House of Lords - European Union

Select Committee on European Union Ninth Report

CHAPTER 2: background—the development of the schengen database

12. The 1990 Schengen Convention provides in Articles 92-119 for the establishment, operation and use of the SIS, and for protection of the data contained in it. Articles 94 to 100 divide the data entered in the SIS into a number of different categories of "alerts". The word "alert" is used in a technical sense, and is defined in relation to SIS II as "a set of data entered in SIS II allowing the competent authorities to identify a person with a view to taking specific action".[8] The categories of alert are:

(a) persons wanted for extradition to a Schengen State (Article 95);

(b) a list of non-EU citizens ("third-country nationals") who should in principle be denied entry to any of the Schengen States (Article 96);

(d) persons wanted as witnesses, or for the purposes of prosecution or the enforcement of sentences (Article 98);

(e) persons or vehicles to be placed under surveillance or subjected to specific checks (Article 99); and

(f) objects sought for the purpose of seizure or use in criminal proceedings (Article 100).

13. Each Schengen State decides which of its law enforcement and immigration control authorities are to have access to some or all categories of SIS alerts, and for which purposes. If a national authority finds that a particular individual or object is listed in the SIS, this is known as a "hit". The following are examples of the way the system works.

BOX 1

Examples of the Schengen Information System in action

A consulate of one of the Schengen States is considering an application for a short-term visa, which will be valid for visiting all of the Schengen States (this is known as a "Schengen visa"). The consequence of a hit is that in principle the visa application must be refused.[9]

A person in police custody is the subject of an extradition request or a European Arrest Warrant (EAW), which is listed in the SIS. A hit would usually result in the arrest of the fugitive and the subsequent transmission of further documentation relating to the extradition request or the EAW, so that the process of extraditing or surrendering the fugitive can get under way.

A police officer checks the SIS to see whether a vehicle with foreign licence plates is listed as a stolen vehicle in an alert in the SIS. The hit on the stolen vehicle would trigger bilateral contacts between the national authority which made the hit and the national authority which issued the alert.

14. The current SIS began operations in March 1995, when the Schengen Convention was first fully put into force for an initial group of seven Member States.[10] The Convention was later extended, and by March 2001 it applied fully to all of the first fifteen EU Member States, except the United Kingdom and Ireland.[11] The Convention also applied by that date to the associated States of Norway and Iceland.

15. In the meantime, the legal framework for the Schengen Convention and the measures building on it (known collectively as the "Schengen acquis") altered fundamentally on 1 May 1999, when the Treaty of Amsterdam came into force. This Treaty aimed to integrate the Schengen acquis into the EU's legal order. This meant that the existing Schengen acquis would henceforth be treated as if it were EU law, and that all future measures building on that acquis would be adopted according to EU decision-making procedures. These procedures differ according to the different legal bases in the Treaties which confer power upon the EU institutions.

16. Accordingly the Council was obliged to adopt a decision allocating all of the Schengen acquis in force as of 1 May 1999 to a legal basis in either the EC Treaty (which among other things deals with economic integration, including immigration law) or the EU Treaty (which deals with the EU's Common Foreign and Security Policy—the "second pillar"—and cooperation in criminal law and policing—the "third pillar"). The Council was able to agree on allocating the entire Schengen acquis to a legal base in the "first pillar" (the EC Treaty) or the "third pillar" (the policing and criminal law provisions of the EU Treaty), except for the provisions concerning the Schengen Information System.[12] The reason the Council was unable to agree on the allocation of the SIS provisions was that they applied simultaneously to data concerning immigration (which in principle should be subject to legal bases in the "first pillar" EC Treaty) and to data concerning policing and criminal law (which in principle should be subject to legal bases in the "third pillar" part of the EU Treaty).

17. As a result, by way of default, all SIS provisions are regarded as falling within the third pillar (policing and criminal law). However, the Treaty of Amsterdam requires that any new measures "building upon" the Schengen acquis which was in force back in May 1999 have to be adopted using the correct legal bases. So, despite the failure to agree on the "legal base" for the SIS provisions in the Schengen acquis, it is necessary to use the relevant EC Treaty "legal bases" for any new measure concerning SIS immigration data to be adopted after May 1999.[13]

The United Kingdom position

18. When the Schengen acquis was integrated into the legal framework of the EU by a Protocol to the Amsterdam Treaty,[14] the United Kingdom gained the possibility to request participation in all or part of that acquis, subject to approval by the unanimous consent of the Schengen states. To that end, the United Kingdom requested and gained approval in 2000 to participate in all of the Schengen acquis provisions concerning criminal law and policing (except for cross-border hot pursuit by police officers).[15] This also entailed participation in the SIS, as regards criminal law and policing information, but not the SIS immigration data, concerning the list of persons to be denied entry into the Schengen States. The Schengen provisions in which the United Kingdom had been given permission to participate were put into effect for this country from 1 January 2005.[16] The United Kingdom should have been ready to be linked to the SIS database by late 2004, but to date it has failed to connect to the system. Home Office officials told us that this proved impossible due to technical difficulties and "acts of God", such as a fire which destroyed some equipment. (Q 8)

19. The later application of Ireland to participate in the same provisions of the Schengen acquis as the United Kingdom (except for the provisions on cross-border police surveillance) was approved in 2002,[17] but has not yet been put into effect in any respect.

The need for SIS II

20. As we have said, initially the main purpose of a new version of the SIS was to accommodate the inclusion of the EU's new Member States. The creation of a new system was also seen as an opportunity to provide for additional technical features, in particular for the inclusion of biometric data (data directly concerning the physical characteristics of individuals, such as photographs, fingerprints, DNA profiles or retina scans).

21. In the event, neither the United Kingdom nor Ireland has sought to opt in to the measures concerning SIS II immigration data, but they will both be covered by the measures concerning policing and criminal law data, as well as concerning access by vehicle registration authorities to data on stolen vehicles (see further discussion of the new SIS II legislation in paragraphs below). We consider in chapter 7 whether the Government should attempt to obtain access to some of the SIS II immigration data, and to share United Kingdom immigration data with other Member States.

The timetable of SIS II

22. The initial intention was to implement SIS II in 2007, in parallel with the extension of the Schengen area to the EU's new Member States (the ten Member States joining in May 2004).[18] When, as far back as 2001, the Council entrusted the Commission with the development of SIS II, its mandate ran to 31 December 2006; five years was thought to be generous. But following the Commission's award of the tender for the SIS II project, a disappointed tenderer brought legal proceedings against the Commission. The Court of First Instance[19] suspended the award of the tender until its interim ruling, in which it strongly criticised the Commission's conduct in issuing the tender, but nevertheless allowed it to proceed. The case was subsequently settled.[20]

23. This was the main cause of delay, but there was no lack of other delaying factors. There was uncertainty regarding the sites for the development until agreement was reached that the main site should be in Strasbourg, with the back-up site in Sankt Johann im Pongau, in Austria. Problems arose with the air-conditioning which is an important feature of such a project. (Q 5) The implementation of the SIS II contract by the successful tenderer ran into difficulties; the Commission admitted that it did not sufficiently supervise the tenderer, due to a lack of qualified staff. (Q 392) And finally, in the Commission's own inimitable words, "the complexity of the project itself also had a negative impact on the planning"[21]—a fact which should come as no surprise to those familiar with the fate of similar projects in this country.

24. In July 2006 the Commission accordingly proposed that its mandate should be extended to 31 December 2007, and this was agreed. But barely two months later the Commission proposed an extension of its mandate by a further year, to 31 December 2008.[22] No further reasons were given for this either by the Commission or by the Home Office in their Explanatory Memorandum on the proposal. Nevertheless, this further extension was also agreed.[23]

25. The A8—the ten Member States which acceded in May 2004, less Cyprus and Malta—believe they are being treated as second class States from the point of view of free movement of persons. They had been led to believe that they would join the Schengen area by October 2007, and this date had been re-affirmed by the European Council in June 2006. They had been anxiously awaiting SIS II coming into operation, and were dismayed by these delays. Some of them had invested considerable resources to ensure that their internal record systems would be of a standard which would enable them to join. We heard an eloquent speech to this effect from the Chairman of the Constitutional Rights Committee of the Estonian Parliament. At a joint meeting in November 2006, the foreign ministers of the Visegrád countries[24] and the three Baltic States were still pressing for adherence to the original timetable.

26. In October 2006 Portugal put forward a proposal, which it called "SIS one4all", to allow the SIS to be adapted to include the A8, so enabling them to join Schengen by October 2007.[25] Some of those States were initially unenthusiastic, believing that they should not accept a halfway house; other States, and not just the A8, feared that this would further delay SIS II. The Commission believed that it would add nine months to the planning of SIS II. Nevertheless on 5 December 2006 the Justice and Home Affairs Council, after re-affirming that "the development of the SIS II remains the absolute priority", decided to implement SIS one4all for the A8, and invited the Commission to present yet another revised timetable for SIS II by February 2007.

27. Since the requirement to develop a new generation of the SIS was apparent many years ago, in the light of the planned enlargement of the EU, there was an opportunity for long-term strategic planning of the project, which could have avoided the delays and reduced the costs which have affected the SIS II project. This opportunity was missed. There are lessons to be learned by the EU as regards the planning and development of other large-scale multinational information systems.

The United Kingdom's timetable

28. As we have said,[26] the United Kingdom does not participate in the current SIS, nor has it any plans to do so. Home Office witnesses told us that their assessment in October 2005 was that SIS I connection for the United Kingdom would not have been achieved by the time SIS II would have been delivered for the rest of the Member States.[27] Ministers decided that efforts should be concentrated on delivering SIS II to a properly robust programme and timetable. The United Kingdom's "aspiration is to join SIS II in 2009. We think we will be ready … all Member States will be connected when the UK will join in 2009." (QQ 8, 11) But Superintendent Mike Flynn, the Director of the Joint Operational Authority of SIRENE UK,[28] was of the view that, once the central system of SIS II was in operation, "the new Member States, of which the United Kingdom will be one, will have a staggered integration into the system, and we would reasonably expect this to be about 2010". (Q 202)

29. The inevitable further delay entailed by SIS one4all might have been bad news for the law enforcement authorities of this country. As it is, unless there is further disastrous slippage in the timetable for SIS II, it will be operative by the time the United Kingdom can be connected. This does not explain why Ministers are content for the United Kingdom to be the last Member State to be connected to it, or for our law enforcement authorities to be the last to benefit from the scheme.

30. Ministers should put more resources into the development of the national connection to SIS II. Whenever the central system is ready, the United Kingdom should be ready and able to participate as early and as fully as possible.

31. It does not appear that the Government have considered that the United Kingdom might join SIS one4all. Since this was designed for those States which had plans to join SIS II in 2007, and since the United Kingdom had in any event no plans to join before 2009 at the earliest, no doubt the Government felt that SIS one4all was not relevant and need not affect its plans. At least, agreement has been reached that the United Kingdom need not contribute to its cost.[29]

The cost

32. The cost of developing SIS II is a charge on the budget of the EU. Since the Commission was charged with the task of developing SIS II at the end of 2001, a total of over €26 million has been committed to this project from the EU budget.[30] According to the Commission's proposed SIS II legislation, the EU budget will be charged a further €114 million between 2007 and 2012 to get SIS II up and running.[31] Of this the United Kingdom pays 18%: a full contribution, despite not having access to all the information on SIS II. (QQ 28-32)

33. The current Home Office estimate for the cost to the United Kingdom of implementing SIS II is £39 million. Additionally there is an annual cost of £500,000 to the Commission for its costs in running the system, and operational costs for running the system in the United Kingdom, the supporting technology and the people to manage it of the order of £3 to £4 million. (QQ 22-27)

Lack of transparency

34. The Commission did not conduct an impact assessment of the SIS II proposals, even though these have become standard for any significant EU legislative proposal. Furthermore, the Commission's legislative proposals for SIS II were accompanied by an explanatory memorandum that only briefly set out the background to the proposals, whereas the explanatory memoranda for proposed EC or EU legislation usually explain the proposed legislative text in detail.

35. In its written evidence, the Commission told us that "the underlying rationale and nature of the system [SIS II] will remain the same as the current SIS. An impact assessment and public consultation were, therefore, not necessary." For the Home Office, Jonathan Sweet repeated this, and did not suggest that there was anything inadequate about this procedure. (Q 33) However in oral evidence Jonathan Faull, the Director-General for Justice, Freedom and Security at the Commission, reassured us that an impact assessment would be carried out before new functions of considerable importance were implemented, such as the full use of biometric data and its use for searches. (Q 387)

36. The Commission had formally consulted several persons and bodies, among them Mr Peter Hustinx, the European Data Protection Supervisor (EDPS). However it seems to us that the Commission did not take his views seriously. In his formal Opinion on the proposals for the legislation, delivered in reply to the Commission's request, Mr Hustinx stated: "It is in many respects difficult to know what the intention behind the texts is; the absence of an explanatory memorandum is highly regrettable … Moreover, one can only regret there has been no impact assessment study. The fact that the first version of the system is already in place does not justify this, since there are considerable differences between both."[32]

37. Other witnesses have also regretted the lack of explanatory material. We share this view. In the light of the considerable cost and resource implications for all Member States (including the United Kingdom) resulting from the development of SIS II, an impact assessment was obviously desirable. The existence of the prior agreement of the Council on SIS II is no answer. As for the explanatory memorandum, the extensive changes which the Commission proposed to the current SIS merited a detailed explanation, as is usual with the great majority of EU legislative proposals.

38. A project of this importance and magnitude needs to be developed openly and publicly. It potentially affects not just EU citizens, but also hundreds of thousands of non-EU citizens who may wish to travel to or reside in the EU. Information must be readily available, not just to EU institutions and national experts, but to all those affected.

39. It is unacceptable for a project with such cost and resource implications to be developed without a prior full impact assessment, and a full legislative explanatory memorandum.

40. The Government should press for greater transparency in the future development of the project, including the award of contracts.

Legislation for SIS II

41. The legislation for the establishment of SIS II was contained in three measures proposed by the Commission in May 2005: a Regulation concerning SIS II immigration data; a Regulation concerning access by vehicle registration authorities to SIS II data on stolen vehicles; and a third pillar Decision concerning policing and criminal law data.[33] Three different measures were necessary because any measures 'building upon" the Schengen acquis following its integration into the EU's legal framework had to be based upon the correct legal bases in the EU and EC Treaties: EC immigration law powers (as regards the immigration data); EC transport law powers (as regards access to data on stolen vehicles); and EU policing and criminal law powers (as regard police and criminal law data).

42. The SIS II Regulation concerning immigration data will take effect as EC law, whereas at present the current SIS remains almost entirely a third pillar measure. This will entail the direct applicability of the Regulation in national legal systems, the Court of Justice's jurisdiction in the truncated form applicable to EC immigration and asylum law,[34] and the application of EC rules and principles in other areas (such as the use of the EC budget, the rules on accountability of EC bodies, and the application of EC data protection rules).

43. The two EC Regulations were both subject to the co-decision procedure with the European Parliament, as well as to qualified majority voting in the Council. After an agreement at first reading between the Council and the European Parliament, both Regulations were adopted on 20 December 2006, and entered into force on 17 January 2007.[35] The third pillar Decision, which was subject to consultation with the European Parliament and unanimous voting in the Council, has been agreed in principle but was not adopted at the JHA Council meeting on 15 February 2007 because Denmark and Sweden maintained their parliamentary scrutiny reserves.[36]

44. As compared to the current SIS, the new legislation provides for the inclusion of biometric data into SIS II, as mentioned above. The new legislation also provides for revised rules on data protection. Although all six of the current categories of alert have been retained, without any additional categories being added, there have been amendments to the detailed rules applicable to four categories (immigration alerts, extradition alerts, surveillance alerts and alerts on objects).

45. As for access to alerts and the power to input alerts, the existing rules are unchanged, except for an extension of access to alerts for the national members of Eurojust, the EU prosecutors' agency, which will have power to access alerts concerning extradition, missing persons, wanted persons and alerts on objects.[37] There are also revised provisions on the system of "flagging" alerts, which allows a requested State to prevent a requested action (such as the arrest of a person) from being carried out on its territory following a hit. (QQ 231-233) Furthermore, SIS II will provide for a link between different alerts; the current SIS does not provide for this.

46. The Commission's proposals would have gone further in several respects, in particular: requiring a greater level of harmonisation regarding the grounds for issuing an immigration alert; conferring power upon the Commission to manage SIS II; providing for more detailed rules on the authorities with power to access alerts and the circumstances in which they could access them; allowing wider possibilities for the transfer of SIS II data to third parties; and setting out longer periods for retaining data in SIS II as compared to the current SIS.[38]

47. During the negotiation of this proposal, in the first half of 2006 the Austrian Presidency sought to drop most of the changes to the existing Schengen Convention rules that had been proposed by the Commission. However, the Council had to modify this approach in order to take account of the joint decision-making power of the European Parliament, which wanted to retain many of the changes proposed by the Commission and insert further changes of its own. The Council agreed on the legislation in June 2006, but negotiations with the European Parliament continued under the Finnish Presidency before the texts could be agreed and adopted.

48. It proved difficult for parliaments and civil society to obtain any access to texts under discussion, or to follow the progress of negotiations between the Council and the European Parliament. JUSTICE pointed out the "notorious difficulty for non-governmental organisations … to obtain up-to-date information about the current state of Commission proposals for legal instruments, such as SIS II, under negotiation in the EU Council". (p 132) The situation is complicated because when the European Parliament and the Council seek to agree on legislation at the "first reading" of the co-decision process,[39] there is no formal or even informal arrangement governing the conduct of their negotiations. (QQ 76, 128, 383, 482)

49. The lack of transparency in Council proceedings, and in co-decision negotiations between the Council and the European Parliament, is an issue relevant to all areas of EU policy-making, and has been particularly noticeable in the negotiations on the SIS II legislation. The Government should press the EU institutions to ensure greater openness and transparency of their proceedings, and in particular to codify the procedures for co-decision negotiations. All drafts of legislation should as a general rule be published immediately.

50. The legislation does however require regular reports and evaluations of
SIS II, unlike the current SIS, where there is in practice no system of reporting to the public or evaluating its functioning. This is an improvement we welcome.

Issues concerning United Kingdom implementation

51. To date, there has been minimal public consultation or Parliamentary scrutiny concerning United Kingdom participation in the Schengen Information System. Given the direct and indirect costs of participation, (Q 22) and its potential significance for both civil liberties and the operational effectiveness of our law enforcement authorities, this is most regrettable. There will be no opportunity for such a debate when SIS II is implemented in the United Kingdom if, as the Government assert, participation in SIS II does not require any amendment of our domestic law. (Q 592)

52. To facilitate public debate on SIS II and to ensure effective Parliamentary scrutiny of United Kingdom participation in the project, the Government should undertake to publish regular reports on our preparation for SIS II, and on the planned and actual impact on the United Kingdom.

8 This definition is taken from Article 3(a) of the Regulation on the setting up of SIS II (OJ 2006 L 381/4), but is equally relevant to the original SIS. Back

9 See Article 15 of the Convention, read in conjunction with Article 5. Back

10 Belgium, France, Germany, Luxembourg, Netherlands, Portugal and Spain. Back

11 See paragraphs 18-19. Back

12 The decision allocating the acquis can be found in OJ 1999 L 176/1. Back

13 Modest amendments to the current SIS were given effect by an EC Regulation and an EU third pillar Decision adopted in 2004 and 2005, which among other things gave access to Europol and Eurojust. (OJ 2004 L 162/29, and 2005 L 68/44). Back

14 Protocol integrating the Schengen acquis into the framework of the European Union. Back

15 OJ 2000 L 131/43. Back

16 OJ 2004 L 395/70. Back