EUROPEAN COMMISSION
Brussels, 29.6.2021
COM(2021) 336 final
REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL
on the state of play of preparations for the full implementation of the new legal bases for the Schengen Information System (SIS) in accordance with Article 66(4) of Regulation (EU) 2018/1861 and Article 79(4) of Regulation (EU) 2018/1862
1.INTRODUCTION
On 28 November 2018, the European Parliament and the Council adopted three new Regulations on the establishment, operation and use of the Schengen Information System (hereafter: the Regulations) 1 .
Article 66(4) of Regulation (EU) 2018/1861 and Article 79(4) of Regulation (EU) 2018/1862 requires the Commission to submit on an annual basis a report to the European Parliament and the Council on the state of play of preparations for the full implementation of the Regulations.
The first status report adopted in February 2020 2 described the preparatory work done by the Commission, agencies and Member States from 1 January 2019 until 30 September 2019.
This second status report covers the period from 1 October 2019 until 30 September 2020 3 . It is based on information that Member States and agencies have made available to the Commission in questionnaires and surveys, and achievements in meetings and workshops.
The different sections explain the work covered during the reporting period by the Commission, Member States and agencies.
2.STATE OF PLAY OF PREPARATIONS FOR IMPLEMENTATION OF THE REGULATIONS
2.1.Preparation of implementing acts by the Commission
2.1.1.Requirements
A targeted amendment to the SIRENE Manual 4 is required in order to allow Europol to exchange supplementary information with the SIRENE Bureaux as provided for in point 9 of Article 63 of Regulation (EU) 2018/1861 and point 7 of Article 77 of Regulation (EU) 2018/1862.
In addition, the implementing acts necessary for the full application of the Regulations must be adopted before the revised Schengen Information System can start operations in accordance with Article 66(2) of Regulation (EU) 2018/1861 and Article 79(2) of Regulation (EU) 2018/1862. The legal deadline for the full application of the revised Schengen Information System is 28 December 2021.
2.1.2.Finalisation of technical implementing decisions
During the reporting period, the Commission, in cooperation with agencies and the relevant Committee 5 , finalised the work on the implementing decisions that are a technical prerequisite for the entry into operation of the revised Schengen Information System.
2.1.3.Revision of SIRENE Manual in two phases
During the reporting period, the Commission, in cooperation with agencies and the SIS-SIRENE Committee, reached significant progress in updating the SIRENE Manual, in two phases:
·phase I: targeted amendment of the current SIRENE Manual 6 to include Europol in the exchange of supplementary information with SIRENE Bureaux as provided for in point 9 of Article 63 of Regulation (EU) 2018/1861 and point 7 of Article 77 of Regulation (EU) 2018/1862;
·phase II (to be completed as a precondition for the full start of the application of the revised Schengen Information System): complete revision of the SIRENE Manual, including all new procedures required in view of the Regulations.
With regard to the targeted amendment of the SIRENE Manual under phase I, the Commission elaborated specific rules for the exchange of supplementary information between Europol and the SIRENE Bureaux, notably on:
·the use of handling codes;
·the provision of supplementary information by Europol after a match;
·the provision of supplementary information by the SIRENE Bureaux after a hit on alerts related to terrorist offences;
·the procedures for Europol when it needs to obtain agreement to use data and supplementary information, or to share it with third countries;
·the procedures for Europol when it needs to obtain agreement on the continued storage of supplementary information; and
·the collection and provision of statistics on the exchange of supplementary information by Europol.
The preparatory work has been completed during the reporting period.
With regard to the complete revision of the SIRENE Manual under phase II, the Commission organised during the reporting period nine meetings of the SIRENE Subgroup to analyse thoroughly the procedural requirements originating from the Regulations. The main preparatory work has been completed during the reporting period, including the revision of the SIRENE forms (templates used by SIRENE Bureaux to exchange supplementary information in a structured way) and the technical specifications for the exchange of SIRENE forms.
The work will continue during the next reporting period with the aim to reach an agreement on the draft SIRENE Manual in the SIS-SIRENE Committee and to adopt the revised SIRENE Manual by the end of the next reporting period.
2.2.Development of Central SIS 7 and preparation of testing activities by eu-LISA
2.2.1.Tasks of eu-LISA
Eu-LISA is in charge of the operation and development of Central SIS and plays a crucial role in the implementation of the Regulations. The main tasks of eu-LISA are:
·to update the technical documentation for Central SIS and the interactions between Central SIS and the national systems in line with the requirements from the Regulations and the implementing acts;
·to implement the required changes in Central SIS and prepare, coordinate and carry out all testing activities with regard to Central SIS and the interactions with the national systems, in close cooperation with Member States and agencies;
·to complete all testing activities before the revised Schengen Information System can start operations in accordance with Article 66(2) of Regulation (EU) 2018/1861 and Article 79(2) of Regulation (EU) 2018/1862.
2.2.2.Entry into operation of the first implementation phase on 8 January 2020
On 8 January 2020, eu-LISA has put the first release for the update of Central SIS in accordance with the Regulations into operation, giving Europol full access to all alerts created in the Schengen Information System and enabling the European Border and Coast Guard Agency to establish a technical connection to Central SIS, as required under point 9 of Article 63 of Regulation (EU) 2018/1861 and points 7 and 8 of Article 77 of Regulation (EU) 2018/1862. In addition, the agencies have been granted access to the fingerprint search functionality of the Schengen Information System.
2.2.3.Preparations for the development of the non-biometric part of Central SIS for start of operation before end 2021
During the reporting period, eu-LISA organised ten Project Management Forum meetings with all stakeholders (Commission, Members States, Europol, Eurojust and the European Border and Coast Guard Agency) and the external contractor to steer the development and finalisation of the technical specifications in line with the technical rules agreed in the relevant committee.
The technical specifications for the non-biometric part of the revision of the Schengen Information System have been approved by all stakeholders in May 2020, and eu-LISA has started the development of the required changes to Central SIS during the reporting period.
2.2.4.Preparations for the development of biometric part of Central SIS for start of operations before end 2021
During the reporting period, eu-LISA organised nine specific meetings with all stakeholders (Commission, Members States, Europol, Eurojust and the European Border and Coast Guard Agency) and the external contractor on the Automated Fingerprint Identification System. The biometric component of this system entered into operation in March 2018, but the Regulations require important modifications. In particular, biometric searches will be extended with new categories of dactyloscopic data (palm prints and palm/finger marks).
The ‘Analysis and Design’ phase covering the preliminary work on project initiation, requirements and specification was concluded during the reporting period with the finalisation and approval of the technical specifications on 1 October 2020. The second phase “Implementation” has been initiated.
2.2.5.Review of technical specifications for the exchange of supplementary information between SIRENE Bureaux
The revision of the forms by the relevant committee referred to under point 2.1.3 required an update of the technical specifications for the exchange of forms and the related documentation. In accordance with common Article 15(3)(b) of Regulation (EU) 2018/1861 and Regulation (EU) 2018/1862, the maintenance and updating of technical specifications for the exchange of supplementary information between SIRENE Bureaux has been assigned to eu-LISA.
During the reporting period, eu-LISA organised five workshops with all stakeholders reaching a general agreement on the requirements in September 2020. It is planned to finalise and approve the technical specifications and documentation by the end of 2020.
2.2.6.Summary and risks
Compared to the previous reporting period, where eu-LISA initiated the preparations for the project with the creation of technical groups and organising the global planning, work is progressing for the development of Central SIS in line with the Regulations.
The technical specifications are approved and development is ongoing for the non-biometric part of Central SIS. For the biometric part of Central SIS, the technical specifications are finalised and development has been initiated. The two parts of the technical specifications will be merged into one single document by the end of 2020.
The COVID-19 crisis has impacted on global planning with hardware shortages, hardware delivery delays, travel restrictions and inaccessibility of eu-LISA’s data centres. The global planning for 2020 and 2021 was re-adjusted and 2021 will be dedicated to testing activities with Member States and agencies until November, after the next reporting period. According to the global planning, is still schedules to put the final release for the revised Schengen Information System in production by the end of 2021, according to the deadlines specified in the Regulations.
2.3.Member States’ preparations
2.3.1.Scope and requirements
This report covers 25 EU Member States and four Schengen Associated Countries 8 connected to Central SIS during the reporting period, and two EU Member States (Cyprus and Ireland) which were not connected to Central SIS during the reporting period. 9
Article 66 (5)(c) of Regulation (EU) 2018/1861 and Article 79 (5)(c) of Regulation 2018/1862 require all Member States connected to Central SIS to have implemented the search functionality of the Schengen Information System - Automated Fingerprint Identification System in their national systems by 28 December 2020. This obligation does not yet apply to Cyprus and Ireland, as they were not yet connected to Central SIS during the reporting period.
In addition, all Member States connected to Central SIS need to ensure the timely development of their national systems in line with the approved documents and technical specifications.
Member States must have notified the Commission that they have made the necessary technical and legal arrangements to process data and exchange supplementary information pursuant to this Regulation before the revised Schengen Information System can start operations in accordance with Article 66(2) of Regulation (EU) 2018/1861 and Article 79(2) of Regulation (EU) 2018/1862.
2.3.2.State of play of deployment of Schengen Information System - Automated Fingerprint Identification System (to be completed by end 2020)
The obligation to deploy the Schengen Information System - fingerprint search functionality applies to 25 EU Member States and four Schengen Associated Countries (Cyprus and Ireland are not yet in scope during the current reporting period).
The status until the end of the reporting period (30 September 2020) is the following:
·22 out of 29 participating States have already deployed the fingerprint search functionality;
·5 out of 29 participating States have planned to deploy the fingerprint search functionality before the end of 2020;
·2 out of 29 participating States have planned to deploy the fingerprint search functionality in the beginning of 2021; the two States concerned indicated that the delay was due to the impact of the COVID-19 crisis.
2.3.3.Preparations for the full implementation of the Regulations (to be completed before the end of 2021)
Preparations by Member States are crucial because the Commission can only set the date from which the new Schengen Information System starts operation pursuant to Article 66(2) of Regulation (EU) 2018/1861 and Article 79(2) of Regulation (EU) 2018/1862 after the Member States have notified the Commission that they have made the necessary technical and legal arrangements.
The Commission asked all EU Member States and Schengen Associated Countries to report through a questionnaire launched in September 2020 on preparations done at national level in the reporting period. All Member States responded (31 respondents).
Member States were requested to provide input in the following areas:
·project planning and management;
·internal coordination;
·impact assessment in terms of budget, human resources, organisation and national legislation;
·risks.
In terms of project planning, nearly all Member States and Schengen Associated Countries (29 respondents out of 30) have already started to define or have defined a project plan and related milestones (15 more than in 2019). In addition, 28 respondents out of 31 have established or will establish in the near future a specific project team and assigned a project manager, while the remaining three States will manage the implementation through existing departments or teams. A large majority of the respondents (24) established in 2020 cooperation at national level between competent authorities.
In terms of impact assessment, the Member States are currently at different stages of preparation 10 :
budgetary impact assessment:
·14 Member States have completed the assessment and allocated the relative budget;
·16 Member States have completed the assessment and will allocate the budget by the end of 2020 or beginning of 2021;
·1 Member State will start the assessment by the end of 2020;
human resources needs assessment:
·17 Member States have completed the assessment;
·9 Member States will complete the assessment by 2020 or in 2021;
·5 Member States will start the assessment by the end of 2021 or indicated no date;
organisational needs assessment:
·5 Member States have completed the assessment and adopted measures to cope with the implementation;
·14 Member States have completed the assessment but need to adopt measures to cope with the implementation;
·9 Members State will complete the assessment by end of 2020 or beginning of 2021;
·3 Member States have reported that they have started the assessment but did not indicated a final date;
assessment of impact on national legislation:
·1 Member State has completed the analysis and approved the amendments;
·16 Member States have completed the assessment and started the approval of the amendments;
·4 Member States will complete the assessment by the end of 2020;
·7 Member States will complete the assessment at the beginning or during 2021;
·3 Member States will complete the assessment by the end of 2021.
2.3.4.Summary and risks
During the reporting period, Member States showed progress in all project preparation areas for the full implementation of the Regulations. Member States are progressing with the analysis of the requirements of the system, and a few Member States have already initiated the development of their national systems during the reporting period. The approval of the technical specifications for the biometric and non-biometric part of Central SIS during the reporting period has made it possible for Member States to initiate those national developments. Nevertheless, the main work will be carried out in the next reporting period, starting from 1 October 2020.
Most of the Member States will be operational with fingerprint searches by end of 2020, as required by the Regulations.
In their answers to the questionnaire, Member States highlighted several risk and issues for the success of the project at national level, such as:
·impact of the COVID-19 pandemic as a general risk of possible delays;
·ambitious timelines and many projects related to large-scale information systems with similar deadlines;
·staffing problems, problems with tendering procedures and some issues with internal legislative procedures.
The Commission and eu-LISA will continue to closely follow the preparatory activities by Member States during the regular meetings of the relative committee and the Project Management Forum.
2.4.Agencies
2.4.1.Scope and requirements
This part of the report focuses on preparations done by Europol and the European Border and Coast Guard Agency as the provisions impacting those agencies entered into application already by end 2019. The changes impacting Eurojust are minimal and only apply as from end 2021. Eurojust also did not answer to the questionnaire but will need to be included in the report covering the next reporting period.
2.4.2.Europol
Europol already is a user of the Schengen Information System. The Regulations include for Europol modifications in the following two areas:
·access to all categories of alerts, and
·connection to the SIRENE network.
The new provisions apply as of the end of 2019.
By the end of November 2019, Europol concluded the technical preparations to enable the existing search interface to access all alerts. In January 2020, Europol was granted technical access to all alert types as part of the new Schengen Information System. Europol enabled this access to its end-users after positive outcome of a prior consultation process with the European Data Protection Supervisor during the reporting period.
Europol initially aimed to be ready for the connection to the SIRENE network by end 2020. However, preparations for the setup of the SIRENE function at Europol continued during 2020. Europol is re-designing the internal business processes that will be impacted by the SIRENE information flow and validating the detailed requirements of the SIRENE mail relay integration with the internal environment at Europol. An interim solution to enable retrieve, process and send SIRENE messages is planned to be ready for testing by end of 2020 and readiness of Europol to implement the full SIRENE function is planned by end of 2021, not by 2020 as previously planned.
2.4.3.European Border and Coast Guard Agency
Under the Regulations, the members of the teams deployed by the European Border and Coast Guard Agency have as from end 2019 the right to access all categories of alerts. The members of those teams need to access the Schengen Information System through a technical interface set up and maintained by the European Border and Coast Guard Agency. In the course of 2019, the Agency made all the preparations in a form of a project divided in different parts.
During the reporting period, the European Border and Coast Guard Agency carried over the following activities:
·approval of a final version of the Project Initiation Document in August 2020;
·in February 2020 a restricted procedure for a Framework Contract for the development of a software solution for the European Border and Coast Guard Agency was launched; the procedure was delayed due to COVID-19 and it is planned to receive the offer from the bidders by end of October 2020;
·the tender for acquisition of the document readers and fingerprint scanners will be re-published by end of October 2020;
·the first draft of Standard Operating Procedures has been prepared by the project team and consulted internally within the European Border and Coast Guard Agency; Member States’ consultation is ongoing;
·eu-LISA delivered new hardware for the network connection to the Schengen Information System and organised technical workshops to key agency representatives.
Contrary to what was estimated in 2019, the project is now estimated at a total duration of 31 months and final delivery date in May 2022. The first major output of the project (i.e. web application for searches) is estimated to be delivered in November 2021.
3.CONCLUSIONS
During the second reporting period (30 September 2019 – 30 September 2020), the different stakeholders have made significant progress to achieve implementation of the Regulations in accordance with the defined milestones:
1)implementation phase I (as from end 2019): eu-LISA completed by 8 January 2020 the necessary preparations to extend full access to the Schengen Information System to Europol, and to allow the European Border and Coast Guard Agency to connect to the Schengen Information System; Europol has access to all alert categories; the European Border and Coast Guard Agency continued the project for allowing the members of its teams to get access to the Schengen Information System in November 2021;
2)implementation phase II (by end 2020): at the end of the reporting period, 22 Member States have deployed the fingerprint search functionality; five Member States still plan to deploy the functionality by the end of 2020; it is estimated that two Member States will have a slight delay in the implementation (early 2021);
3)implementation phase III (by end 2021): during the reporting period, under the coordination of the Commission and eu-LISA, activities to prepare implementing measures and technical specifications required for full implementation of the Regulations continued; the finalisation of some major milestones of the preparatory work in 2020 (technical implementing acts and technical specifications) made it possible for Member States to start national developments to be ready for entry into operation by the end of 2021.
The COVID-19 pandemic disrupted the implementation schedule, but measures put in place by the Commission, eu-LISA and Member States in the last months have for the time being proven effective and have reduced the negative impact at central and national level.
Two Member States declared not being able to deploy the fingerprints search functionality by the end of 2020, as required by the Regulation. However, the delay is limited to a few months and should be accommodated by the beginning of 2021.
The Commission will continue to engage directly both at political and technical level and monitor, in coordination with the eu-LISA Management Board, progress in the implementation of the revised Schengen Information System in the context of interoperability of information systems for borders and security.
The third status report will describe the activities of stakeholders during the next reporting period, from 1 October 2020 until 30 September 2021.