- Latest available (Revised)
- Original (As adopted by EU)
Council Decision 2007/533/JHA of 12 June 2007 on the establishment, operation and use of the second generation Schengen Information System (SIS II)
When the UK left the EU, legislation.gov.uk published EU legislation that had been published by the EU up to IP completion day (31 December 2020 11.00 p.m.). On legislation.gov.uk, these items of legislation are kept up-to-date with any amendments made by the UK since then.
Legislation.gov.uk publishes the UK version. EUR-Lex publishes the EU version. The EU Exit Web Archive holds a snapshot of EUR-Lex’s version from IP completion day (31 December 2020 11.00 p.m.).
This is the original version as it was originally adopted in the EU.
This legislation may since have been updated - see the latest available (revised) version
1.The Management Authority, in relation to Central SIS II and the Commission in relation to the Communication Infrastructure, shall adopt the necessary measures, including of a security plan, in order to:
(a)physically protect data, including by making contingency plans for the protection of critical infrastructure;
(b)deny unauthorised persons access to data-processing facilities used for processing personal data (facilities access control);
(c)prevent the unauthorised reading, copying, modification or removal of data media (data media control);
(d)prevent the unauthorised input of data and the unauthorised inspection, modification or deletion of stored personal data (storage control);
(e)prevent the use of automated data-processing systems by unauthorised persons using data communication equipment (user control);
(f)ensure that persons authorised to use an automated data-processing system have access only to the data covered by their access authorisation by means of individual and unique user identities and confidential access modes only (data access control);
(g)create profiles describing the functions and responsibilities for persons who are authorised to access the data or the data processing facilities and make these profiles available to the European Data Protection Supervisor referred to in Article 61 without delay upon its request (personnel profiles);
(h)ensure that it is possible to verify and establish to which bodies personal data may be transmitted using data communication equipment (communication control);
(i)ensure that it is subsequently possible to verify and establish which personal data have been input into automated data-processing systems, when and by whom the data were input (input control);
(j)prevent the unauthorised reading, copying, modification or deletion of personal data during transfers of personal data or during transportation of data media in particular by means of appropriate encryption techniques (transport control);
(k)monitor the effectiveness of the security measures referred to in this paragraph and take the necessary organisational measures related to internal monitoring to ensure compliance with this Decision (self-auditing).
2.The Management Authority shall take measures equivalent to those referred to in paragraph 1 as regards security in respect of the exchange of supplementary information through the Communication Infrastructure.
Latest Available (revised):The latest available updated version of the legislation incorporating changes made by subsequent legislation and applied by our editorial team. Changes we have not yet applied to the text, can be found in the ‘Changes to Legislation’ area.
Original (As adopted by EU): The original version of the legislation as it stood when it was first adopted in the EU. No changes have been applied to the text.
Access essential accompanying documents and information for this legislation item from this tab. Dependent on the legislation item being viewed this may include:
Use this menu to access essential accompanying documents and information for this legislation item. Dependent on the legislation item being viewed this may include:
Click 'View More' or select 'More Resources' tab for additional information including: