Internal Policies of the Union

Directorate C – Citizens’ Rights and Constitutional Affairs

BRIEFING PAPER: ORDER FORM No IP/C/LIBE/OF/2005-168

An assessment of the proposals of regulation and decision which define the purpose, functionality and responsibilities of the future SIS II.

15 February 2006

TABLE OF CONTENTS

1. Introduction .......................................................................................................................... 1

2. Second generation SIS: proposed features and working mechanisms............................ 1

2.1. Specific features of the proposed Decision (D)....................................................... 2

2.2. Specific features of the proposed Regulation (R).................................................. 2

3. The sensitive points of SIS II............................................................................................... 2

3.1. Legislative technique and structure....................................................................... 3

3.2 General features of SIS II: purpose, organisation and working methods……… 3

3.2.1. Dual purpose of SIS II – free movement and crime control …………….. 3

3.2.2. Democratic deficits in the preparatory phase and after …………………. 3

3.2.3. Lack of guidance for the use of alerts…………………. …………………. 4

3.2.4. Legal remedy against unjustified refusal of entry………. ………………. 5

3.3. Data protection………. ………………………………………………………….. 5

3.3.1. Overlapping provisions and loopholes………. ………………………….. 5

3.3.2. Precision of purpose description………. ………………………………… 5

3.3.3. Access granted to Europol, Eurojust and national judicial authorities ………. 5

3.3.4. Supervision and controlling………. ……………………………………… 5

3.3.5. Rights of the individual: legal remedies and retention periods……….... 6

3.4. Data security and system architecture………. ………………………………… 6

4. Recommendations to the European Parliament .............................................................. 6

Bibliography............................................................................................................................. 7

Annex: Table – ‘The proposed SIS II: Who has access to which alert?’………………… 8

Abstract

The reform of the Schengen Information System (SIS) is a major milestone in the development of the Area of Freedom, Justice and Security, if not for the EU as such, but the process has not been carried out with the appropriate levels of publicity and democratic control. With the Commission proposals of May 2005 marking the emergence of the new SIS II from the more secretive ‘Third Pillar’ environment, there is now a golden opportunity to examine the proposed legislation thoroughly. It is widely held that the current drafts are a clear improvement on earlier versions. However, a number of sensitive features still need attention, in particular how far new mechanisms and the wider involvement of enforcement and judicial authorities have come with legal safeguards to ensure that data protection and other human rights are respected. The introduction of biometric data into alert records, the interlinking of alerts and possible ‘mergers’ with separate databases (e.g. VIS) should also be examined.

The European Parliament can expect to have an attentive audience given that, in addition to the opinion it is requested to deliver on the ‘Third Pillar’ part of SIS II (proposed Decision), it has full co-decision power on the ‘First Pillar’ project of Regulation.

Abbreviations

D Decision (relates to the Proposal for a Council Decision on the establishment, operation and use of the second generation Schengen information system (SIS II), COM(2005) 230 final)

EAW European Arrest Warrant

EDPS European Data Protection Supervisor

EP European Parliament

JSA Schengen Joint Supervisory Authority

LIBE Committee on Civil Liberties, Justice and Home Affairs of the European Parliament

R Regulation (relates to the Proposal for a Regulation of the European Parliament and of the Council on the establishment, operation and use of the second generation Schengen information system (SIS II), COM(2005) 236 final/2)

SIRENE Supplementary Information REquest at National Entry, ie the follow-up communication mechanism to be used between national authorities once searches in SIS lead to a hit

SIS Schengen Information System

TEC Treaty on the European Community

TEU Treaty on the European Union

VIS Visa Information System An assessment of the proposals of regulation and decision which define the purpose, functionality and responsibilities of the future SIS II

Peter Hobbing [1]

1. Introduction

The Schengen Information System (SIS) is rightly considered the backbone of ‘borderless’ Europe and the Area of Freedom, Security and Justice [2]. It is thus no surprise that its profound reform - after just 11 years of operation - is a major event for the European Union as a whole. Alongside technical innovation and the emergence of new security risks, the prospect of accession by 10 new members was the main reason for the review of its operations as from the late 1990s.

The current SIS I+ was designed for a maximum of 18 members (15 Member States, Norway, Iceland and one reserve) – by 2004 at the latest, the enlargement round would have largely exceeded its capacities as would access by additional bodies such as Europol, Eurojust, national judicial authorities and security services. SIS is also technically outdated as it cannot hold other than alphanumeric data, i.e. in particular photos and fingerprints. And finally, there was the concern, after the events of 11 September 2001, that a purely control-oriented data system would not be appropriate any more for covering specific security risks.

Given the importance of the event, it is regrettable that the procedure for the redesign of SIS was not transparent enough and that the solutions put forward were not simple enough. The general impression among the public (and even among some in the EU institutions) seemed to be that SIS II as proposed was a «complex and opaque project - hard to understand, even for experts and absolutely incomprehensible to citizens» (MEP Coelho, November 2003) [3].

The difficulty is due to a number of factors, in particular that SIS with its dual implications for free movement as well as police and criminal justice matters lies right on the edge between the first and third EU pillars and thus each time requires two instruments (regulation and decision) to regulate the same real world situation. On top of this, the reform did not tackle the whole subject all at once but in a staggered order, starting with two instruments on system development in 2001 [4], adding another two on new system functionalities in 2004/2005 [5], before addressing the current subject with the package of 3 Commission proposals presented on 31 May 2005 [6]. As a result, the subject has various overlaps and cross-references that make it hard for people to find their bearings.

Furthermore, certain security-oriented discussions of SIS II, which were held in Council fora operating under increased confidentiality, have created the impression that important aspects were not handled with full democratic transparency. [7]

2. SIS II and its proposed features/working mechanisms

The proposed SIS II continues to work with the same basic features as its predecessor [8], i.e. its alert-system allows for searches only on a «hit/no hit-basis» [9] (as opposed to an investigation system with more refined search facilities). SIS II only contains minimum information (cf. Articles 16(1), 25(3) R, Articles 39(1), 44(3) D). Full case information may, after a hit, be obtained through conventional contacts between the national SIRENE offices. Member state authorities can enter data, access and perform searches either in the SIS II central database (CS-SIS) or in a national copy of it (NS) (Art. 4). The Commission is responsible for the management of the central database (Art. 12) and the costs incurred come out of the EU budget (Art. 5). System sites for SIS II/VIS will be Strasbourg (main system) and St. Johann im Pongau/Salzburg (back-up systems).

Apart from the identical introductory provisions (Art. 1-14), the two instruments differ considerably. In both cases, the most important innovations are the introduction of new types of alerts [10] and extended access to alerts by authorities at national or EU level, mainly in the field of internal security. Both instruments now foresee biometric data (photos, fingerprints) contained in alert records (Art. 39 (1)(d-e) D, Art. 16(1)(d-e) R) to allow for a more reliable identification of persons (not yet biometric searches as such!) and the interlinking of alerts (Art. 26 R, 46 D) in order to enhance the operational use of SIS II.

The proposals foresee, inter alia, extensive provisions on data protection and legal remedies in case of infringements. They will replace Title IV of the Schengen Convention containing the current provisions on SIS.

2.1. Specific features of the proposed Decision (D)

Besides taking over most of the traditional alerts from the Schengen Convention [11], the proposed decision introduces the European Arrest Warrant (EAW) [12]as a new form of alert (Art. 15) accompanied by all data contained in the warrant (Art. 16 (1)). This is an important exception from the principle of restricted data retention in SIS records (cf. Art. 39 (1)). Another new category labelled ‘violent troublemakers’ (e,g. football hooligans), which was temporarily considered for alert, has been dropped.

Police and border authorities have traditionally been given access to SIS, In addition to them, four groups of authorities - Europol, Eurojust, national judicial authorities and vehicle registration authorities – have been granted access to SIS II. For most of them access is subject to certain restrictions, e.g. via the clause «where necessary for the performance of their tasks». [13]

2.2. Specific features of the proposed Regulation (R)

The Regulation contains only one type of alert (refusal of entry, Art. 15), which, in comparison to the former Art. 96 Schengen Convention, introduces a number of safeguards to ensure an acceptable interpretation of the term «serious threat to public policy or security» by national authorities. Particular reference is made to EU instruments stipulating rights of admission/residence for third country nationals (Art. 15 (2)).

Access is exclusively granted to border authorities as well as authorities issuing visas or responsible for immigration, asylum and refugee matters (Art. 17, 18) - there is no mention of Europol or other internal security agencies. This restriction may also be seen in connection with the recent Commission communication on the interoperability of JHA databases [14]: which confirms the principle of purpose limitation to exclude enforcement authorities from certain data. [15]

3. The sensitive points of SIS II

From the very outset, there have been a lot of critical statements accompanying the planning and development of the project. The reason for this was partly to do with the somewhat secretive atmosphere, which gave rise to speculation about the true legislative intentions pursued. Official documents available combined with assumptions made on the basis of these documents led to civil liberties organisations and others producing long lists of critical observations. These may serve as a basis for a critical look at the proposals currently on the table [16]. It is nevertheless advisable to make a careful comparison of all references with the final version of the proposed, Besides the well-founded objections, there are assumptions for which there is no evidence in the drafts or which have become obsolete by the texts actually presented [17].

3.1. Legislative technique and structure

A frequent criticism of the 2nd generation SIS is that it has been developed via numerous ad hoc amendments of the old rules contained in Title IV of the 1990 Schengen Convention instead of by designing one comprehensive and transparent legal document [18]. Besides numerous instruments, initiatives and relevant Council conclusions since 1999, not even the current proposal fits into one text but is presented in three parts. It is true that, due to the unfortunate failure of the Constitution, the dichotomy between the First and Third Pillars continues to exist [19], requiring a division of the relevant subject matter into two separate files, one based on Art. 30 ff TEU and the other on Art. 62, 66 TEC.

This produces considerable overlapping of texts (Art. 1 – 14 are practically identical) but also contradictions and possible misunderstanding. Authorities responsible for carrying out checks on people at the external border (and thus granted access to certain alerts) are identified as such in Art. 17 R, whereas in the Decision the same group is labelled «border authorities» (Art. 18, 24 D). Such incoherent terminology also causes confusion regarding the customs authorities which are considered as an integral part of the standard set of border authorities. If this was not wanted in this case, different terminology or a definition to this end in Art. 3 would have been advisable.

At first sight, it would appear technically less understandable that there is still a third proposal [20] to regulate one individual access issue, i.e. that by vehicle registration authorities to access alerts based on Art. 35 (a), (b) and (f) of the Decision (objects for seizure and use as evidence). But it is again the «pillar split» which requires this complicated manoeuvre to grant access for a ‘First Pillar’ authority (Art. 71 TEC), to a ‘Third Pillar’ matter (stolen vehicles).

The good news is, however, that the current proposals would, if adopted, abrogate the whole set of pre-2006 legislation, including the entire Title IV of the Schengen Convention (Art. 62 D, Art. 36 R).

3.2 General features of SIS II: purpose, organisation and working methods

The following SIS II features are worth raising as they have been criticised.

3.2.1. Dual purpose of SIS II

Some critics regret that SIS II – beyond its former remit as a compensatory measure ensuring the free movement of persons in the EU – now also serves increasingly for crime control purposes, especially to fight terrorism and serious crime [21]. This new direction clearly has some repercussions on the working routines of the system, notably as regards data access (including its limitations) for the authorities concerned. These issues need to be handled in the sense of purpose limitation, i.e. that access cannot go any further than the legitimate purpose pursued by the authority in question. In view of the changing challenges, it does not, however, seem feasible to confine SIS II to one fixed purpose for all time. For the same reason, the purpose description should not be too narrow in order to allow for some flexibility to adapt to new situations. [22]

3.2.2. Democratic deficits in the preparatory phase and after

The lack of transparency has been regretted by many [23], notably as regards the low level of involvement of the European Parliament and other relevant instances such as the JSA (Schengen Joint Supervisory Authority).

The lack of a profound public debate is often explained by the political urgency of the matter: in order to comply with the 2007 deadline for the link-up of new Member States, technical decisions had to be taken at an early stage, long before the completion of legislative procedures. The safeguard for such strategy would lie in the provisional deactivation of any new function, i.e. until the legislator takes a formal decision (for further details see 3.3.2 below).

From the Commission point of view, this is closely connected with the Third Pillar-related procedures prevailing in the Council discussions, especially during the first phase of discussions. However, with the decision for a treaty-based legislative process based on formal Commission initiatives, this situation has considerably changed [24]. First of all, the EP now has the opportunity to join in the procedure and significantly influence its outcome. Even if, as regards the proposed Decision, EP involvement is limited to consultation (Art. 39 TEU), the draft Regulation based on Title IV TEU, and thus subject to the co-decision procedure, can pass only the with EP’s express consent. The practical importance of this involvement is all the greater as SIS II may become operational only when both instruments have been adopted.

Once operational, SIS II is subject to various mechanisms ensuring transparency and institutional involvement as is typically the case with Community ‘First Pillar’ legislation. Both instruments foresee advisory and regulatory committees (‘comitology’) in the sense of Council Decision 1999/968/EC [25], chaired by the Commission. In case of diverging opinions on the implementing measures proposed, the issue is referred to the Council, with simultaneous notification to the Parliament [26].

Further transparency gaps [27] are closed by the Commission’s obligation to produce a report on the operation of SIS II every two years (Art. 34(4) R and 59(3) D) and an overall evaluation every four years (Art. 34(4)R and 59(4)D). The list of authorities competent to process SIS II data has to be published in the Official Journal (Art. 21(3) R, 40(4) D).

3.2.3. Lack of guidance for member states regarding alerts

A major complaint over the years has been that the original SIS provisions did not foresee harmonised rules as to the creation of alert records in the system, particularly «the broad grounds under which people can be registered as ‘illegal aliens’ to be refused entry (Art. 96 Schengen Convention)» [28]

There seems to be a major discrepancy between member states regarding the classification of failed asylum seekers: according to the practice adopted in Germany and Italy, these are routinely considered «illegal aliens» and thus flagged in the system – which explains why these two countries account for more than 75% of the alerts under Art. 96!

This conflicting situation has been highlighted by the recent judgment of the Court of Justice of 31 January 2006 [29] which pointed to the existence of such unjustified alerts and the requirement that member states take note of the alert to verify, before refusing entry, whether the presence of the third country national concerned truly constituted a threat in the sense of Art. 96.

It is reassuring to see, however, that similar cases are less likely to occur under the new legislation: as distinct from the former practice, Art. 15 R cites a number of specific circumstances to be considered [30] as well as instruments to be consulted [31] by the relevant authorities before issuing an alert.

3.2.4. Legal remedy against unjustified refusal of entry

The proposed regulation seems to include a weakening of the actual right of third country nationals to legal remedies against the refusal of entry based on SIS. Different from the current wording of Article 111 of the Schengen Convention, Art. 30(1)R and 52(1)D confine this right to persons who find themselves inside the territory of a member state. This situation appears entirely inappropriate and should be modified by readapting it to former Art. 111(1) Schengen Convention. [32]

3.3. Data protection

3.3.1. Overlapping provisions and loopholes

As another direct consequence of the ‘pillar dichotomy’, there will be four legal instruments applicable to data protection as covered by the proposed legislation, i.e. Art. 8 ECHR regarding the fundamental right for data protection, the 1981 Council of Europe Convention on automatic processing of personal data (Convention 108), Directive 95/46/EC on the processing of personal data and Regulation (EC) 45/2001 on the processing of such data by Community institutions.

As Directive 95/46 applies to ‘First Pillar’ legislation only and Regulation 45/2001 to data processed by EU institutions and bodies only, the remaining processing by member states is solely subject to Convention 108 with a less developed level of protection. A way to improve this unsatisfactory level of protection by means of approximating standards would be to finalise the proposed framework decision on data protection in the third pillar. [33]

3.3.2. Precision of ‘purpose description’

In the context of the dual purpose character of SIS II (see 3.2.1), an objection has been raised that the «flexible» wording of Art. 1 and 2 of the Decision («maintain a high level of security») was not in conformity with the established principle of ‘purpose limitation’ - there should be a «clearer and more explicit wording» [34]. Commission and Council, however, stress the argument that in order for them to respond to the changing challenges in the short term, some flexibility in the ‘purpose description’ is essential. [35] ‘Purpose limitation’ clauses for each individual category of alert and for each SIS II access granted have been the concrete data protection safeguards to date. Access by additional authorities would require the same legislative procedure.

3.3.3. Access granted to Europol, Eurojust and national judicial authorities

Existing objections towards SIS II access granted to these authorities [36] have been met by the purpose limitation approach chosen by the proposals: none of these authorities is granted general access to all alert types but only those which fall under its specific remit. Further limitations exist for Europol and Eurojust in Art. 57,58 D (consent by member state concerned is necessary for the use of the data) [37]. An additional safeguard exists in view of the so-called linked alerts: access to the links is granted only where the authority concerned has competence in that area [38]. A similar solution exists with regard to the alert under Art. 16 D (European Arrest Warrant). In view of the additional data categories contained in these records, Europol can, according to the Europol Convention, only access this data if it needs it to carry out its tasks.

3.3.4. Supervision and control

As a direct consequence of the pillar dichotomy and the applicability of various data protection instruments (see 3.2.1 above), the situation regarding supervision and controlling is also at times inconsistent [39]. While the treatment of data processing by member states remains unchanged, it has also been agreed that Regulation 45/2001 applies to all processing carried out by the Commission and supervision will be exercised by the European Data Protection Supervisor (EDPS). However, various questions relating to the extent of EDPS competence and possible joint controlling functions by Commission and member states have been raised by the JSA [40] and should be clarified before the legislation is finalised.

3.3.5. Rights of the individual: legal remedies and retention periods

The existing remedies (Art. 52D, Art. 30R) and the obligatory recording of data transmissions are generally well received [41]. But a crucial remaining problem lies in the uncertainty for the individual as to whether data relating to him/her are stored in the system. While Art. 28R requires automatic notification of the processing/storage to the person concerned, the Decision foresees no such obligatory information (cf. Art. 50(1)D) [42]. Efforts should be made to give both mechanisms the same level of protection.

In comparison to the former legislation, data retention periods have been schematically increased, some from 3 to 10 years. Some results are considered «absurd», [43] if alerts on missing minors are kept a long time after they have reached the age of majority (Art. 25(2) D).

3.4. Data security and system architecture

One of the major concerns relates to possible security risks caused by the «latent development» of additional SIS II functions (e.g. adding such functions in order to prepare for possible future scenarios). It is stressed that, despite the current deactivation of these functions, there may be means to circumvent the safeguards and use the functions without previous legislative consent. [44] Such abuse could consist in switching, within SIS II, towards the use of investigative functions instead of the current ‘hit/no hit’ mechanism, towards biometric searches instead of mere verification functions. [45] In the same context, the notion of a common technical platform/interoperability between SIS II and VIS could be interpreted as ‘institutional speak’ for their latent integration. [46]

IT specialists, however, stress that such manoeuvres are not likely to occur in practice. In particular, there seems to be no increased risk from the mere fact that two separate databases are maintained at the same geographical location or in the same building.

The proposals comply with previous EP requests (EP 2003) insofar as they foresee that operational management of SIS II be entrusted to an EU agency under Community status (and thus subject to EP control) and that there should be no involvement of private companies [47].

4. Recommendations to the European Parliament

Carefully examine all three current proposals relating to SIS II. Even if COM(2005) 230 is subject to consultation only, all EP comments are likely to be considered with due attention in view of the pending co-decision procedure for COM(2005) 236 and 237.

Pay particular attention to previous recommendations adopted by the EP, notably those of 20 November 2003, to determine to what extent they have been taken into account by the proposals.

Examine the opinion delivered by the Joint Supervisory Authority of Schengen because this institution has so far not formally been consulted in the legislative procedure.

Take into account further statements/criticism pointing to possible/established weaknesses in the proposals.

Bibliography

Apap, J., Carrera, S. (2005), The European Arrest Warrant – A Good Testing Ground for Mutual Recognition in the Enlarged EU?, CEPS, January.

Balzacq, T., D. Bigo, S. Carrera and E. Guild (2005), Security and the Two-Level Game: The Treaty of Prüm, the EU and the Management of Threats,Centre for European Policy Studies, Brussels.

Brouwer, E. (2005), Data surveillance and border control in the EU: Balancing efficiency and legal protection of third country nationals,June:http://www.libertysecurity.org/article289.html

European Commission (2005), Communication (COM(2005) 597 Final of 24.11.2005) on Improved Effectiveness, Enhanced Interoperability and Synergies among European Databases in the Area of Justice And Home Affairs.

European Parliament (2003), Recommendations to the Council on the second-generation Schengen information system (SIS II) of 20.11.2003.

European Parliament (2005), LIBE Working Document on the current functioning of SIS (Rapporteur Carlos Coelho),PE 364.674v02-00 of 20.10.2005.

Guild, E. and S. Carrera (2005), No Constitutional Treaty: Implications for the Area of Freedom, Security and Justice, Centre for European Policy Studies, Brussels 2005.

Hayes, B. (2004), From the Schengen Information System to SIS II and the Visa Information System (VIS): the proposals explained,Statewatch Report, February.

Hayes, B. (2005), Statewatch Analysis SIS II: fait accompli? Construction of EU’s Big Brother database underway, Statewatch, May.

Hobbing, P. (2005), Integrated Border Management at the EU Level, CEPS, Brussels.

Hobbing, P. (2006), An Analysis of the Commission Communication (COM(2005) 597 Final of 24.11.2005) on Improved Effectiveness, Enhanced Interoperability and Synergies among European Databases in the Area of Justice And Home Affairs , Briefing for the European Parliament IP/C/LIBE/FWC/2005-08, CEPS, 31 January.

Joint Supervisory Authority of Schengen (2005), Opinion on the proposed legal basis for SIS II, October 2005, http://www.libertysecurity.org/IMG/pdf/JSA-SIS.pdf

Peers, S.(2005),Statewatch Analysis - The SIS II proposals,Statewatch, June.

Pflanzer, S. (2005), The new Schengen Information System- Anybody in control?,EUobserver of 20 December 2005

An assessment of the proposals of regulation and decision which define the purpose, functionality and responsibilities of the future SIS II