PURPOSE: to create the necessary legal basis to enable Member States to organise the reception and processing of visa applications in relation to the introduction of biometric data into the Visa Information System (VIS) and to organise this type of activity within their diplomatic missions and consular posts.

LEGISLATIVE ACT: Regulation (EC) No 390/2009 of the European Parliament and of the Council of 23 April 2009 amending the Common Consular Instructions on visas for diplomatic missions and consular posts in relation to the introduction of biometrics including provisions on the organisation of the reception and processing of visa applications.

BACKGROUND: the setting up of the VIS is governed by several texts which define its general legal framework:

the first text establishes the legal basis for the creation of the VIS and authorises the Commission to develop it and make Community funds available to that end (see CNS/2004/0029 : Council Decision 2004/512/EC); the second text establishes the technical framework for the creation of the VIS and for the exchange of data between Member States (see COD/2004/0287 : Regulation (EC) No 767/2008) and provides the legal framework for the gathering and use of data by the authorities responsible for visas, including biometric identifiers; in order to complete the final creation of the VIS, a third instrument is needed to define the standards to be applied by the consular offices of the Member States so as to comply with the technical instructions of the VIS. To that end, it is necessary to amend the Common Consular Instructions with which the consular offices of the Member States currently comply, above all for the application of new rules concerning the gathering of data and its introduction into visas. That is the objective of this Regulation.

CONTENT: the Regulation is intended to create the legal basis for Member States to:

take mandatory biometric identifiers - the facial image and ten flat fingerprints - from visa applicants; establish a legal framework for the organisation of Member States' consular offices with a view to the implementation of the Visa Information System (VIS)

Biometric identifiers : the Regulation defines the standards for the collection of these biometric identifiers by referring to the relevant provisions set out by the International Civil Aviation Organisation (ICAO). Member States shall collect biometric identifiers comprising the facial image and 10 fingerprints from the applicant in accordance with the safeguards laid down in the European Convention for the Protection of Human Rights and Fundamental Freedoms, in the Charter of Fundamental Rights of the EU and in the United Nations Convention on the Rights of the Child. No further technical specifications are required in order to ensure interoperability.

The biometric identifiers shall be collected by qualified and duly authorised staff of the diplomatic mission or consular post and the authorities responsible for issuing visas at the borders. The data shall be entered in the VIS only by duly authorised consular staff and in compliance with the rules of courtesy and the human dignity of the applicants.

Derogations to the introduction of biometric identifiers in visas : as requested by the European Parliament, certain applicants shall be exempt from the requirement to give fingerprints, namely:

children under the age of 12 ; persons for whom fingerprinting is physically impossible.

The age limit of 12 years shall however be reviewed following the results of a study that the Commission shall subsequently present three years following the creation of the VIS.

In order to facilitate the procedure of any subsequent application, it should be possible to copy fingerprints from the first entry into the VIS within a period of 59 months. Once this period of time has elapsed, the fingerprints should be collected again.

Cooperation between Member States : in order to facilitate the registration of applicants and to reduce the costs for Member States, the Regulation sets out new organisational possibilities between the consular offices of the Member States. Firstly, a number of new Common Consular Instructions are set out in order to authorise diplomatic missions and consular posts to represent one or more other Member States in a limited manner solely for the collection of applications and the enrolment of biometric identifiers.

Other possibilities for cooperation are also provided for, such as:

the co-location of diplomatic and consular posts; the creation of Common Application Centres; recourse to honorary consuls; cooperation with external service providers.

External service providers : the Regulation contains provisions for situations in which Member States decide, in order to facilitate the procedure, to cooperate with an external service provider for the collection of applications . Such a decision may be taken if, in particular circumstances or for reasons relating to the local situation, cooperation with other Member States in the form of limited representation, co-location or a Common Application Centre proves not to be appropriate for the Member State concerned. Such arrangements should be established in compliance with the general principles for issuing visas, respecting the data protection requirements. In this context, provisions have been added in an annex to establish a list of minimum requirements in the case of cooperation with external service providers. Those requirements include provisions on the exact responsibilities of external service providers, on direct and total access to their premises, information for applicants, confidentiality and on the circumstances, conditions and procedures for suspending or terminating the cooperation.

Organisation of visa sections : the Regulation contains specific provisions for organising visa sections. Each Member State shall be responsible for organising the reception and processing of applications, which shall be lodged at a diplomatic mission or consular post of a Member State.

In this context, the following points related to cooperation between Member States have been clarified:

the terms of cooperation between Member States when the “one-stop” principle is applied for several diplomatic missions; recourse to honorary consuls; cooperation with external service providers (see above) and types of cooperation envisaged when tasks are delegated to those service providers; Member States’ obligations in the event of recourse to external service providers (notably their obligation to verify the reliability of the provider and their compliance with data protection rules); service fees (these should be proportionate to the costs incurred by the external service provider while performing one or more of the tasks).

The Regulation also contains provisions in terms of cooperation with commercial intermediaries (private administrative agencies and transport or travel agencies, such as tour operators and retailers).

Reporting : the Commission shall present, 3 years after the VIS is brought into operation and every 4 years thereafter, a report on the implementation of the Regulation, including the implementation of the collection and use of biometric identifiers, the suitability of the ICAO standard chosen, compliance with data protection rules, experience with external service providers with specific reference to the collection of biometric data, the implementation of the 59-month rule for the copying of fingerprints and the organisation of the reception and processing of applications.

The report shall also include the cases in which fingerprints could factually not be provided or were not required to be provided for legal reasons, compared with the number of cases in which fingerprints were taken. It must include information on cases in which a person who could factually not provide fingerprints was refused a visa. The report shall be accompanied, where necessary, by appropriate proposals to amend this Regulation.

The first report shall also address the issue of the sufficient reliability for identification and verification purposes of fingerprints of children under the age of 12 and, in particular, how fingerprints evolve with age, based on the results of a study carried out under the responsibility of the Commission.

Territorial provisions : Norway, Iceland, Switzerland and Liechtenstein shall be associated with the implementation of the Regulation pursuant to the bilateral agreements concluded with the EU on the Schengen acquis. The United Kingdom and Ireland shall not participate in the adoption of the text, pursuant to the protocol annexed to the EU Treaty and subsequent decisions. For the same reasons, Denmark shall not participate in the adoption of the text but may decide within a period of 6 months if it will transpose or not this text into its national law.

ENTRY INTO FORCE: 29 May 2009.

Regulation 2009/390
OJ L 131 28.05.2009, p. 0001

03617/2009/LEX

The European Parliament adopted (without vote) a legislative resolution approving unamended, under the second reading of the codecision procedure, the Council’s common position on the proposal for a regulation of the European Parliament and of the Council amending the Common Consular Instructions on visas for diplomatic missions and consular posts in relation to the introduction of biometrics including provisions on the organisation of the reception and processing of visa applications.

T6-0167/2009

Debate in Parliament

A6-0143/2009

A6-0143/2009

The Committee on Civil Liberties, Justice and Home Affairs adopted the recommendation for second reading drawn up by Sarah LUDFORD (ALDE, UK) approving unamended, under the second reading of the codecision procedure, the Council’s common position on the proposal for a regulation of the European Parliament and of the Council amending the Common Consular Instructions on visas for diplomatic missions and consular posts in relation to the introduction of biometrics including provisions on the organisation of the reception and processing of visa applications.

The Council's common position incorporates the elements of the compromise reached by the European Parliament and the Council after the discussions that followed Parliament's adoption of its opinion at first reading on 9 July 2008 and the political trialogue of 2 December 2008.

This common position essentially preserves the key objectives of the Commission's original proposal. It takes into account the principal amendments adopted by Parliament at first reading, which supplement and clarify the legal framework for organising Member States' consular offices and cooperation between them for the purpose of receiving and processing visa applications.

The main differences of substance between the common position and the original Commission proposal are as follows:

· the age limit for taking fingerprints : whereas the Commission had originally proposed taking fingerprints from visa applicants aged six and over, the text of the common position provisionally sets a minimum age of 12, which will be re-examined in the light of the findings of the study that the Commission has undertaken to carry out at Parliament's request;

· the use of external service providers for the reception of visa applications : clarification was provided concerning the special conditions in which Member States may use such external service providers and the minimum requirements that must be included in the legal instruments establishing ties between the Member States and the external service providers. In exchange for maintaining direct access to the consular offices, the possibility of charging visa applicants an extra fee has been introduced, regardless of the exemptions from fees provided for in Annex 12 to the Common Consular Instructions. The extra fee should be in proportion to the costs incurred by the external service provider in performing the tasks assigned to it, and an effort should be made to harmonise it as part of local consular cooperation. It may not be more than half the fee laid down in Annex 12 to the Common Consular Instructions;

· the use of honorary consuls : the text of the common position allows honorary consuls to be used for the reception of visa applications, including collecting biometric data. Honorary consuls, who do not have the status of a civil servant of the Member State they represent, will be subject to the same rules as apply to external service providers;

· secure data transmission : provisions lay down the legal and practical arrangements for the secure transmission of data between Member States or between external service providers and Member States, particularly in third countries where data encryption is not allowed. The proposed wording introduces important data protection guarantees and confirms the Member States' responsibility in this regard.

Other Parliamentary amendments concerning drafting changes to improve the text are also accepted.

In conclusion, the Commission accepts the common position, which incorporates and complements the main elements of its original proposal and the principal amendments adopted by the European Parliament.

COM(2009)0109
EUR-Lex

PE421.273

The Council welcomes the spirit of cooperation which prevailed with the European Parliament during the negotiations. The text of the common position reflects a compromise reached during the discussions between the European Parliament, the Commission and the Council and can be summarised as follows:

fingerprinting age : the proposal of the Commission provided that for the purpose of visa applications, fingerprints should be taken from children from the age of six years . However, the European Parliament did not agree with this approach, and, by way of compromise, the text provides as a first step that fingerprints are taken only from the age of twelve years . The Commission shall present, three years after the VIS is brought into operation and every four years thereafter, a report on the implementation of the Regulation. The first report shall address the issue of the sufficient reliability for identification and verification purposes of fingerprints of children below the age of 12 years, and in particular how fingerprints evolve with age, based on the results of a study carried out under the responsibility of the Commission; cooperation with ESP ("outsourcing"): the aim of the proposal from the Commission is in particular to create a common legal framework for "outsourcing", a form of organisation already practiced by several Member States. The Commission has indicated in its proposal that a common legal framework is necessary taking into account in particular data protection requirements. "Outsourcing" is not proposed as a general solution but as a possibility which may be used in certain diplomatic missions or consular posts depending on the local situation. An important benefit of setting up a legal framework is that it becomes clear that the Member States remain the "controller" and the ESP the "processor" in the meaning of Article 16 and 17 of Directive 95/46/EC on data protection. In this sense, the contractual terms with the ESP must contain the obligations for the processing of data in the sense of the directive. The provisions of the common position provide that only in particular circumstances or for reasons relating to the local situation (high number of applicants or territorial coverage of the third country concerned) and only where the other forms of cooperation prove not to be appropriate, a Member State may, as a last resort, cooperate with an ESP; additional fees (service fees) : the Commission states in the explanatory memorandum to its proposals that, when using the possibility of outsourcing, the total amount of fees charged to the applicant for processing the visa application shall not be higher than the normal visa fee (the fee set out in Annex 12 to the CCI). Thus, no additional costs could be charged to the applicant. This approach was supported by the European Parliament in its opinion. However, the Council was not able to agree to that. By way of compromise, the common position provides that the ESP may charge a service fee in addition to the normal visa fee, but that this service fee shall not exceed half of the amount of the normal visa fee , irrespective of the possible exemptions from the visa fee; transfer of data : in order to ensure that all relevant data protection provisions are respected, the proposal from the Commission provides for data protection and security rules when a transfer of data occurs between two Member States in the framework of "limited representation" (see Article 1(1) of the proposal) and between a Member State and an ESP in the case of outsourcing. Therefore, Member States have to ensure that the contract to be concluded with the ESP includes relevant data protection clauses, the implementation of which shall be supervised by consular officers. Member States in this regard remain liable for the compliance with data protection rules also in case of outsourcing. Based on concerns expressed by the European Parliament, the common position reinforces the provisions relating to the safety of the transfer of data between, on the one hand, the representing Member State and the represented Member State and, on the other hand, between the Member State and the ESP concerned.

It should be noted that this text was the subject of discussion between the institutions, the Chair of the LIBE committee of the European Parliament has since in a letter to the Chairman of Coreper indicated that if the compromise text is transmitted to the European Parliament as a common position of the Council, he will recommend to the Members of the LIBE and subsequently to the plenary that the common position be accepted without amendments in Parliament's second reading , subject to verification by the lawyer linguists of both institutions.

05329/1/2009

The Council welcomes the spirit of cooperation which prevailed with the European Parliament during the negotiations. The text of the common position reflects a compromise reached during the discussions between the European Parliament, the Commission and the Council and can be summarised as follows:

fingerprinting age : the proposal of the Commission provided that for the purpose of visa applications, fingerprints should be taken from children from the age of six years . However, the European Parliament did not agree with this approach, and, by way of compromise, the text provides as a first step that fingerprints are taken only from the age of twelve years . The Commission shall present, three years after the VIS is brought into operation and every four years thereafter, a report on the implementation of the Regulation. The first report shall address the issue of the sufficient reliability for identification and verification purposes of fingerprints of children below the age of 12 years, and in particular how fingerprints evolve with age, based on the results of a study carried out under the responsibility of the Commission; cooperation with ESP ("outsourcing"): the aim of the proposal from the Commission is in particular to create a common legal framework for "outsourcing", a form of organisation already practiced by several Member States. The Commission has indicated in its proposal that a common legal framework is necessary taking into account in particular data protection requirements. "Outsourcing" is not proposed as a general solution but as a possibility which may be used in certain diplomatic missions or consular posts depending on the local situation. An important benefit of setting up a legal framework is that it becomes clear that the Member States remain the "controller" and the ESP the "processor" in the meaning of Article 16 and 17 of Directive 95/46/EC on data protection. In this sense, the contractual terms with the ESP must contain the obligations for the processing of data in the sense of the directive. The provisions of the common position provide that only in particular circumstances or for reasons relating to the local situation (high number of applicants or territorial coverage of the third country concerned) and only where the other forms of cooperation prove not to be appropriate, a Member State may, as a last resort, cooperate with an ESP; additional fees (service fees) : the Commission states in the explanatory memorandum to its proposals that, when using the possibility of outsourcing, the total amount of fees charged to the applicant for processing the visa application shall not be higher than the normal visa fee (the fee set out in Annex 12 to the CCI). Thus, no additional costs could be charged to the applicant. This approach was supported by the European Parliament in its opinion. However, the Council was not able to agree to that. By way of compromise, the common position provides that the ESP may charge a service fee in addition to the normal visa fee, but that this service fee shall not exceed half of the amount of the normal visa fee , irrespective of the possible exemptions from the visa fee; transfer of data : in order to ensure that all relevant data protection provisions are respected, the proposal from the Commission provides for data protection and security rules when a transfer of data occurs between two Member States in the framework of "limited representation" (see Article 1(1) of the proposal) and between a Member State and an ESP in the case of outsourcing. Therefore, Member States have to ensure that the contract to be concluded with the ESP includes relevant data protection clauses, the implementation of which shall be supervised by consular officers. Member States in this regard remain liable for the compliance with data protection rules also in case of outsourcing. Based on concerns expressed by the European Parliament, the common position reinforces the provisions relating to the safety of the transfer of data between, on the one hand, the representing Member State and the represented Member State and, on the other hand, between the Member State and the ESP concerned.

It should be noted that this text was the subject of discussion between the institutions, the Chair of the LIBE committee of the European Parliament has since in a letter to the Chairman of Coreper indicated that if the compromise text is transmitted to the European Parliament as a common position of the Council, he will recommend to the Members of the LIBE and subsequently to the plenary that the common position be accepted without amendments in Parliament's second reading , subject to verification by the lawyer linguists of both institutions.

05329/1/2009

06894/2009

SP(2008)4891

Results of vote in Parliament

The European Parliament adopted, by 445 votes to 64 with 41 abstentions, a legislative resolution amending the proposal for a regulation of the European Parliament and of the Council amending the Common Consular Instructions on visas for diplomatic missions and consular posts in relation to the introduction of biometrics including provisions on the organisation of the reception and processing of visa applications. The report had been tabled for consideration in plenary by Sarah LUDFORD (ALDE, UK) on behalf of the Committee on Civil Liberties, Justice and Home Affairs. Several amendments aimed to ensure a correlation between this proposal and the relevant provisions of the VIS Regulation.

The main amendments are as follows:

VIS: Member State may also represent one or more other Member States solely for the reception of applications and the enrolment of biometric identifiers. Where it receives an application, the representing Member State shall create the application file in the VIS and insert the data referred to in the VIS Regulation. It shall then inform the consular post of the represented Member State of the application and the VIS entry through the VIS communication infrastructure as provided for in the VIS Regulation.

Conduct of staff involved in visa applications : applicants must be received courteously by all staff involved in visa applications. All staff shall fully respect the human dignity and integrity of the applicant. Any measures taken shall be proportionate to the objectives pursued. Staff shall not discriminate against persons on grounds of sex, racial or ethnic origin, religion or belief, disability, age or sexual orientation.

Fingerprinting : persons where fingerprinting is physically impossible are excepted from the scope. If, however, fingerprinting of less than ten fingers is possible, the respective number of fingerprints shall be taken. Member States shall ensure that appropriate procedures guaranteeing the dignity of the person concerned are in place in the event of there being difficulties in enrolling. They shall also ensure that the decision as to whether fingerprinting is impossible is always taken by the duly authorised staff of the diplomatic mission or consular post of the Member State. Furthermore, should the impossibility be temporary, the applicant shall be required to give fingerprints at the following application. Consular staff shall be entitled to ask for further clarification of the reasons for the temporary impossibility.

The fact that fingerprinting is physically impossible shall not influence the grant or refusal of a visa.

Scanned photographs : for persons under the age of 12, scanned photographs shall be used which do not require them to appear in person.

Exceptions: exceptions include children under the age of 12 (rather than 6). The exemption from the requirement to give fingerprints for children, and in particular the age range for the taking of fingerprints, shall be reviewed three years after the start of operation of the VIS. To this end the Commission shall present a report which shall cover the experience of the VIS with regard to the taking and use of fingerprints from children aged 12 and over and a detailed technical assessment of the reliability of taking and using the fingerprints of children under the age of 12 for identification and verification purposes in a large-scale database such as the VIS. The report shall incorporate an extended impact assessment of lower and higher age limits for requiring fingerprints, including social, ergonomic and financial aspects.

The report shall make a similar assessment as regards the taking of fingerprints from the elderly. Should the report show significant problems with taking fingerprints of persons over a certain age, the Commission shall make a proposal to impose an upper age limit.

Outsourcing: in the case of outsourcing, consular officials must be present to supervise the external service provider. Parliament stipulated that the diplomatic missions or consular posts of the Member States shall ensure that the company selected offers relevant professional expertise in information assurance and data security. Member States should follow best procurement practices in contracting external visa support services.

The external service provider must return the passport to the applicant or to a legal representative at the end of the procedure.

Written contracts with external service provider : Parliament prescribed several additional matters which such contracts should cover, such as requiring the service provider to record any complaints from applicants on data misuse or unauthorised access. A model contract shall be established within local consular cooperation.

The fee paid by the applicant shall not exceed the fee set out in the text irrespective of whether Member States cooperate with external service providers. The Commission had referred to the total amount of fees charged by the external service provider.

Information campaign : a new clause states that shortly before the VIS is brought into operation in a third country, the diplomatic missions or consular posts of Member States together with the delegation of the Commission shall launch a campaign informing the general public about the objectives pursued, the data stored in and the authorities having access to the VIS, and the rights of visa applicants.

Member States’ responsibilities : a new part is added on general responsibilities for Member States. This covers such matters as documents, training, liabilities, and penalties The wording has been clarified to bring it into conformity with the wording in the VIS Regulation.

Report and review : three years after the VIS is brought into operation and every four years thereafter, the Commission must present a report on the implementation of the Regulation, including the implementation of the enrolment of biometric identifiers, the appropriateness of the ICAO standard chosen, compliance with data protection rules, experience with external service providers with specific reference to the collection of biometric data, the principle of the “first application” and the organisation of the reception and the processing of visa applications. The report shall also include: the cases in which fingerprints could factually not be provided or were not required to be provided for legal reasons compared with the number of cases in which fingerprints are taken; and information on cases in which a person who could factually not provide fingerprints was refused a visa.

Other amendments are the following :

- the word 'aliens' should be replaced by the word 'applicants' throughout the text, since this is the word used in the VIS Regulation;

- a reference to the Charter of Fundamental Rights has also been added ;

- it will be possible to copy biometric data from the first application within a period of 59 (rather than 48 months) months from the start of the retention period provided for in the VIS Regulation;

- given in particular the risks for data security and data protection linked to the taking of biometrics, some amendments ensure that any activity linked to the issuing of visas takes place in a building enjoying diplomatic or consular protection. This is the case both for Common Application Centres and external service providers.

- a reference is made to the common Schengen visa internet site;

- on information on visa applications, the Committee inserted the relevant provisions from the Visa Code proposal.

T6-0358/2008

Debate in Parliament

A6-0459/2007

A6-0459/2007

The Committee on Civil Liberties, Justice and Home Affairs adopted a report drafted by Sarah LUDFORD (ALDE, UK) and made several amendments to the proposal for a regulation of the European Parliament and of the Council amending the Common Consular Instructions on visas for diplomatic missions and consular posts in relation to the introduction of biometrics including provisions on the organisation of the reception and processing of visa applications. Several amendments aimed to ensure a correlation between this proposal and the relevant provisions of the VIS Regulation.

The main amendments are as follows:

VIS: Member State may also represent one or more other Member States solely for the reception of applications and the enrolment of biometric identifiers. Where it receives an application, the representing Member State shall create the application file in the VIS and insert the data referred to in the VIS Regulation. It shall then inform the consular post of the represented Member State of the application and the VIS entry through the VIS communication infrastructure as provided for in the VIS Regulation. The committee states that the underlying rationale of the idea to roll out the VIS in particular regions is that all consulates of the Member States start using the VIS at the same time. This implies that all consulates have access to the VIS. Introducing the basic visa data directly into the VIS is the best guarantee for ensuring data security, in particular as regards the transmission of biometric data.

Conduct of staff involved in visa applications : applicants must be received courteously by all staff involved in visa applications. All staff shall fully respect the human dignity and integrity of the applicant. Any measures taken shall be proportionate to the objectives pursued. Staff shall not discriminate against persons on grounds of sex, racial or ethnic origin, religion or belief, disability, age or sexual orientation.

Fingerprinting : the decision as to whether fingerprinting is impossible must always be taken by the duly authorised staff of the diplomatic mission or consular post of the Member State. Furthermore, should the impossibility be temporary, the applicant shall be required to give fingerprints at the following application. Consular staff shall be entitled to ask for further clarification of the reasons for the temporary impossibility. The fact that fingerprinting is physically impossible shall not influence the grant or refusal of a visa.

Scanned photographs : for persons under the age of 12, scanned photographs shall be used which do not require them to appear in person.

Exceptions: exceptions include children under the age of 12 (rather than 6). The exemption from the requirement to give fingerprints for children and the elderly, and in particular the age range for the taking of fingerprints, shall be reviewed three years after the start of operation of the VIS. The Commission shall present a report which shall in particular cover the experience of the VIS with regard to the taking and use of fingerprints from children aged 12 and over and a detailed technical assessment of the reliability of taking and using the fingerprints of children under the age of 12 for identification and verification purposes in a large-scale database such as the VIS. The report shall incorporate an extended impact assessment of lower and higher age limits for requiring fingerprints, including social, ergonomic and financial aspects.

Outsourcing: in the case of outsourcing, consular officials must be present to supervise the external service provider. Their presence safeguards the public nature of the visa issuing process. Furthermore, it has been clarified that in the case of outsourcing, the final responsibility for the processing of data and for any breaches of the contract lies with Member States. The external service provider must return the passport to the applicant or to a legal representative at the end of the procedure.

Written contracts with external service provider : the committee stipulated certain additional matters which such contracts should cover, such as requiring the service provider to record any complaints from applicants on data misuse or unauthorised access. A model contract shall be established within local consular cooperation.

The fee paid by the applicant shall not exceed the fee set out in the text irrespective of whether Member States cooperate with external service providers. The Commission had referred to the total amount of fees charged by the external service provider.

Information campaign : a new clause states that shortly before the VIS is brought into operation in a third country, the diplomatic missions or consular posts of Member States together with the delegation of the Commission shall launch a campaign informing the general public about the objectives pursued, the data stored in and the authorities having access to the VIS, and the rights of visa applicants.

Member States’ responsibilities : a new part is added on general responsibilities for Member States. A provision on the status of documents, data and biometric identifiers is important in order to ensure that they will benefit from consular protection. A provision on training is necessary, given the specific expertise the enrolment of biometrics requires. Rules on liability and penalties are necessary in view of potential damage resulting from acts violating this Regulation. The wording has been clarified to bring it into conformity with the wording in the VIS Regulation.

Report and review : three years after the VIS is brought into operation and every four years thereafter, the Commission must present a report on the implementation of the Regulation, including the implementation of the enrolment of biometric identifiers, the appropriateness of the ICAO standard chosen, compliance with data protection rules, experience with external service providers with specific reference to the collection of biometric data, the principle of the “first application” and the organisation of the reception and the processing of visa applications. The report shall also include: the cases in which fingerprints could factually not be provided or were not required to be provided for legal reasons compared with the number of cases in which fingerprints are taken; and information on cases in which a person who could factually not provide fingerprints was refused a visa.

Other amendments are the following :

- the word 'aliens' should be replaced by the word 'applicants' throughout the text, since this is the word used in the VIS Regulation;

- a reference to the Charter of Fundamental Rights has also been added ;

- it will be possible to copy biometric data from the first application within a period of 59 (rather than 48 months) months from the start of the retention period provided for in the VIS Regulation;

- given in particular the risks for data security and data protection linked to the taking of biometrics, some amendments ensure that any activity linked to the issuing of visas takes place in a building enjoying diplomatic or consular protection. This is the case both for Common Application Centres and external service providers.

- a reference is made to the common Schengen visa internet site;

- on information on visa applications, the Committee inserted the relevant provisions from the Visa Code proposal.

PE396.819

PE394.165

PE390.625

Opinion of the European Data Protection Supervisor

The present proposal aims at amending the Common Consular Instructions (CCI). These were adopted by the Executive Committee established by the Convention applying the Schengen Agreement of 14 June 1985.

As a part of the Schengen Acquis, they were inserted into EU law by a Protocol annexed to the Treaty of Amsterdam, and have been amended on several occasions since. Although a number of amendments remain confidential, the CCI were published in 2000. As to content, they are essentially a handbook containing practical rules on how to issue short-stay visas. They contain provisions on the examination of applications, the decision-making procedure, on how to fill in visa-stickers, etc.

According to the EDPS, this sensitive nature of biometric data requires that the introduction of obligations to use these data should only take place after a thorough assessment of its risks and should follow a procedure allowing full democratic control. These remarks underlie the examination by the EDPS of the present proposal.

The EDPS welcomes the fact that this proposal to amend the Common Consular Instructions is to be adopted in co-decision, thereby enhancing the democratic scrutiny in an area where this is certainly much needed.

On the substance , the EDPS recommends the following:

the exemptions of the obligation to provide fingerprints should be dealt with in the VIS Regulation rather than in the CCI, in order to ensure clarity and consistency of this regime; the age limits for fingerprinting and photographs should be given careful consideration, taking account of aspects of feasibility but also of considerations of ethics, convenience and accuracy; photographs should not be considered as a ‘stand alone’ identification method but only as a supporting element; outsourcing the processing of visa application to a private company should be admissible only if it involves a place under diplomatic protection, and is based on contractual clauses providing for effective oversight and liability of the contractor.

OJ C 321 29.12.2006, p. 0038
N6-0003/2007

Commission Vice-President Frattini presented this recently adopted Commission proposal which is intended to create the legal basis for Member States to take mandatory biometric identifiers - the facial image and ten flat fingerprints - from visa applicants and to give a legal framework for the organisation of Member States' consular offices.

According to the Hague Programme, the Commission was invited to submit a proposal providing for a legal framework for Member States to set up Common Application Centres. The creation of such common application centres for visas is intended to allow Member States to share premises, staff and equipment and thus the economic burden caused by the introduction of biometric data in visas.

2732

PURPOSE: i) to amend the Common Consular Instructions to allow for mandatory biometric identifiers from visa applicants ii) to offer Member States various options on how to organise, jointly, the reception and processing of visa applications.

PROPOSED ACT: Regulation of the European Parliament and of the Council.

CONTENT: this draft Regulation is being proposed by the European Commission to complement and reinforce the proposed Regulation on the exchange of data between Member States on short-stay visas.

Background

Currently, there are two procedure numbers, which relate to the presentation of this proposal:

- CNS/2004/0029: Refers to Council Decision 2004/512/EC on the establishment of the Visa Information System. (adopted on 8 June 2004).

- CNS/2004/0287: Refers to the proposed Regulation on the exchange of data on Schengen short-stay visas including the national long-stay visas which are concurrently valid as short-stay visas (Proposal yet to be concluded).

In addition, the Common Consular Instructions (CCI), a Council document on “ Common Consular Instructions on Visas for the Diplomatic Missions and Consular Posts” governs the exact specifications on how to issue visas, from the costing thereof to verification of an applicant etc. (Please refer to Official Journal 2003/C 310, 19/12/2003)

Objective

The purpose of this proposal is twofold. Firstly, to create a legal base from which the Member States are able to take mandatory biometric identifies (in this case the facial image and ten flat fingerprints) and secondly, to create a legal base from which the Member States can operate joint consular offices for the implementation of the Visa Information System (VIS).

Biometric identifiers

The proposed Regulation on the exchange of data between the Member States on short-stay visas deals mainly with the transmission and exchange of data. The focus of this proposal is on the collection of biometric data. In presenting this Regulation the EU will create an additional legal instrument, which allows for the implementation of common and harmonised biometric specifications. To do so the Common Consular Instructions (CCI) will need to be amended.

The biometric specifications will be based on international standards adopted by the ICAO. These set out in detail how the photograph has to be taken as well as detailing how fingerprints must be scanned. Initially, biometric identifiers were to have been stored on a contactless chip attached to each visa sticker. However, this proved technically unfeasible. As a result all biometric identifiers of visa applicants will now be stored on the Visa Information System only. As a reminder, this development also affects a proposal to lay down a uniform format for the residence permits for third-country nationals . (Please refer to CNS/2003/0218).

Common Application Centres

A further element to this proposal is the pooling of resources for the sake of cost savings and simplification through the establishment of Common Application Centres (CAC’s). This applies to the organisation of Member States’ consular sections for the implementation of VIS. The concept of CAC’s is based on the Hague programme, which invited the Commission to present a proposal on the establishment of common application centres. A number of advantages are associated with the establishment of CAC’s: reinforcing local consular co-operation; streamlining procedures and offering cost-savings through the pooling of Member State resources. In other words, in addition to existing representations, Member States could consider the option of using new consular offices based on co-location, common application centres and outsourcing.

This later point, outsourcing, forms another central plank of the proposal. The outsourcing of non-sensitive activities, such as call-centres for appointments or the reception of applications, for consular posts faced with particularly high numbers of applications, could prove to be a further cost-saving measure. Outsourcing, however, should be done based on a common format. As the Commission points out, some Member States already “outsource” certain activities without common procedures and standards. It should be stressed that outsourcing is not being proposed as a general solution. Rather, it is optional, to be used in certain posts depending on the local situation. The solution being proposed by the Commission would mean that the Member States remain the “controllers” whilst external service providers remain the “processor”.

Provisions in detail

In other provisions, the proposed Regulation would create a “one-stop” system for visa applications, whereby depositing a visa application form and the taking of biometric identifies can all take place at the same time and in the same place. The CCI will also be amended:

- To allow for “limited representation”. This option allows a visa applicant to deposit his/her application form and submit their biometric data via one Member State consular section. This consular section can then forward the data to the consular post of the Member State deciding the visa application.

- To oblige the Member States to collect biometric identifiers as part of the visa application procedure. Fingerprints are taken during the first submission of a visa application.

- To waive the necessity of having to re-submit this data if the applicant seeks further applications within a four year time-frame. In other words the fingerprints and the photograph can be re-used and copied from the first application – up to a period of four years.

- To ensure that the necessary information is stored, for this period of time, on the VIS.

- To oblige applicants to make at least one personal appearance. After that applicants may use travel agencies to introduce their second request for a visa application.

Exceptions to these provisions have been built-in to the proposal. For example, children under the age of 6 do not need to submit finger-prints. Nor do persons, who are physically incapable of doing so. Holders of diplomatic passports, service/official passports and special passports will also be exempted from submitting biometric data.

On the matter of the Common Application Centres, the CCI will be amended:

- To offer the possibility of outsourcing. Responsibility for issuing visa remains that of the Member States. However, an external service provider could take over responsibility for certain activities, such as arranging appointments and/or taking the biometric identifiers. Member States must ensure that all relevant data protection rules are applied

- Member States will not be forced to co-operate and participate in CAC’s if they do not wish to do so. The setting up of a CAC will be a matter for Member State negotiations. However, in cases where they do decide to co-operate they must do so based on one of the options set out in the amended CCI.

- The framework for co-operation, such as cost sharing, will be agreed amongst the participating Member States. They will be responsible for determining the solution chosen for each country or region within a third country. They will be obliged to draw up a list indicating the solutions chosen, which will be published.

Lastly, in order to examine the effectiveness of the CAC’s and other forms of co-operation the Commission will present a report on the implementation of the present Regulation.

In accordance with Treaty provisions, the UK, Ireland and Denmark will not be taking part in the adoption of the Regulation. The ten new EU Member States, Norway, Iceland and Switzerland shall participate.

COM(2006)0269
EUR-Lex

PURPOSE: i) to amend the Common Consular Instructions to allow for mandatory biometric identifiers from visa applicants ii) to offer Member States various options on how to organise, jointly, the reception and processing of visa applications.

PROPOSED ACT: Regulation of the European Parliament and of the Council.

CONTENT: this draft Regulation is being proposed by the European Commission to complement and reinforce the proposed Regulation on the exchange of data between Member States on short-stay visas.

Background

Currently, there are two procedure numbers, which relate to the presentation of this proposal:

- CNS/2004/0029: Refers to Council Decision 2004/512/EC on the establishment of the Visa Information System. (adopted on 8 June 2004).

- CNS/2004/0287: Refers to the proposed Regulation on the exchange of data on Schengen short-stay visas including the national long-stay visas which are concurrently valid as short-stay visas (Proposal yet to be concluded).

In addition, the Common Consular Instructions (CCI), a Council document on “ Common Consular Instructions on Visas for the Diplomatic Missions and Consular Posts” governs the exact specifications on how to issue visas, from the costing thereof to verification of an applicant etc. (Please refer to Official Journal 2003/C 310, 19/12/2003)

Objective

The purpose of this proposal is twofold. Firstly, to create a legal base from which the Member States are able to take mandatory biometric identifies (in this case the facial image and ten flat fingerprints) and secondly, to create a legal base from which the Member States can operate joint consular offices for the implementation of the Visa Information System (VIS).

Biometric identifiers

The proposed Regulation on the exchange of data between the Member States on short-stay visas deals mainly with the transmission and exchange of data. The focus of this proposal is on the collection of biometric data. In presenting this Regulation the EU will create an additional legal instrument, which allows for the implementation of common and harmonised biometric specifications. To do so the Common Consular Instructions (CCI) will need to be amended.

The biometric specifications will be based on international standards adopted by the ICAO. These set out in detail how the photograph has to be taken as well as detailing how fingerprints must be scanned. Initially, biometric identifiers were to have been stored on a contactless chip attached to each visa sticker. However, this proved technically unfeasible. As a result all biometric identifiers of visa applicants will now be stored on the Visa Information System only. As a reminder, this development also affects a proposal to lay down a uniform format for the residence permits for third-country nationals . (Please refer to CNS/2003/0218).

Common Application Centres

A further element to this proposal is the pooling of resources for the sake of cost savings and simplification through the establishment of Common Application Centres (CAC’s). This applies to the organisation of Member States’ consular sections for the implementation of VIS. The concept of CAC’s is based on the Hague programme, which invited the Commission to present a proposal on the establishment of common application centres. A number of advantages are associated with the establishment of CAC’s: reinforcing local consular co-operation; streamlining procedures and offering cost-savings through the pooling of Member State resources. In other words, in addition to existing representations, Member States could consider the option of using new consular offices based on co-location, common application centres and outsourcing.

This later point, outsourcing, forms another central plank of the proposal. The outsourcing of non-sensitive activities, such as call-centres for appointments or the reception of applications, for consular posts faced with particularly high numbers of applications, could prove to be a further cost-saving measure. Outsourcing, however, should be done based on a common format. As the Commission points out, some Member States already “outsource” certain activities without common procedures and standards. It should be stressed that outsourcing is not being proposed as a general solution. Rather, it is optional, to be used in certain posts depending on the local situation. The solution being proposed by the Commission would mean that the Member States remain the “controllers” whilst external service providers remain the “processor”.

Provisions in detail

In other provisions, the proposed Regulation would create a “one-stop” system for visa applications, whereby depositing a visa application form and the taking of biometric identifies can all take place at the same time and in the same place. The CCI will also be amended:

- To allow for “limited representation”. This option allows a visa applicant to deposit his/her application form and submit their biometric data via one Member State consular section. This consular section can then forward the data to the consular post of the Member State deciding the visa application.

- To oblige the Member States to collect biometric identifiers as part of the visa application procedure. Fingerprints are taken during the first submission of a visa application.

- To waive the necessity of having to re-submit this data if the applicant seeks further applications within a four year time-frame. In other words the fingerprints and the photograph can be re-used and copied from the first application – up to a period of four years.

- To ensure that the necessary information is stored, for this period of time, on the VIS.

- To oblige applicants to make at least one personal appearance. After that applicants may use travel agencies to introduce their second request for a visa application.

Exceptions to these provisions have been built-in to the proposal. For example, children under the age of 6 do not need to submit finger-prints. Nor do persons, who are physically incapable of doing so. Holders of diplomatic passports, service/official passports and special passports will also be exempted from submitting biometric data.

On the matter of the Common Application Centres, the CCI will be amended:

- To offer the possibility of outsourcing. Responsibility for issuing visa remains that of the Member States. However, an external service provider could take over responsibility for certain activities, such as arranging appointments and/or taking the biometric identifiers. Member States must ensure that all relevant data protection rules are applied

- Member States will not be forced to co-operate and participate in CAC’s if they do not wish to do so. The setting up of a CAC will be a matter for Member State negotiations. However, in cases where they do decide to co-operate they must do so based on one of the options set out in the amended CCI.

- The framework for co-operation, such as cost sharing, will be agreed amongst the participating Member States. They will be responsible for determining the solution chosen for each country or region within a third country. They will be obliged to draw up a list indicating the solutions chosen, which will be published.

Lastly, in order to examine the effectiveness of the CAC’s and other forms of co-operation the Commission will present a report on the implementation of the present Regulation.

In accordance with Treaty provisions, the UK, Ireland and Denmark will not be taking part in the adoption of the Regulation. The ten new EU Member States, Norway, Iceland and Switzerland shall participate.

COM(2006)0269
EUR-Lex