Council Regulation (EU) No 1272/2012
of 20 December 2012
on migration from the Schengen Information System (SIS 1+) to the second generation Schengen Information System (SIS II) (recast)
THE COUNCIL OF THE EUROPEAN UNION,
Having regard to the Treaty on the Functioning of the European Union, and in particular Article 74 thereof,
Having regard to the proposal from the European Commission,
Whereas:
SIS II was established by Regulation (EC) No 1987/2006 and by Decision 2007/533/JHA. This Regulation should be without prejudice to the provisions of those acts.
The development of SIS II should be continued and should be finalised in the framework of the SIS II global schedule endorsed by the Council on 6 June 2008 and subsequently amended in October 2009 in the light of orientations given by the Council of 4 June 2009 (Justice and Home Affairs). The new version of the SIS II global schedule was presented by the Commission to the European Parliament and the Council in October 2010.
A comprehensive test of SIS II should be conducted in full cooperation between the Member States and the Commission, in accordance with the provisions of this Regulation. As soon as possible after its completion, that test should be validated as provided for by Regulation (EC) No 1987/2006 and Decision 2007/533/JHA. Only test data should be used for the purpose of the comprehensive test.
Member States should perform a test on the exchange of supplementary information.
As regards SIS 1+, the Schengen Convention provides for a technical support function (C.SIS). As regards SIS II, Regulation (EC) No 1987/2006 and Decision 2007/533/JHA provide for a Central SIS II composed of a technical support function and a uniform national interface (NI-SIS). The technical support function of Central SIS II should be located in Strasbourg (France) and a backup in St Johann im Pongau (Austria).
In order to better manage the potential difficulties brought about by the migration from SIS 1+ to SIS II, an interim migration architecture for SIS should be established and tested. The interim migration architecture should have no impact on the operational availability of SIS 1+. A converter should be provided by the Commission.
The Member State issuing an alert should be responsible for ensuring that the data entered into SIS is accurate, up to date and lawful.
The Commission should remain responsible for Central SIS II and its communication infrastructure. This responsibility includes the maintenance and continuation of the development of SIS II and its communication infrastructure, including at all times the correction of errors. The Commission should provide coordination and support for the joint activities. The Commission should provide, in particular, the necessary technical and operational support to the Member States at Central SIS II level including the availability of a helpdesk.
The Member States are and should remain responsible for the development and maintenance of their national systems (N.SIS II).
France should remain responsible for the technical support function of SIS 1+, as expressly provided for in the Schengen Convention.
Representatives of the Member States participating in SIS 1+ should coordinate their actions within the framework of the Council. It is necessary to set out a framework for that organisational action.
In order to support Member States in opting for the most favourable technical and financial solution, the Commission should initiate without delay the process of adapting this Regulation by proposing a legal framework for the migration from SIS 1+ to SIS II which better reflects the technical migration approach outlined in the Migration Plan for the SIS Project (the ‘Migration Plan’) adopted by the Commission after a positive vote by the SIS-VIS Committee on 23 February 2011.
The Migration Plan envisages that within the switchover period all Member States, consecutively, will perform their individual switchover of the national application from SIS 1+ into SIS II. It is desirable from a technical point of view that Member States that have switched over be able to use the full scope of SIS II from the time of the switchover and not have to wait until other Member States have also switched over. Therefore, it is necessary to apply Regulation (EC) No 1987/2006 and Decision 2007/533/JHA from the time of the initiation of the switchover by the first Member State. For reasons of legal certainty, the period of switchover should be kept as short as possible, and should not exceed 12 hours. The application of Regulation (EC) No 1987/2006 and Decision 2007/533/JHA should not prevent Member States, which have not switched over yet or which have had to fall back for technical reasons, from using SIS II limited to SIS 1+ functionalities during the intensive monitoring period. In order to apply the same standards and conditions to alerts, data processing and data protection in all Member States, it is necessary to apply the SIS II legal framework to the SIS operational activities of the Member States which did not yet switch over.
It is necessary to maintain the application of certain provisions of Title IV of the Schengen Convention on a temporary basis by incorporating those provisions into this Regulation as they provide the legal framework for the converter and the interim migration architecture during the migration. The interim migration architecture for the operations of SIS 1+ allows SIS 1+ and certain technical parts of the SIS II architecture to operate in parallel during a limited transitional period which is needed to make possible an incremental migration from SIS 1+ to SIS II.
Regulation (EC) No 1987/2006 and Decision 2007/533/JHA provide that the best available technology, subject to a cost-benefit analysis, should be used for Central SIS II. The Annex to the Council Conclusions on the further direction of SIS II of 4-5 June 2009 laid down milestones which should be met in order to continue with the current SIS II project. In parallel, a study has been conducted concerning the elaboration of an alternative technical scenario for developing SIS II based on SIS 1+ evolution (SIS 1+ RE) as the contingency plan, in case the tests demonstrate non-compliance with the milestone requirements. Based on these parameters, the Council may decide to invite the Commission to switch to the alternative technical scenario.
The description of the technical components of the interim migration architecture should therefore be adapted to allow for another technical solution, and in particular the SIS 1+ RE regarding the development of Central SIS II. SIS 1+ RE is a possible technical solution to develop Central SIS II and to achieve the objectives of the SIS II laid down in Regulation (EC) No 1987/2006 and Decision 2007/533/JHA.
The SIS 1+ RE is characterised by uniqueness of means between SIS II development and SIS 1+. The references in this Regulation to the technical architecture of SIS II and to the migration process should therefore, in case of implementation of an alternative technical scenario, be read as the references to SIS II based on another technical solution, as applied mutatis mutandis to the technical specificities of that solution, in keeping with the objective to develop Central SIS II.
In any technical scenario, the result of migration at central level should be availability of the SIS 1+ database and new SIS II functionalities, including additional data categories, in the Central SIS II. In order to facilitate data loading it should be specified that deleted data as referred to in Article 113(2) of the Schengen Convention will not be migrated from SIS 1+ to SIS II.
Any such contract should respect the rules of data protection and data security and take into account the role of the relevant data protection authorities applicable to the SIS, in particular the provisions of the Schengen Convention and of this Regulation.
As regards the financing of the development of the Central SIS II based on an alternative technical solution, it should be covered by the general budget of the Union while respecting the principle of sound financial management. In accordance with the Financial Regulation the Commission may delegate budget implementation tasks to national public sector bodies. Following the political orientation and subject to the conditions laid down in the Financial Regulation, the Commission would be invited, in case of switchover to the alternative solution, to delegate the budget implementation tasks related to the development of the SIS II based on SIS 1+ RE to France.
Since the adoption of those legal acts, the SIS II project received a significant reorientation in the course of 2010, after the completion of an important test campaign, the ‘Milestone 1’. Furthermore, the evolutions in the use of the SIS by the Member States led to a need to update the SIS II technical requirements concerning performance and storage capacity which affected the costs of the SIS II project both at central and national level.
With regard to the migration process from SIS 1+ to SIS II, the evolution in requirements and the advances made in the completion of the SIS II project led to a redefinition of the migration architecture, of the migration calendar and of the testing requirements. An important part of the activities that would now be required at Member State level for the migration to SIS II were not anticipated at the time when Regulation (EC) No 1104/2008 and Decision 2008/839/JHA were adopted or at the time when the financial package and the multiannual programmes under the EBF were drawn up. It is, therefore, necessary to partly realign the cost distribution principles for the migration from SIS 1+ to SIS II. Certain national activities related to that migration, in particular in connection with the participation of Member States in migration-related testing activities could be co-financed from the SIS II budget line of the general budget of the Union. That possibility should cover specific and well-defined activities beyond, and not to coincide with, other SIS II related actions which would continue to be supported under the EBF. The financial assistance thus provided under this Regulation should be complementary to that provided by the EBF.
The Commission and the Member States should continue to cooperate closely during all steps of the development of the SIS II and the migration from SIS 1+ to SIS II in order to complete the process. In the Council conclusions on SIS II of 26-27 February 2009 and 4-5 June 2009, an informal body consisting of the experts of the Member States and designated as the Global Programme Management Board, was established to enhance the cooperation and to provide direct Member States support to the central SIS II project. The positive result of the work of that group of experts and the necessity of further enhancing the cooperation and the transparency of the central SIS II project justify the formal integration of the group of experts into the SIS II management structure. A group of experts, called the Global Programme Management Board, should therefore be formally established to complement the current SIS II organisational structure. In order to ensure efficiency as well as cost effectiveness the number of experts should be limited. The activities of the Global Programme Management Board should be without prejudice to the responsibilities of the Commission and of the Member States.
The European Data Protection Supervisor is responsible for monitoring and ensuring the application of Regulation (EC) No 45/2001 and is competent to monitor the activities of the Union institutions and bodies in relation to the processing of personal data. The Joint Supervisory Authority is responsible for supervising the technical support function of the current SIS 1+ until the entry into force of the SIS II legal framework. National Supervisory Authorities are responsible for supervising the processing of SIS 1+ personal data on the territory of their respective Member States and remain responsible for monitoring the lawfulness of the processing of SIS II personal data on the territory of their respective Member States. This Regulation should be without prejudice to the specific provisions of the Schengen Convention as well as of Regulation (EC) No 1987/2006 and of Decision 2007/533/JHA on the protection and security of personal data. That SIS II legal framework provides that the National Supervisory Authorities and the European Data Protection Supervisor ensure the coordinated supervision of SIS II.
The migration from SIS 1+ to SIS II is a complex process which, despite extensive preparation by all stakeholders, entails significant technical risks. It is desirable for the legal framework to provide for the necessary flexibility to respond to unexpected difficulties which the central system or one or several national systems could face during the migration process. Therefore, while for reasons of legal certainty the switchover phase and the intensive monitoring period during which the interim migration architecture continues to exist should be as short as possible, the Council should, in case of technical difficulties, be enabled to fix the final date for the termination of migration in accordance with Article 55(2) of Regulation (EC) No 1987/2006 and Article 71(2) of Decision 2007/533/JHA.
Since the objectives of this Regulation, namely setting up the interim migration architecture and migrating the data from SIS 1+ to SIS II, cannot be sufficiently achieved by the Member States and can, therefore, by reason of the scale and effects of the action, be better achieved at Union level, the Union may adopt measures in accordance with the principle of subsidiarity, as set out in Article 5 of the Treaty on European Union. In accordance with the principle of proportionality, as set out in that Article, this Regulation does not go beyond what is necessary to achieve those objectives.
This Regulation respects the fundamental rights and observes the principles recognised in particular by the Charter of Fundamental Rights of the European Union.
In order to give effect in 2012 to the financial facility which could be provided to Member States from the general budget of the Union in accordance with this Regulation, this Regulation should enter into force on the day following its publication.
In accordance with Articles 1 and 2 of Protocol (No 22) on the position of Denmark, annexed to the Treaty on European Union and the Treaty on the Functioning of the European Union, Denmark is not taking part in the adoption of this Regulation and is not bound by it or subject to its application. Given that this Regulation builds upon the Schengen acquis, Denmark shall, in accordance with Article 4 of that Protocol, decide within a period of six months after the Council has decided on this Regulation whether it will implement it in its national law.
This Regulation is without prejudice to the arrangements for the partial participation of Ireland and the United Kingdom in the Schengen acquis as determined by Decisions 2000/365/EC and 2002/192/EC respectively.
As regards Cyprus, this Regulation constitutes an act building upon, or otherwise related to, the Schengen acquis within the meaning of Article 3(2) of the 2003 Act of Accession.
HAS ADOPTED THIS REGULATION: