REPORT on the proposal for a regulation of the European Parliament and of the Council amending the Common Consular Instructions on visas for diplomatic missions and consular posts in relation to the introduction of biometrics including provisions on the organisation of the reception and processing of visa applications

29.11.2007 - (COM(2006)0269 – C6‑0166/2006 – 2006/0088(COD)) - ***I

Committee on Civil Liberties, Justice and Home Affairs
Rapporteur: Sarah Ludford

DRAFT EUROPEAN PARLIAMENT LEGISLATIVE RESOLUTION

on the proposal for a regulation of the European Parliament and of the Council amending the Common Consular Instructions on visas for diplomatic missions and consular posts in relation to the introduction of biometrics including provisions on the organisation of the reception and processing of visa applications

(COM(2006)0269 – C6‑0166/2006 – 2006/0088(COD))

(Codecision procedure: first reading)

The European Parliament,

–   having regard to the Commission proposal to the European Parliament and the Council (COM(2006)0269),

–   having regard to Article 251(2) and Article 62 (2) (b) (ii) of the EC Treaty, pursuant to which the Commission submitted the proposal to Parliament (C6‑0166/2006),

–   having regard to Rule 51 of its Rules of Procedure,

–   having regard to the report of the Committee on Civil Liberties, Justice and Home Affairs (A6‑0459/2007),

1.  Approves the Commission proposal as amended;

2.  Calls on the Commission to refer the matter to Parliament again if it intends to amend the proposal substantially or replace it with another text;

3.  Instructs its President to forward its position to the Council and the Commission.

Text proposed by the Commission	Amendments by Parliament
Amendment 1 RECITAL 3
(3) The choice of the biometric identifiers is made in the [Regulation of the European Parliament and of the Council concerning the Visa Information System (VIS) and the exchange of data between Member States on short-stay visas]. This Regulation defines the standards for the collection of these biometric identifiers by referring to the relevant provisions set out by the International Civil Aviation Organisation (ICAO). No further technical specifications are required in order to ensure interoperability.	(3) The [Regulation of the European Parliament and of the Council concerning the Visa Information System (VIS) and the exchange of data between Member States on short-stay visas] provides that fingerprints and photographs of the applicant should be stored in the VIS. This Regulation defines the standards for the collection of these biometric identifiers by referring to the relevant provisions set out by the International Civil Aviation Organisation (ICAO). No further technical specifications are required in order to ensure interoperability.
Justification
This amendment only aims to clarify the text: it should be clear what the choice of biometric identifiers is and that two distinct regulations are meant.
Amendment 2 RECITAL 3 A (new)
	(3a) The reception arrangements for applicants should be made with due respect for human dignity and integrity. The processing of visa applications should be conducted in a professional and respectful manner and be proportionate to the objectives pursued.
Justification
The provision is copied from the Commission's Visa Code proposal (COM(2006)403) and slightly modified. Since the present text will probably enter into force before the new Visa Code enters into force it is important to incorporate in the present text those provisions judged indispensable for the functioning of the VIS. A general clause on the conduct of staff seems essential in particular because of the taking of biometric data as a new element in the visa issuing process.
Amendment 3 RECITAL 5
(5) Other options such as co-location, common application centres and outsourcing should be introduced. An appropriate legal framework for these options should be established, taking into account in particular data protection issues. Under the legal framework established Member States should be free to determine which type of organisational structure they will use in each third country. Details of those structures should be published by the Commission.	(5) Other options such as co-location, common application centres and outsourcing should be introduced. An appropriate legal framework for these options should be established, taking into account in particular data protection issues. In order to ensure the integrity of the visa issuing process, any activity related to the issuing of visas, including the collection of biometric data, should take place on the premises of a Member State which enjoy diplomatic or consular protection under international law or on European Commission premises recognised by the host State as inviolable. Under the legal framework established Member States should be free in accordance with the conditions laid down in in this Regulation to determine which type of organisational structure they will use in each third country. Details of those structures should be published by the Commission on a common Schengen visa internet site.
Justification
This amendment replaces Amendment 3 of the draft report.
Given, in particular, the risks for data security and data protection linked to the taking of biometrics but also the fact that the process of visa issuing is and should remain a public task (even if certain aspects are outsourced), several amendments have been tabled to ensure that any activity linked to the issuing of visas takes place in a building enjoying diplomatic or consular protection. It is important that these are Member States' buildings or delegations of the Commission, in order to ensure that Directive 95/46 and Regulation 45/2001 are applicable and that any material is protected, e.g. from seizure.
The idea of establishing a common Schengen visa internet site, www.schengenvisa.eu has been brought forward by Henrik Lax in his draft report on Visa Code and the present rapporteur fully supports it. For reasons of transparency and clarity, it is important that the organisational structures chosen by the Member States be published on the same website.
Amendment 4 RECITAL 7
(7) It is necessary to make provisions for situations in which Member States’ central authorities decide to outsource part of the visa handling process to an external service provider. Such arrangements should be established in strict compliance with the general principles for issuing visas, respecting the data protection requirements set out in Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data.	(7) Since the issuing of visas is by its very nature a public task, any decision taken by the central authorities of a Member State to outsource part of the visa handling process to an external service provider should only be taken if no other possibility exists and if it is duly justified. Such arrangements should be established in strict compliance with the general principles for issuing visas, respecting the data protection requirements set out in Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data.
Justification
Given the whole range of consequences that outsourcing could create, it should be undertaken only as a last option and should be duly justified. The rapporteur considers it very important to state this explicitly.
Amendment 5 RECITAL 8
(8) Member States shall conclude contracts with external service providers which should contain provisions on their exact responsibilities, direct and total access to their premises; information of applicants, confidentiality and circumstances, conditions and procedures for suspending or terminating the contract.	(8) Any contract that a Member State concludes with an external service provider should contain provisions on the provider's exact responsibilities, direct and total access to its premises; information of applicants, confidentiality, compliance with data protection rules and circumstances, conditions and procedures for suspending or terminating the contract. Member States should take appropriate measures to ensure that the contracts with external service providers are enforceable.
Justification
This amendment replaces Amendment 5 of the draft report. The first parts of the amendment are clarifications. The last part adds data protection as an important provision which the contracts with external service providers should contain.
Amendment 6 RECITAL 8 A (new)
	(8a) Member States should aim to organise the receipt of visa applications, the enrolment of biometric identifiers and the interview in such a way that the visa applicant has to appear only once in person (one-stop-shop principle) in order to obtain a visa.
Justification
It is very important that the introduction of biometrics does not create unnecessary inconveniences for visa applicants since it is also supposed to facilitate legitimate travel. Therefore Member States should aim as much as possible to follow the one stop shop principle.
Amendment 7 RECITAL 9
(9) To ensure the compliance with data protection the working group created by Article 29 of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and the European Data Protection Supervisor have been consulted.	(9) The European Data Protection Supervisor has issued an opinion in accordance with Article 28(2) of Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data1 and the Article 29 Working Party in accordance with Article 30(1)(c) of Directive 95/46/EC. 1 OJ L 8, 12.1.2001, p. 1.
Justification
This recital has been clarified because it suggested that simply consulting the data protection authorities ensured compliance with data protection rules. In reality both the EDPS and the Article 29 Working Party raised in their opinions on this proposal a series of serious concerns.
Amendment 8 RECITAL 9 A (new)
	(9a) Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data applies to the processing of personal data in application of this Regulation. However, certain points should be clarified, in particular in respect of the responsibility for the processing of data, of safeguarding the rights of the data subjects and of the supervision on data protection.
Justification
It is essential to explicitly state that Directive 95/46 on data protection applies to all processing of personal data in application of this Regulation.
Amendment 9 RECITAL 11
(11) In order to facilitate the procedure of any subsequent application, it should be possible to copy biometric data from the first application within a period of 48 months in accordance with the retention period laid down in the VIS Regulation. Once this period of time has elapsed, the biometric identifiers should be captured again.	(11) In order to facilitate the procedure of any subsequent application, it should be possible to copy biometric data from the first application within a period of 59 months from the start of the retention period provided for in Article 23 of the VIS Regulation. Once this period of time has elapsed, the biometric identifiers should be captured again.
Justification
This amendment replaces Amendment 9 of the draft report.
The retention time in the VIS is five years, i.e. 60 months, so a 'reuse' period of 59 months ensures that the data on the applicant is still available. In addition, a longer period in which the biometric data can be reused increases the user-friendliness and reduces the workload of consulates. This is also consistent with the approach of Mr Lax in his report on the future Visa Code.
Amendment 10 RECITAL 14
(14) The Commission should present a report on the implementation of this Regulation two years after its entry into force, covering the implementation of the enrolment of biometric identifiers, the principle of the “first application” and the organisation of the reception and the processing of visa applications.	(14) The Commission should present a report on the implementation of this Regulation three years after the VIS is brought into operation and every four years thereafter, covering the implementation of the enrolment of biometric identifiers, the appropriateness of the ICAO standard chosen, compliance with data protection rules, experience with external service providers with specific reference to the collection of biometric data, the principle of the “first application” and the organisation of the reception and the processing of visa applications. The report should also include, on the basis of Article 17 (12), (13) and (14) and Article 50(4) of the VIS Regulation, the cases in which fingerprints could factually not be provided or were not required to be provided for legal reasons compared with the cases in which fingerprints are taken. The report should include information on cases in which a person who could factually not provide fingerprints was refused a visa. The report should be accompanied, where necessary, by appropriate proposals to amend this Regulation. The Commission should transmit the report to the European Parliament and the Council.
Justification
This amendment is a compromise between Am 35 of the rapporteur, Am 36 of Mrs. Roure and Am 40 of Mrs. Kaufmann.
Amendment 11 RECITAL 15
(15) The subsidiarity principle applies insofar as the proposal does not fall under the exclusive competence of the Community. This Regulation does not go beyond what is necessary in order to achieve the objectives pursued in accordance with the third paragraph of Article 5 of the Treaty.	(15) The objectives of this Regulation are the organisation of the receipt and processing of visa applications in respect of the insertion of biometric data in the VIS. Since these objectives cannot be sufficiently achieved by the Member States the Community may adopt measures in accordance with the principle of subsidiarity as set out in Article 5 of the Treaty. In accordance with the principle of proportionality, as set out in the third paragraph of that Article, this Regulation does not go beyond what is necessary in order to achieve those objectives.
Justification
Recitals 15 and 16 are brought into one single recital as is usual practice in the Commission’s proposals and the text made clearer.
Amendment 12 RECITAL 16
(16) In accordance with the principle of proportionality, it is necessary and appropriate for the achievement of the basic objective of introducing common standards and interoperable biometric identifiers to lay down rules for all Member States implementing the Schengen Convention. This Regulation does not go beyond what is necessary in order to achieve the objectives pursued in accordance with the third paragraph of Article 5 of the Treaty.	deleted
Justification
See justification for amendments to recital 15.
Amendment 13 RECITAL 16 A (new)
	(16a) This Regulation respects fundamental rights and observes the principles recognised in particular by the European Convention for the Protection of Human Rights and Fundamental Freedoms, by the Charter of Fundamental Rights of the European Union and by the United Nations Convention on the Rights of the Child.
Justification
This is a standard recital in EU legislation which has an impact on fundamental rights. The reference to the United Nations Convention on the Rights of the Child is of particular interest in the present context and therefore added to the standard recital.
Amendment 14 ARTICLE 1, POINT 1, POINT (A) Point II, point 1.2., point (b) (CCI)
"A Member State may also represent one or more other Member States solely for the reception of applications and the enrolment of biometric identifiers. The relevant provisions of 1.2 (c) and (e) shall apply. The reception and transmission of files and data to the represented consular post shall be carried out respecting the relevant data protection and security rules".	"A Member State may also represent one or more other Member States solely for the reception of applications and the enrolment of biometric identifiers. The relevant provisions of 1.2 (c) and (e) shall apply. Where it receives an application, the representing Member State shall create the application file in the VIS and insert the data referred to in Article 9 of the VIS Regulation. It shall then inform the consular post of the represented Member State of the application and the VIS entry through the VIS communication infrastructure as provided for in Article 16 of the VIS Regulation. The reception and transmission of files and data to the represented consular post shall be carried out respecting the relevant data protection and security rules".
Justification
This amendment replaces Amendment 15 of the draft report.
The underlying rationale of the idea to roll out the VIS in particular regions is that all consulates of the Member States start using the VIS at the same time. This implies that all consulates have access to the VIS. It seems, therefore, logical that the representing Member State introduces, on behalf of the represented Member State, the basic visa data directly into the VIS. This is the best guarantee for ensuring data security and data protection, in particular as regards the transmission of biometric data. The numbering of VIS articles has been adapted to those in the final version of the Regulation.
Amendment 15 ARTICLE 1, POINT 1 A (new) Point III, point -1 (new) (CCI)
	(1a) In Point III, point -1 shall be added: "Conduct of staff involved in visa applications Member States shall ensure that applicants are received courteously by all staff involved in visa applications. All staff shall, in the performance of their duties, fully respect the human dignity and integrity of the applicant. Any measures taken shall be proportionate to the objectives pursued. While performing their tasks, staff shall not discriminate against persons on grounds of sex, racial or ethnic origin, religion or belief, disability, age or sexual orientation."
Justification
Am 16 of the rapporteur was slightly modified so that it also applies to staff of the external service providers.
Amendment 16 ARTICLE 1, POINT 2 Point III, point 1.1 (CCI)
(2) In Point III, point 1 is replaced by the following:	(2) In Point III, point 1 is replaced by the following:
1.1 Visa application forms-number of application forms	1.1 Visa application forms-number of application forms
Aliens shall also be required to fill in the uniform visa form. Applications for a uniform visa must be made using the harmonised form a specimen of which is given in Annex 16.	Applicants shall also be required to fill in the uniform visa form. Applications for a uniform visa must be made using the harmonised form a specimen of which is given in Annex 16.
At least one copy of the application form must be filled in so that it may be used during consultation with the central authorities. The Contracting Parties may, insofar as national administrative procedures so require, request several copies of the application.	At least one copy of the application form must be filled in so that it may be used during consultation with the central authorities. The Contracting Parties may, insofar as national administrative procedures so require, request several copies of the application.
Justification
This amendment replaces Amendment 17 of the draft report.
The word 'aliens' should be replaced by the word 'applicants' throughout the text, since this is the word used and defined in the VIS Regulation.
Amendment 17 ARTICLE 1, POINT 2 Point III, point 1.2, point (a) (CCI)
a) Member States shall collect biometric identifiers comprising the facial image and ten fingerprints from the applicant in accordance with the safeguards laid down in the European Convention for the Protection of Human Rights and Fundamental Freedoms and in the United Nations Convention on the Rights of the Child.	a) Member States shall collect biometric identifiers comprising the facial image and ten fingerprints from the applicant respecting the rights laid down in the European Convention for the Protection of Human Rights and Fundamental Freedoms, in the Charter of Fundamental Rights of the European Union and in the United Nations Convention on the Rights of the Child.
At the moment of submission of his/her first visa application each applicant shall be required to appear in person. At that time the following biometric identifiers shall be collected:	At the moment of submission of his/her first visa application each applicant not subject to any of the exceptions referred to in point (b) shall be required to appear in person. At that time the following biometric identifiers shall be collected:
– a photograph, scanned or taken at the time of application and	– a photograph, scanned or taken at the time of application and
– ten fingerprints taken flat and digitally captured.	– ten fingerprints taken flat and digitally captured.
For any subsequent application the biometric identifiers shall be copied from the first application, providing the last entry is not older than 48 months. After this period a subsequent application is to be considered as a “first application”.	For any subsequent application, within 59 months from the start of the retention period provided for in Article 23 of the VIS Regulation, the biometric identifiers shall be copied from the first application. After this period a subsequent application is to be considered as a “first application”.
The technical requirements for the photograph and the fingerprints shall be in accordance with the international standards as set out in ICAO document 9303 part 1 (passports) 6th edition.	The technical requirements for the photograph and the fingerprints shall be in accordance with the international standards as set out in ICAO document 9303 part 1 (passports) 6th edition.
The biometric identifiers shall be taken by qualified and duly authorised staff of the diplomatic mission or consular post or, under their supervision, of the external service provider referred to in point 1.B.	The biometric identifiers shall be taken by qualified and duly authorised staff of the diplomatic mission or consular post or, under their supervision and responsibility, of the external service provider referred to in point 1.B.
The data shall be entered in the Visa Information System (VIS) only by duly authorised consular staff according to Articles 4(1), Article 5 and Article 6(5) and (6) of the VIS regulation.	The data shall be entered in the Visa Information System (VIS) only by duly authorised consular staff referred to in Article 4(1), in accordance with Article 5 of the VIS regulation.
	Member States shall ensure that full use is made of all search criteria under Article 13 of the VIS Regulation in order to avoid false rejections and identifications.
	The collection of biometric identifiers, including their transmission from the service provider to the responsible consular post, shall be supervised in accordance with Articles 41 and 43 of the VIS Regulation and Article 28 of Directive 1995/46.
Justification
This amendment replaces Amendment 18 of the draft report.
Although neither the European Convention for the Protection of Human Rights and Fundamental Freedoms nor the United Nations Convention on the Rights of the Child lay down safeguards for the collection of biometrics, they include important human rights which should be respected in the context of this proposal. A reference to the Charter of Fundamental Rights has also been added.
It should be made explicit that not every single applicant needs to appear in person at a consulate but that exceptions are foreseen.
The reference to "the last entry" is misleading and therefore the text has been clarified. For the extension of the period regarding the frequency of collection of biometric data, see the justification to the amendment on recital 11.
The taking of biometrics by external service providers should meet various conditions and an important one is that the final responsibility lies with the consular missions or diplomatic posts.
Article 5 of the VIS Regulation as the general article dealing with the procedures for entering data on the application is sufficient and therefore the references to the other articles should be deleted.
It is important as a fallback procedure to make clear that visa authorities should use all search keys foreseen in Article 13 of the VIS regulation.
To ensure consistency with the specific rules on data protection as laid down in the VIS Regulation a cross-reference to them seems necessary (see opinion of the Article 29 Working Party, p. 9). The numbering of VIS articles has been adapted to those in the final version of the Regulation
Amendment 18 ARTICLE 1, POINT 2 Point III, point 1.2, point (b) (CCI)
b) Exceptions The following applicants shall be exempt from the requirement to give fingerprints:	b) Exceptions The following applicants shall be exempt from the requirement to give fingerprints:
– Children under the age of 6;	– Children under the age of 12;
– Persons where fingerprinting is physically impossible. If, however, fingerprinting of less than ten fingers is possible, the respective number of fingerprints shall be taken.	– Persons where fingerprinting is physically impossible. If, however, fingerprinting of less than ten fingers is possible, the respective number of fingerprints shall be taken. Member States shall ensure that appropriate procedures guaranteeing the dignity of the person concerned are in place in the event of there being difficulties in enrolling. They shall also ensure that the decision as to whether fingerprinting is impossible is always taken by the duly authorised staff of the diplomatic mission or consular post of the Member State(s). Furthermore, should the impossibility be temporary, the applicant shall be required to give fingerprints at the following application. Consular staff shall be entitled to ask for further clarification of the reasons for the temporary impossibility.
	The fact that fingerprinting is physically impossible shall not influence the grant or refusal of a visa.
A Member State may provide for exceptions from the requirement of collecting biometric identifiers for holders of diplomatic passports, service/official passports and special passports.	A Member State may provide for exceptions from the requirement of collecting biometric identifiers for holders of diplomatic passports, service/official passports and special passports.
In each of these cases an entry “not applicable” shall be introduced in the VIS.	In each of these cases an entry “not applicable” shall be introduced in the VIS.
	Without prejudice to the provisions of Point III.4, for persons under the age of 12, scanned photographs shall be used which do not require them to appear in person.
	The exemption from the requirement to give fingerprints for children and the elderly, and in particular the age range for the taking of fingerprints, shall be reviewed three years after the start of operation of the VIS. To this end the Commission shall present a report which shall in particular cover the experience of the VIS with regard to the taking and use of fingerprints from children aged 12 and over and a detailed technical assessment of the reliability of taking and using the fingerprints of children under the age of 12 for identification and verification purposes in a large-scale database such as the VIS. The report shall incorporate an extended impact assessment of lower and higher age limits for requiring fingerprints, including social, ergonomic and financial aspects. The report shall make a similar assessment as regards the taking of fingerprints from the elderly. Should the report show significant problems with taking fingerprints of persons over a certain age, the Commission shall make a proposal to impose an upper age limit. The report shall be accompanied, where necessary, by suitable proposals to amend this Regulation.
Justification
This amendment combines Am 41 of the rapporteur, Am 42 of Mrs. Roure and Am 40 of Mrs. Kaufmann.
Amendment 19 ARTICLE 1, POINT 3 Point VII, point 1 A, paragraph 2 (CCI)
For each location Member States shall either equip their consular office with the required material for capturing/collecting biometric identifiers or without prejudice to the above mentioned options of representation, decide to cooperate with one or more other Member States. Any cooperation shall take the form of co-location or the establishment of a Common Application Centre or co-operation with external service providers.	For each location Member States shall either equip their consular office with the required material for capturing/collecting biometric identifiers or without prejudice to the above mentioned options of representation, decide to cooperate with one or more other Member States. Any cooperation shall take the form of co-location or the establishment of a Common Application Centre or, where these are inappropriate, co-operation with external service providers.
Justification
Given that the issuing of visas including the taking of biometrics must remain essentially a public task, outsourcing should only be used as a last resort. It replaces amendment 20.
Amendment 20 ARTICLE 1, POINT 3 Point VII, point 1 A, paragraph 2, point (a) (CCI)
a) Where “co-location” is chosen, staff from the diplomatic posts and consular missions of one or more Member States process the applications (including biometric identifiers) addressed to them at the diplomatic post and consular mission of another Member State and share the equipment of that Member State. The Member States concerned shall agree on the duration and conditions for the termination of the co-location as well as the part of the administrative fee to be received by the Member State whose diplomatic post or consular mission is being used.	a) Where “co-location” is chosen, staff from the diplomatic posts and consular missions of one or more Member States process the applications (including biometric identifiers) addressed to them at the diplomatic post and consular mission of another Member State and share the equipment of that Member State. The Member States concerned shall agree on the duration and conditions for the termination of the co-location as well as the part of the administrative   fee to be received by the Member State whose diplomatic post or consular mission is being used. Applicants shall be directed to the Member State responsible for the processing of the visa application.
Justification
For co-location as well as Common Application Centres, third-country nationals should be directed to the 'correct' consulate officials.
Amendment 21 ARTICLE 1, POINT 3 Point VII, point 1 A, paragraph 2, point (b) (CCI)
b) Where “Common Application Centres”: are established, staff of diplomatic posts and consular missions of two or more Member States are pooled in one building in order to receive the visa applications (including biometric identifiers) addressed to them. Applicants shall be directed to the Member State responsible for the processing of the visa application. Member States shall agree on the duration and conditions for the termination of this co-operation as well as the cost sharing among the participating Member States. One Member State shall be responsible for contracts in relation to logistics and diplomatic relations with the host country.	b) Where “Common Application Centres” are established, staff of diplomatic posts and consular missions of two or more Member States are pooled in the building of one Member State enjoying diplomatic or consular protection under international law or in a European Commission building recognised by the host State as inviolable in order to receive the visa applications (including biometric identifiers) addressed to them. Applicants shall be directed to the Member State responsible for the processing of the visa application. Member States shall agree on the duration and conditions for the termination of this co-operation as well as the cost sharing among the participating Member States. One Member State shall be responsible for contracts in relation to logistics and diplomatic relations with the host country.
Justification
Given in particular the risks for data security and data protection linked to the taking of biometrics, several amendments have been tabled to ensure that any activity linked to the issuing of visas takes place in a building enjoying diplomatic or consular protection. This is the case both for Common Application Centres and external service providers. This was also strongly recommended by both the EDPS (see p. 7 of his opinion) and by the Art. 29 Working Party (see p. 10 of their opinion). It is important that these are Member States' buildings or delegations of the Commission, in order to ensure that Directive 95/46 and Regulation 45/2001 are applicable and that any material is protected, e.g. from seizure.
Amendment 22 ARTICLE 1, POINT 3 Point VII, point 1 B (CCI)
Where for reasons relating to the local situation of the consular post it is not appropriate to equip the consular office for capturing/collecting biometric identifiers or to organise co-location or a Common Application Centre. a Member State or several Member States jointly may co-operate with an external service provider for the reception of visa applications (including biometric identifiers). In such a case, the Member State(s) concerned shall remain liable for compliance with data protection rules for the processing of visa applications.	If, due to particular circumstances or reasons relating to the local situation of the consular post, it is not appropriate to equip the consular office for capturing/collecting biometric identifiers or to organise co-location or a Common Application Centre a Member State or several Member States jointly may co-operate with an external service provider for the reception of visa applications (including biometric identifiers). In such a case, the Member State(s) concerned shall remain responsible for the processing of the data and therefore liable for any breaches of contract and in particular for compliance with data protection rules for the processing of visa applications. Those Member State(s) shall ensure that an external service provider under Point VII, point 1.B.1b undertakes its activities on the premises of a Member State which enjoy diplomatic or consular protection under international law or on Commission premises recognised by the host state as inviolable and that qualified and duly authorised staff of the diplomatic mission or consular post of the Member State(s) are present to closely supervise the activities of the external service providers.
Justification
This amendment replaces Amendment 23 of the draft report.
The rapporteur proposes that, in the case of outsourcing, consular officials are present to supervise the service provider, as is strongly recommended by the Article 29 Working Party (p. 10 of their opinion). Their presence safeguards the public nature of the visa issuing process. Given the fact that outsourcing already considerably reduces the workload for consulates this obligation should not be seen as an additional burden for Member States. Furthermore, it has been clarified that in the case of outsourcing, the final responsibility for the processing of data and for any breaches of the contract lies with Member States.
Amendment 23 ARTICLE 1, POINT 3 Point VII, point 1.B.1 point (b) (CCI)
b) the external service provider provides general information on the requirements for applying for a visa, collects applications, supporting documents and biometric data from visa applicants and collects the handling fee (as provided for by Part VII, point 4 and Annex 12) and transmits completed files and data to the diplomatic mission or consular post of the Member State competent for the processing of the application.	b) the external service provider provides general information on the requirements for applying for a visa, collects applications, supporting documents and biometric data from visa applicants and collects the handling fee (as provided for by Part VII, point 4 and Annex 12), transmits completed files and data to the diplomatic mission or consular post of the Member State competent for the processing of the application and returns the passport to the applicant or to a legal representative at the end of the procedure.
Justification
This amendment replaces Amendment 24 of the draft report.
Amendment 24 ARTICLE 1, POINT 3 Point VII, point 1.B.2 (CCI)
1.B.2 - Obligations of Member States	1.B.2 - Obligations of Member States
The Member State(s) concerned shall select an external service provider who is able to ensure all the technical and organisational security measures and appropriate technical and organizational measures requested by the Member State(s) to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access, in particular where the processing involves the transmission of data over a network as well as the reception and transmission of files and data to the consular post, and against all other unlawful forms of processing.	In compliance with Directive 95/46/EC, the Member State(s) concerned shall select an external service provider which is able to ensure a high quality of service and all the technical and organisational security measures necessary to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access, in particular where the processing involves the transmission of data over a network as well as the reception and transmission of files and data to the consular post, and against all other unlawful forms of processing.
When selecting external service providers, Member States’ diplomatic missions or consular posts shall scrutinise the solvency and reliability of the company (including necessary licences, commercial registration, company statutes, bank contracts and shall ensure there is no conflict of interests.	When selecting external service providers, Member States’ diplomatic missions or consular posts shall scrutinise the solvency and reliability of the company (including necessary licences, commercial registration, company statutes, bank contracts) and shall ensure there is no conflict of interests.
	The diplomatic missions or consular posts of the Member States shall ensure that the company selected offers relevant professional expertise in information assurance and data security. Member States should follow best procurement practices in contracting external visa support services.
External service providers shall not have access to the Visa Information System (VIS) for any purpose. Access to the VIS shall be reserved exclusively to duly authorised staff of diplomatic missions or consular posts.	External service providers shall not have access to the Visa Information System (VIS) for any purpose. Access to the VIS shall be reserved exclusively to duly authorised staff of diplomatic missions or consular posts solely for the purposes laid down in the VIS Regulation.
The Member State(s) concerned shall conclude a contract with the external service provider in accordance with Article 17 of Directive 95/46. Before concluding such a contract, the diplomatic mission or consular post of the Member State concerned shall within local consular cooperation inform the diplomatic missions and consular posts of other Member States and the Commission delegation why the contract is necessary.	The Member State(s) concerned shall conclude a written contract with the external service provider in accordance with Article 17 of Directive 95/46. Before concluding such a contract, the diplomatic mission or consular post of the Member State concerned shall justify, with reasons in accordance with Point VII, point 1.B, the need for the contract with the diplomatic missions and consular posts of other Member States and the Commission delegation within local consular cooperation.
In addition to the obligations set out in Article 17 of Directive 95/46, the contract shall also contain provisions which:	In addition to the obligations set out in Article 17 of Directive 95/46, the contract shall also contain provisions which:
a) define the exact responsibilities of the service provider;	a) define the exact responsibilities of the service provider;
b) require the service provider to act under the instructions of the responsible Member States and to process the data only for the purposes of processing of personal data of visa applications on behalf of the responsible Member States in compliance with Directive 95/46;	b) require the service provider to act under the instructions of the responsible Member States and to process the data only for the purposes of processing of personal data of visa applications on behalf of the responsible Member States in compliance with Directive 95/46;
c) require the service provider to provide the applicants with the information required under Regulation ……. [draft VIS regulation];	c) require the service provider to provide the applicants with the information required under Article 37 of the draft Regulation of the European Parliament and of the Council concerning the Visa Information System (VIS) and the exchange of data between Member States on short-stay visas;
	ca) require the service provider to ensure that its staff are appropriately trained and respects the rules laid down in Point III, point -1;
	cb) require the service provider to adopt appropriate anti-corruption measures;
	cc) require the service provider to report to the responsible Member State without delay any security breaches or any other problems;
	cd) require the service provider to record any complaints or notifications from applicants on data misuse or unauthorised access. The external service provider shall inform the responsible Member State's diplomatic mission or consular post without delay and coordinate with them in order to find a solution. Complaints should be handled in such a way so as to ensure that explanatory responses are given to visa applicants promptly;
d) provide for access by consular staff to the premises of the service provider at all times;	d) provide for access by consular staff to the premises of the service provider at all times;
e) require the service provider to observe rules of confidentiality (including the protection of the data collected in relation to visa applications;	e) require the service provider and its staff to observe rules of confidentiality which shall also apply once the staff have left the employ of the external service provider or after the suspension or termination of the contract;
	ea) ensure data protection compliance, including reporting obligations, external audits, regular spot checks by, inter alia, national data protection authorities and that mechanisms are in place for the apportionment of the liability of a contractor in the event of a breach of the regulations on privacy, including the obligation to compensate individuals where they have suffered damage resulting from an act or omission of the service provider;
	eb) require the service provider to transmit without delay the completed file to the diplomatic mission or consular post of the Member State responsible for the processing of the application and not to copy, store, or otherwise retain any data collected after the transmission;
	ec) require the service provider to prevent any unauthorised reading, copying, modification or deletion of visa data during the transmission from the service provider to the diplomatic mission or consular post of the Member State responsible for the processing of the application, in particular by means of appropriate encryption techniques;.
f) contain a suspension and termination clause.	f) contain a suspension and termination clause;
	fa) contain a revision clause with a view to ensuring that contracts reflect best current practices;
	fb) lay down rules on the conduct of the staff responsible for handling visa applications and for collecting biometric data with maximum respect for human dignity. Any measure taken when carrying out those duties must be proportionate to the aims of that measure. In processing the application, staff shall avoid any discrimination among persons on grounds of sex, racial or ethnic origin, religion or belief, disability, age or sexual orientation.
	A model contract shall be established within local consular cooperation.
	Member States shall ensure that there is the least possible service disruption for visa applicants in the event of the external service provider suddenly ceasing to provide the services required under the contract.
The Member State(s) concerned shall monitor implementation of the contract, including:	The Member State(s) concerned shall cooperate closely with the external service provider and shall closely monitor the implementation of the contract, including:
a) the general information provided by the service provider to visa applicants;	a) the general information provided by the service provider to visa applicants;
b) the technical and organisational security measures and appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing as well as the reception and transmission of files and data to the consular post;	b) the technical and organisational security measures and appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing as well as the reception and transmission of files and data to the diplomatic mission or consular post;
c) the capturing of biometric identifiers;	c) the capturing and transmission of biometric identifiers;
d) the measures taken to ensure compliance with data protection provisions.	d) the measures taken to ensure compliance with data protection and data security provisions as well as measures against corruption.
The total amount of fees charged by the external service provider for processing the visa application shall not exceed the fee set out in annex 12.	The fee paid by the applicant shall not exceed the fee set out in annex 12 irrespective of whether Member States cooperate with external service providers.
	Member States shall ensure that a procedure is in place allowing for the identification of the external service provider handling any visa application.
The consular staff of the Member State(s) concerned shall give training to the service provider, corresponding to the knowledge needed to offer appropriate service and sufficient information to visa applicants.	The consular staff of the Member State(s) concerned shall give training to the service provider, corresponding to the knowledge needed to offer appropriate service and sufficient information to visa applicants.
Justification
This amendment takes over the amendment 47 of the rapporteur with the addition of the reference to Directive 95/46/EC, rules on conduct of staff of the external service providers and more specific provisions on the fee.
Amendment 25 ARTICLE 1, POINT 3 Point VII, point 1.B.5 (CCI)
1.B.5 - Information	1.B.5 - Information
Precise information on the means of obtaining an appointment and submitting a visa application shall be displayed by Member States’ diplomatic missions and consular posts for the general public.	Member States and their diplomatic missions or consular posts shall provide the general public with all relevant information in relation to a visa application :
	(a) the criteria, conditions and procedures for applying for a visa;
	(b) the means of obtaining an appointment, if applicable;
	(c) where the application should be submitted (competent diplomatic mission or consular post, common application centre or external service provider).
	This information to the general public shall also be available through a common Schengen visa internet site.
	The latter shall be established in order to further support the application of the common visa policy and the handling of the visa procedure.
Justification
This amendment replaces Amendment 26 of the draft report.
This is copied from Article 41(1) of the Visa Code proposal which is much better than the present text. Since the present text will probably enter into force before the new Visa Code enters into force, it is important to incorporate in the present text those provisions judged indispensable for the functioning of the VIS. The idea of establishing a common Schengen visa internet site, www.schengenvisa.eu has been brought forward by Henrik Lax in his draft report on Visa Code and the present rapporteur fully supports it. Since the present text will probably enter into force before the new Visa Code enters into force, it is important to incorporate this provision here.
Amendment 26 ARTICLE 1, POINT 3 Point VII, point 1.B.6 (new) (CCI)
	1.B.6 - Information Campaign
	Shortly before the VIS is brought into operation in a third country, the diplomatic missions or consular posts of Member States together with the delegation of the Commission shall launch a campaign informing the general public about the objectives pursued, the data stored in and the authorities having access to the VIS, and the rights of visa applicants. Such campaigns shall be conducted regularly.
Justification
Given the important changes the establishment of the VIS will bring to the current visa procedure and the implications for the visa applicant, it is important that an information campaign is made to inform the general public about the new system in place.
Amendment 27 ARTICLE 1, POINT 3 Point VII, point 1.D, paragraph 1 (CCI)
Member States shall inform the Commission of how they intend to organise the reception and processing of visa applications in each consular location. The Commission will ensure appropriate publication.	Member States shall inform the Commission of how they intend to organise the reception and processing of visa applications in each consular location. The Commission will ensure appropriate publication on the common Schengen visa internet site.
Justification
This amendment replaces Amendment 28 of the draft report. See the justification to the amendment on recital 5.
Amendment 28 ARTICLE 1, POINT 3 Point VII, point 1.E (new) (CCI)
	1.E General responsibilities
	1.E.1 Documents
	Any document, data or biometric identifier received by, or on behalf of, a Member State in the course of a visa application shall be considered a 'consular document' under the Vienna Convention on Consular Relations and shall be treated in an appropriate manner.
	1.E.2 Training
	Before being authorised to take biometric identifiers, the staff of the diplomatic mission or consular point shall receive appropriate training so as to ensure smooth and professional enrolment.
	1.E.3 Liability
	Any person who, or Member State which, has suffered damage as a result of an unlawful processing operation or any act in breach of this Regulation shall be entitled to receive compensation from the Member State which is responsible for the damage suffered. That Member State shall be exempted from its liability, in whole or in part, if it proves that it is not responsible for the event giving rise to the damage.
	Claims for compensation against a Member State for the damage referred to in the previous subparagraph shall be governed by the provisions of national law of the defendant Member State.
	1.E.4 Penalties
	Member States shall take the necessary measures to ensure that any breach of this Regulation, in particular any misuse of data submitted for a visa application is punishable by penalties, including administrative and/or criminal penalties in accordance with national law, that are effective, proportionate and dissuasive.
Justification
This amendment replaces Amendment 29 of the draft report.
A new part is added with general responsibilities for Member States which seem indispensable for the functioning of the VIS. A provision on the status of documents, data and biometric identifiers is important in order to ensure that they will benefit from consular protection. A provision on training is necessary, given the specific expertise the enrolment of biometrics requires. Rules on liability and penalties are necessary in view of potential damage resulting from acts violating this Regulation. The wording has been clarified to bring it into conformity with the wording in the VIS Regulation.
Amendment 29 ARTICLE 2
The Commission shall present a report to the European Parliament and to the Council on the implementation of the present regulation two years after its entry into force.	The Commission shall present, three years after the VIS is brought into operation and every four years thereafter, a report to the European Parliament and to the Council on the implementation of this Regulation, including the implementation of the enrolment of biometric identifiers, the appropriateness of the ICAO standard chosen, compliance with data protection rules, experience with external service providers with specific reference to the collection of biometric data, the principle of the “first application” and the organisation of the reception and the processing of visa applications. The report shall also include, on the basis of Article 17 (12), (13) and (14) and of Article 50(4) of the VIS Regulation, the cases in which fingerprints could factually not be provided or were not required to be provided for legal reasons compared with the number of cases in which fingerprints are taken. The report shall include information on cases in which a person who could factually not provide fingerprints was refused a visa. The report shall be accompanied, where necessary, by appropriate proposals to amend this Regulation.
Justification
This compromise amendment combines Am 56 of the rapporteur, Am 55 of Mrs. Kaufmann and Am 36 of Mrs. Roure.

EXPLANATORY STATEMENT

I. Introduction

The present proposal is the 4th element of the VIS package. In modifying the existing Common Consular Instructions[1] it provides, firstly, for the obligation to give biometrics to be stored in the VIS and the standards for doing so. Secondly, it includes provisions on the organisation of the reception of visa applications.

Although a complete revision of the visa rules is foreseen with the Visa Code[2] the Commission has made this specific proposal separately. The underlying rationale of this approach is that the adoption of the Visa Code is likely to take longer than the present proposal of which the adoption could allow the VIS to start operating.[3] The rapporteur stresses the importance of ensuring coherence between the two proposals.

An introduction into the subject areas covered by the present proposal was given by the rapporteur in two simultaneous working documents.[4] Those documents identified the politically sensitive questions and were the basis for several discussions.

For the preparation of this draft report the rapporteur also took into consideration the very helpful opinions presented by the European Data Protection Supervisor[5] and the Article 29 Working Party.[6]

II. Biometrics

II.1 Fingerprints

The rapporteur proposes to initially exempt persons below the age of 14 and over 79 from the obligation to provide fingerprints, with a review of these age limits after three years following a detailed study.

The choice of these age limits have to be essentially a policy choice at this stage rather than one based on technical guidance, for the simple reason that objective, independent advice is lacking. There was no impact assessment accompanying the proposal from the Commission, which considering its promises and commitments on better regulation is deeply regrettable and pretty shocking. The Commission seems just to have put forward a proposal largely reflecting discussions which took place with the Member States in the Council. In addition, there exists no large-scale experience of fingerprinting children under 14 or elderly persons.

Thus in the absence of credible technical guidance the rapporteur believes that it is wise in the initial stage to adopt age limits which we are sure will be workable, thereby avoiding unnecessary risks of turning the VIS project into a big experiment. Since the only currently comparable large-scale applications of fingerprints are Eurodac (minimum age 14 years) and US-Visit (14 to 79 years) those age limits should also be used for an initial period for the VIS.

But even if there was proven technology to fingerprint children of a very low age one should think twice and ask about how appropriate, necessary and proportionate that would be. Such a full analysis cannot be done here, although the rapporteur believes that at least the following points would deserve further reflection.

Firstly, it has to be considered whether the taking of fingerprints of children below the age of 14 is necessary to achieve the objectives of the VIS as laid down in Article 1a of the agreed text. For the first objective, facilitating the visa application procedure, fingerprints of young children are not necessary. On the contrary, this would complicate the application for a visa through the child having to come to the consulate to provide their fingerprints. Since the fingerprints of children are subject to change, we could see the absurd situation where fingerprints of children would have to be taken for example every two years while those of the parents were taken every four or five years.

For the second VIS objective, the prevention of visa shopping, younger age limits are also unnecessary since usually young children travel with their parents with whose application files their own are linked according to Article 5(4) of the VIS Regulation.

For the third objective, the facilitation of the fight against fraud, it is generally considered that biometrics could make visas more difficult to forge. There is, however, no information available whether there is a problem of forged visas of children.

In case of the fourth objective - the facilitation of border control - biometrics would allow a check at the border as to whether the person present is the same person to whom the visa was issued. Though it is not an explicit VIS objective, this could in theory be relevant to the fight against child trafficking through a check on whether the child at the border it is the same child as the one at the consulate with the parents. But the question of whether the 'family' presenting itself at the consulate is indeed a family is outside the realm of the CCI and the VIS. There is indeed a risk that reliance on VIS certainty would actually mean a reduction in the likelihood of border questioning over whether a group constitutes a family.

It is also important to recall that the VIS Regulation provides for a transitional period of three years after the start of VIS operations during which Member States do not have to check fingerprints at the border (Art. 16(1a)). The rapporteur considers it disproportionate to require fingerprints from young children while they are not systematically checked at the border. She believes that that this three year period should be used for an extended study on age limits for fingerprints so that at the end of the period any decision to change age limits could be made on a better-informed basis.

For the fifth VIS objective, to assist in the identification of undocumented persons, fingerprints of young children are equally unnecessary since they are not of adequate quality to use for identification as the Commission acknowledges.[7]

For the sixth objective, facilitating the application of the Dublin II Regulation[8], taking fingerprints of children below 14 seems in contradiction with the minimum age in the Eurodac Regulation and the present text could not change that limit.[9]

Finally, it is also doubtful whether the fingerprints of children below 14 would contribute to the prevention of threats to internal security. While it is imaginable in very rare cases that children are involved in terrorist acts or other serious crimes there are doubts as to whether this would justify taking fingerprints of so many children.

The rapporteur believes that an upper age limit of 79 as in US-Visit is equally important. Persons over 79 are very unlikely to be an immigration or terrorism risk. It seems disproportionate to burden them with the obligation to travel to a consulate and possibly queue several times outside. Without the obligation to provide fingerprints they could use traditional methods like a travel agency. In addition, the accuracy of fingerprints decrease as people grow older. This means that they might encounter unjustified problems at the consulate or at the border. It is also much more difficult for old people to give fingerprints if they are hesitant or do not understand the technology. The rapporteur would not want the EU to give the image to the outside world of failing to respect older people.

II.2 Photographs

The Commission does not propose any age exemption for photographs and the rapporteur agrees with this. The Commission leaves open the question of whether scanned photographs are used or photographs taken at the consulate. The rapporteur is of the opinion that for persons exempted from fingerprinting, as a rule scanned photographs should be used to avoid them having to come to the consulate just for the taking of a photograph.

II.3 Frequency of collection

The Commission proposes to require the applicant to appear in person for enrolment for the first application and to copy that data for any subsequent application within a period of 48 months. The rapporteur proposes to extend this period to 59 months which still guarantees that the data is available in the VIS in conformity with its retention period of 5 years. This prolongation of the period does not affect the security of the visa process and increases its user-friendliness. The rapporteur also proposes an amendment clarifying that after 59 months new biometric data must be taken, since the Commission proposal seemed to imply that if a person regularly applies for a visa (within the period of 48 months) the same biometric data could be used for a lifetime. Lastly, the rapporteur would like to point out that the choice of 14 as the age limit for fingerprints is linked to the frequency of collection. If the age limit was lowered, than the fingerprints of children would have to be taken more often since they constantly change.

III. Reception of visa applications

III.1 Outsourcing

The rapporteur agrees with the general concept of outsourcing in so far as it improves the service for visa applicants and as long as it takes place under conditions which ensure the integrity of the visa issuing process. These essential conditions are that outsourcing is indeed only used as a last resort that the service provider operates in a building under diplomatic protection, that consular officials are present to closely supervise the staff of the service provider and that the contractual clauses providing for the oversight of the contractor are reinforced.

III.2 Common Application Centres (CACs)

As in the cases of outsourcing the rapporteur is of the opinion that CACs should only be established in a building enjoying diplomatic protection.

• [1]  Consolidated version in OJ C 326 of 22.12.2005, p.1 - 149
• [2]  COM(2006)403; Report Lax
• [3]  Technically it will be inserted in the visa code once this is agreed like was the case for the stamping of documents (Reg. 2133/2004) which was introduced in the Schengen Borders Code (Reg. 562/2006).
• [4]  PE 386.565v01-00, 386.717v01-00 presented in LIBE on 10.4. and 8.5.2007.
• [5]  Opinion of 27.10.2006, OJ C 321 of 29.12.2006, p. 38
• [6]  Opinion 3/2007 of 1.3.2007 (WP 134)
• [7]  "The fingerprints of children aged 6-12 years are useful only for a one-to-one comparison." (p.9 of the proposal)
• [8]  Reg. 343/2003; see Art. 1a(f) of the VIS Reg.
• [9]  Briefing Paper "Biometrics and Visa Applications" by Steve Peers, p.5

PROCEDURE

Title	Common consular instructions: biometric identifiers and visa applications
References	COM(2006)0269 - C6-0166/2006 - 2006/0088(COD)
Date submitted to Parliament	31.5.2006
Committee responsible        Date announced in plenary	LIBE 15.6.2006
Rapporteur(s)        Date appointed	Sarah Ludford 20.6.2006
Discussed in committee	19.6.2006		27.11.2006		11.4.2007		17.7.2007
	12.9.2007		20.11.2007
Date adopted	20.11.2007
Result of final vote	+: –: 0:	31 2 5
Members present for the final vote	Philip Bradbourn, Kathalijne Maria Buitenweg, Giuseppe Castiglione, Giusto Catania, Carlos Coelho, Elly de Groen-Kouwenhoven, Esther De Lange, Panayiotis Demetriou, Bárbara Dührkop Dührkop, Armando França, Roland Gewalt, Jeanine Hennis-Plasschaert, Lívia Járóka, Ewa Klamt, Magda Kósáné Kovács, Wolfgang Kreissl-Dörfler, Roselyne Lefrançois, Sarah Ludford, Dan Mihalache, Javier Moreno Sánchez, Bogusław Rogalski, Martine Roure, Inger Segelström, Károly Ferenc Szabó, Søren Bo Søndergaard, Vladimir Urutchev, Manfred Weber, Tatjana Ždanoka
Substitute(s) present for the final vote	Edit Bauer, Simon Busuttil, Gérard Deprez, Sophia in ‘t Veld, Ona Juknevičienė, Sylvia-Yvonne Kaufmann, Mary Lou McDonald, Marianne Mikko, Hubert Pirker
Substitute(s) under Rule 178(2) present for the final vote	Louis Grech