Council Decision 2007/533/JHAShow full title

CHAPTER III RESPONSIBILITIES OF THE MANAGEMENT AUTHORITY

Article 15 Operational management

1. After a transitional period, a management authority (the Management Authority), funded by the general budget of the European Union, shall be responsible for the operational management of Central SIS II. The Management Authority shall ensure, in cooperation with the Member States, that at all times the best available technology, subject to a cost-benefit analysis, is used for Central SIS II.

2. The Management Authority shall also be responsible for the following tasks relating to the Communication Infrastructure:

(a) supervision;

(b) security;

(c) the coordination of relations between the Member States and the provider.

3. The Commission shall be responsible for all other tasks relating to the Communication Infrastructure, in particular:

(a) tasks relating to implementation of the budget;

(b) acquisition and renewal;

(c) contractual matters.

4. During a transitional period before the Management Authority takes up its responsibilities, the Commission shall be responsible for the operational management of Central SIS II. The Commission may delegate that task and tasks relating to implementation of the budget in accordance with the Council Regulation (EC, Euratom) No 1605/2002 of 25 June 2002 on the Financial Regulation applicable to the general budget of the European Communities(1), to national public-sector bodies, in two different countries.

5. Each national public sector body, as referred to in paragraph 4, must comply in particular with the following selection criteria:

(a) it must demonstrate that it has a lengthy experience in operating a large-scale information system with the functionalities referred to in Article 4(4);

(b) it must have considerable expertise in the service and security requirements of an information system with functionalities comparable to those referred to in Article 4(4);

(c) it must have sufficient and experienced staff with the appropriate professional expertise and linguistic skills to work in an international cooperation environment such as that required by SIS II;

(d) it must have a secure and custom-built facility infrastructure available, in particular, to backup and guarantee the continuous functioning of large-scale IT systems; and

(e) its administrative environment must allow it to implement its tasks properly and avoid any conflict of interests.

6. Prior to any such delegation as referred to in paragraph 4 and at regular intervals thereafter, the Commission shall inform the European Parliament and the Council of the terms of the delegation, its precise scope, and the bodies to which tasks are delegated.

7. Where the Commission delegates its responsibility during the transitional period pursuant to paragraph 4, it shall ensure that this delegation fully respects the limits set by the institutional system laid out in the EC Treaty. It shall ensure, in particular, that this delegation does not adversely affect any effective control mechanism under European Union law, whether of the Court of Justice, the Court of Auditors or the European Data Protection Supervisor.

8. Operational management of Central SIS II shall consist of all the tasks necessary to keep Central SIS II functioning 24 hours a day, seven days a week in accordance with this Decision, in particular the maintenance work and technical developments necessary for the smooth running of the system.

Article 16 Security

1. The Management Authority, in relation to Central SIS II and the Commission in relation to the Communication Infrastructure, shall adopt the necessary measures, including of a security plan, in order to:

(a) physically protect data, including by making contingency plans for the protection of critical infrastructure;

(b) deny unauthorised persons access to data-processing facilities used for processing personal data (facilities access control);

(c) prevent the unauthorised reading, copying, modification or removal of data media (data media control);

(d) prevent the unauthorised input of data and the unauthorised inspection, modification or deletion of stored personal data (storage control);

(e) prevent the use of automated data-processing systems by unauthorised persons using data communication equipment (user control);

(f) ensure that persons authorised to use an automated data-processing system have access only to the data covered by their access authorisation by means of individual and unique user identities and confidential access modes only (data access control);

(g) create profiles describing the functions and responsibilities for persons who are authorised to access the data or the data processing facilities and make these profiles available to the European Data Protection Supervisor referred to in Article 61 without delay upon its request (personnel profiles);

(h) ensure that it is possible to verify and establish to which bodies personal data may be transmitted using data communication equipment (communication control);

(i) ensure that it is subsequently possible to verify and establish which personal data have been input into automated data-processing systems, when and by whom the data were input (input control);

(j) prevent the unauthorised reading, copying, modification or deletion of personal data during transfers of personal data or during transportation of data media in particular by means of appropriate encryption techniques (transport control);

(k) monitor the effectiveness of the security measures referred to in this paragraph and take the necessary organisational measures related to internal monitoring to ensure compliance with this Decision (self-auditing).

2. The Management Authority shall take measures equivalent to those referred to in paragraph 1 as regards security in respect of the exchange of supplementary information through the Communication Infrastructure.

Article 17 Confidentiality – Management Authority

1. Without prejudice to Article 17 of the Staff Regulations of officials of the European Communities, the Management Authority shall apply appropriate rules of professional secrecy or other equivalent duties of confidentiality of comparable standards to those provided in Article 11 in this Decision to all its staff required to work with SIS II data. This obligation shall also apply after those people leave office or employment or after the termination of their activities.

2. The Management Authority shall take measures equivalent to those referred to in paragraph 1 as regards confidentiality in respect of the exchange of supplementary information through the communication infrastructure.

Article 18 Keeping of records at central level

1. The Management Authority shall ensure that every access to and all exchanges of personal data within CS-SIS are recorded for the purposes mentioned in Article 12(1) and (2).

2. The records shall show, in particular, the history of the alerts, the date and time of the data transmitted, the data used to perform searches, the reference to the data transmitted and the name of the competent authority responsible for processing the data.

3. The records may only be used for the purposes mentioned in paragraph 1 and shall be deleted at the earliest one year, and at the latest three years, after their creation. The records which include the history of alerts shall be erased after one to three years after deletion of the alerts.

4. Records may be kept longer if they are required for monitoring procedures that are already underway.

5. The competent authorities in charge of checking whether or not a search is lawful, monitoring the lawfulness of data processing, self-monitoring and ensuring the proper functioning of CS-SIS, data integrity and security, shall have access, within the limits of their competence and at their request, to those records for the purpose of fulfilling their tasks.

Article 19 Information campaign

The Commission shall, in cooperation with the national supervisory authorities, and the European Data Protection Supervisor accompany the start of the operation of SIS II with an information campaign informing the public about the objectives, the data stored, the authorities having access and the rights of persons. After its establishment, the Management Authority, in cooperation with the national supervisory authorities and the European Data Protection Supervisor, shall repeat such campaigns regularly. Member States shall, in cooperation with their national supervisory authorities, devise and implement the necessary policies to inform their citizens about SIS II generally.

(1)

OJ L 248, 16.9.2002, p. 1.