PHAEDRAII-IMPROVINGPRACTICALANDHELPFULCO-OPERATIONBETWEENDATAPROTECTIONAUTHORITIESII
http://www.phaedra-project.eu/
DPA: College Bescherming Persoonsgegevens (Netherlands)
TITLE: CBP IND Applies rules SIS II inadequately
DATE: 30 November 2015
KEY WORDS: Schengen, SIS II, Immigration, Government data
WEBSITE LINK: https://autoriteitpersoonsgegevens.nl/nl/nieuws/cbp-ind-past-regelssis-ii-onvoldoende-toe
ABSTRACT:
The Dutch data protection authority conducted an investigation into the Immigration
and Naturalisation Service (IND) and found that the IND had not always followed the
rules of the Schengen Information System II in the processing of alerts on foreigners.
As part of the investigation, the CBP has a performed sampling on a number of files. In
nine of the 14 cases examined CBP found that the treatment was not in accordance with
the rules in the Schengen Information System (SIS II). For instance, include cases of
alerts without mention of the source of a decision or of the underlying reason for the
alert.
ASSESSMENT:
CBP is the national regulator for the Dutch part of the Schengen Information System.
CBP has checked in the context of compulsory periodic examination of the IND to
ensure that they rules ofthe Schengen Information System (SIS II) are observed.
The Schengen Agreement, signed in 1985 and supplemented by the Schengen
Convention in 1990, created the Schengen area in Europe in 1995. The Schengen area
abolishes internal border controls and implements a common visa policy. The Schengen
Information System (SIS) was a database which allowed the participating states to share
information for border control, national security and law enforcement purposes. The
data protection elements of the SIS were supervised by the Schengen Joint Supervisory
Authority (JSA). With the shift to the expanded SIS II system 1 , the JSA has been
dissolved as of April 2013 and replaced by co-ordinated supervision between national
data protection authorities and the European Data Protection Supervisor. The JSA was
the first EU supervisory authority which promoted joint coordinated supervisory
activities in the law enforcement area as regards the inspection of large scale databases.
This approach to the supervisory role was apparently successful, being influential on
future coordinated supervision efforts such as the Eurodac, VIS and Customs
supervisory bodies.2
1
Council Decision 2007/533/JHA of 12 June 2007 on the establishment, operation and
use of the second gneration Schengen Information System (SIS II) (theeCouncil
Decision) and Regulation (EC) No 1987/2006 of the European Parliament and of the
Council of 20 December 2006 on the establishment, operation and use of the second
generation Schengen Information System (SIS II) (the Regulation),
2
Schengen Joint Supervisory Authority, Activity Report–December 2005 -December
2008,2008, p. 11. http://www.llv.li/pdfllvdssjsa_sch.act.rep.en.pdf
PHAEDRAII-IMPROVINGPRACTICALANDHELPFULCO-OPERATIONBETWEENDATAPROTECTIONAUTHORITIESII
http://www.phaedra-project.eu/
The national supervisory authorities and the European Data Protection Supervisor, will
each act within the scope of its respective competences, and are to:
• to exchange relevant information,
• assist each other in carrying out audits and inspections, examine difficulties of
interpretation or application of the Council Decision (the Regulation),
• study problems with the exercise of independent supervision or in the exercise
of the rights of data subjects,
• draw up harmonised proposals for joint solutions to any problems and
• promote awareness of data protection rights, as necessary.
European Data Protection Supervisor and the national supervisory authorities are to
meet at least twice a year.
SIS II comprises a central system, EU States’ national systems and a communication
network between the central and the national systems. The European Commission is
responsible for the development of the SIS II central system, while SIS II national
systems are developed by the Schengen States. SIS II will be managed by the
independent European Agency for the operational management of large scale IT
systems in the area of freedom, security and justice. This Agency is also be tasked with
managing EURODAC and the Visa Information System3.
3
Barnard-Wills, David & Wright, David (Eds), Co-ordination and cooperation between
data protection authorities: Workstream 1 Report, PHAEDRA project, 30 June 2014,
http://www.phaedra-project.eu/wp-content/uploads/PHAEDRA-D1-30-Dec-2014.pdf,
pp.93-95