Regulation (EC) No 1987/2006 of the European Parliament and of the CouncilShow full title

CHAPTER III U.K. RESPONSIBILITIES OF THE MANAGEMENT AUTHORITY

Article 15 U.K. Operational management

1. After a transitional period, a management authority (the ‘Management Authority’), funded from the general budget of the European Union, shall be responsible for the operational management of Central SIS II. The Management Authority shall ensure, in cooperation with the Member States, that at all times the best available technology, subject to a cost-benefit analysis, is used for Central SIS II.

[F1 2. The Management Authority shall be responsible for all tasks relating to the Communication Infrastructure, in particular:

(a)

supervision;

(b)

security;

(c)

the coordination of relations between the Member States and the provider;

(d)

tasks relating to implementation of the budget;

(e)

acquisition and renewal, and

(f)

contractual matters.]

[F2 3a. The Management Authority shall develop and maintain a mechanism and procedures for carrying out quality checks on the data in CS-SIS. It shall provide regular reports to the Member States in this regard.

The Management Authority shall provide a regular report to the Commission covering the issues encountered and the Member States concerned.

The Commission shall provide the European Parliament and the Council with a regular report on data quality issues that are encountered.]

4. During a transitional period before the Management Authority takes up its responsibilities, the Commission shall be responsible for the operational management of Central SIS II. The Commission may delegate that task and tasks relating to implementation of the budget, in accordance with the Council Regulation (EC, Euratom) No 1605/2002 of 25 June 2002 on the Financial Regulation applicable to the general budget of the European Communities(1), to national public-sector bodies, in two different countries.

5. Each national public-sector body referred to in paragraph 4 shall meet the following selection criteria:

(a) it must demonstrate that it has lengthy experience in operating a large-scale information system with the functionalities referred to in Article 4(4);

(b) it must have considerable expertise in the service and security requirements of an information system with functionalities comparable to those referred to in Article 4(4);

(c) it must have sufficient and experienced staff with the appropriate professional expertise and linguistic skills to work in an international cooperation environment such as that required by SIS II;

(d) it must have a secure and custom-built facility infrastructure able, in particular, to back-up and guarantee the continuous functioning of large-scale IT systems;

and

(e) its administrative environment must allow it to implement its tasks properly and avoid any conflict of interests.

6. Prior to any delegation as referred to in paragraph 4 and at regular intervals thereafter, the Commission shall inform the European Parliament and the Council of the terms of the delegation, its precise scope, and the bodies to which tasks are delegated.

7. Where the Commission delegates its responsibility during the transitional period pursuant to paragraph 4, it shall ensure that this delegation fully respects the limits set by the institutional system laid out in the Treaty. It shall ensure, in particular, that this delegation does not adversely affect any effective control mechanism under Community law, whether of the Court of Justice, the Court of Auditors or the European Data Protection Supervisor.

[F3 8. The operational management of Central SIS II shall consist of all the tasks necessary to keep Central SIS II functioning 24 hours a day, 7 days a week in accordance with this Regulation, in particular the maintenance work and technical developments necessary for the smooth running of the system. Those tasks shall also include the coordination, management and support of testing activities for Central SIS II and the N.SIS II that ensure that Central SIS II and the N.SIS II operate in accordance with the requirements for technical compliance set out in Article 9.]

Textual Amendments

F1 Substituted by Regulation (EU) 2018/1726 of the European Parliament and of the Council of 14 November 2018 on the European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA), and amending Regulation (EC) No 1987/2006 and Council Decision 2007/533/JHA and repealing Regulation (EU) No 1077/2011.

F2 Inserted by Regulation (EU) 2018/1861 of the European Parliament and of the Council of 28 November 2018 on the establishment, operation and use of the Schengen Information System (SIS) in the field of border checks, and amending the Convention implementing the Schengen Agreement, and amending and repealing Regulation (EC) No 1987/2006.

F3 Substituted by Regulation (EU) 2018/1861 of the European Parliament and of the Council of 28 November 2018 on the establishment, operation and use of the Schengen Information System (SIS) in the field of border checks, and amending the Convention implementing the Schengen Agreement, and amending and repealing Regulation (EC) No 1987/2006.

Article 16 U.K. Security

1. The Management Authority, in relation to Central SIS II, and the Commission, in relation to the Communication Infrastructure, shall adopt the necessary measures, including a security plan, in order to:

(a) physically protect data, including by making contingency plans for the protection of critical infrastructure;

(b) deny unauthorised persons access to data-processing facilities used for processing personal data (facilities access control);

(c) prevent the unauthorised reading, copying, modification or removal of data media (data media control);

(d) prevent the unauthorised input of data and the unauthorised inspection, modification or deletion of stored personal data (storage control);

(e) prevent the use of automated data-processing systems by unauthorised persons using data communication equipment (user control);

(f) ensure that persons authorised to use an automated data-processing system have access only to the data covered by their access authorisation by means of individual and unique user identities and confidential access modes only (data access control);

(g) create profiles describing the functions and responsibilities of persons who are authorised to access the data or the data processing facilities and make these profiles available to the European Data Protection Supervisor referred to in Article 45 without delay upon its request (personnel profiles);

(h) ensure that it is possible to verify and establish to which bodies personal data may be transmitted using data communication equipment (communication control);

(i) ensure that it is subsequently possible to verify and establish which personal data have been input into automated data-processing systems, when and by whom the data were input (input control);

(j) prevent the unauthorised reading, copying, modification or deletion of personal data during transfers of personal data or during transportation of data media in particular by means of appropriate encryption techniques (transport control);

(k) monitor the effectiveness of the security measures referred to in this paragraph and take the necessary organisational measures related to internal monitoring to ensure compliance with this Regulation (self-auditing).

2. The Management Authority shall take measures equivalent to those referred to in paragraph 1 as regards security in respect of the exchange of supplementary information through the Communication Infrastructure.

Article 17 U.K. Confidentiality – Management Authority

1. Without prejudice to Article 17 of the Staff Regulations of Officials of the European Communities, the Management Authority shall apply appropriate rules of professional secrecy or other equivalent duties of confidentiality of a comparable standard to those provided in Article 11 of this Regulation to all its staff required to work with SIS II data. This obligation shall also apply after those people leave office or employment or after the termination of their activities.

2. The Management Authority shall take measures equivalent to those referred to in paragraph 1 as regards confidentiality in respect of the exchange of supplementary information through the Communication Infrastructure.

[F2 3. Where the Management Authority cooperates with external contractors in any SIS II-related tasks, it shall closely monitor the activities of the contractor to ensure compliance with all provisions of this Regulation, in particular on security, confidentiality and data protection.

4. The operational management of CS-SIS shall not be entrusted to private companies or private organisations.]

Textual Amendments

F2 Inserted by Regulation (EU) 2018/1861 of the European Parliament and of the Council of 28 November 2018 on the establishment, operation and use of the Schengen Information System (SIS) in the field of border checks, and amending the Convention implementing the Schengen Agreement, and amending and repealing Regulation (EC) No 1987/2006.

Article 18 U.K. Keeping of records at central level

1. The Management Authority shall ensure that every access to and all exchanges of personal data within CS-SIS are recorded for the purposes mentioned in Article 12(1) and (2).

2. The records shall show, in particular, the history of the alerts, the date and time of the data transmitted, the data used to perform searches, the reference to the data transmitted and the name of the competent authority responsible for processing the data.

3. The records may only be used for the purpose mentioned in paragraph 1 and shall be deleted at the earliest one year, and at the latest three years, after their creation. The records which include the history of alerts shall be erased one to three years after deletion of the alerts.

4. Records may be kept longer if they are required for monitoring procedures that are already under way.

5. The competent authorities in charge of checking whether a search is lawful, monitoring the lawfulness of data processing, self-monitoring and ensuring the proper functioning of CS-SIS, data integrity and security, shall have access, within the limits of their competence and at their request, to those records for the purpose of fulfilling their tasks.

Article 19 U.K. Information campaign

The Commission shall, in cooperation with the national supervisory authorities and the European Data Protection Supervisor, accompany the start of the operation of SIS II with an information campaign informing the public about the objectives, the data stored, the authorities having access and the rights of persons. After its establishment, the Management Authority, in cooperation with the national supervisory authorities and the European Data Protection Supervisor, shall repeat such campaigns regularly. Member States shall, in cooperation with their national supervisory authorities, devise and implement the necessary policies to inform their citizens about SIS II generally.

(1)

OJ L 248, 16.9.2002, p. 1.