Select Committee on European Union Ninth Report

CHAPTER 4: Management of the system

79.  The current SIS is at present managed by France.[64] The Commission initially proposed that it should itself be responsible for management of the SIS II system.[65] However the idea of management by the Commission was unpopular with some Member States. Mr Sweet told us that the lack of trust in the Commission arose in part from the technical difficulties the Commission had had in delivering the programme, but also from "the extent to which those delays undermined Member States' confidence more generally in the Commission's ability to manage the system as a whole." (Q 36) It was therefore decided that a Management Authority should ultimately be responsible for the operational management of the Central SIS II. A Joint Declaration of the Commission, the Council and the European Parliament appended to the Regulation and Decision commits those institutions to having the Management Authority fully active within five years.

80.  During this five-year transitional period, responsibility for the management lies with the Commission, but it may delegate that task to national
public-sector bodies in two different countries.[66] Under the terms of the legislation, this delegation must "not adversely affect any control mechanism under Community law, whether of the Court of Justice, the Court of Auditors or the European Data Protection Supervisor".[67] In fact it appears that, as part of the overall agreement on the SIS II legislation, the Commission has already agreed to delegate management of SIS II during the transitional period to France and Austria, which are responsible respectively for the main site in Strasbourg and the back-up site in Sankt Johann im Pongau.

81.  One particular problem about the transitional period is that, despite the assertions in the legislation concerning the accountability mechanisms of EC law, the legislation establishing the EDPS limits his jurisdiction to data processing carried out by the EC institutions.[68] There is no provision permitting the EDPS to supervise data protection in Member States to which the Commission has delegated its powers. This means that the EDPS cannot take decisions concerning the processing of SIS II data in the Member States to which management has been delegated, or refer disputes to the Court of Justice.[69] Mr Thompson from DCA told us: "… we are content with the arrangements that the EDPS cannot bring proceedings under the Third Pillar and, indeed, the EDPS itself has never had powers where it could actually initiate proceedings against Member Sates." The reason for his lack of concern was that, in his view, proceedings were much more likely to be initiated at Member State level where national supervisory authorities (in this country, the Information Commissioner) could take action. (Q 117) We are not persuaded that this is a satisfactory alternative; this in our view is one more reason why the Management Authority should take over as soon as possible.

82.  We were told about five possible options concerning the future Management Authority. The Authority could be operated by the Commission, by Frontex (the EU's border control agency), by Europol, by one Member State on behalf of all of them, or by a new body to be established. Mr Faull told as that there would be "a major impact assessment on the long-term management of SIS II" which would also encompass "the other large-scale IT systems that have been created in the justice, freedom and security area." (Q 415)

83.  The Commission, despite its initial proposal that it should manage SIS II, and despite its current role managing Eurodac (the EU system for comparing the fingerprints of asylum-seekers), does not regard the management of large-scale information systems as one of its core functions. (Q 415) We agree that an essentially operational task like the management of information systems is not easily reconciled with the Commission's duties under Article 211 of the EC Treaty,[70] and is likely to be better performed by a separate agency. The question remains whether the task should be taken on by one of the EU's existing agencies, or by a dedicated agency. Professor Kees Groenendijk, giving evidence on behalf of the Meijers Committee, was suspicious that the underlying rationale for creating a new agency might be to put it out of reach of the Community "rules of remedies, liabilities, and the general rules on transparency …" (Q 82) Mrs Laura Yli Vakkuri who, when she gave evidence to us during the Finnish Presidency, was Chair of the Schengen Acquis Working Party, said that the preference of the Presidency would be for an independent agency. (Q 494)

84.  Management by an existing agency might avoid the likely delays and costs of creating an entirely new agency. However, it is unlikely that such delays and costs would be significantly reduced by assigning the management of SIS II to either of the two obvious candidates, Frontex or Europol. Frontex does not even have access to SIS data, nor will it have access to SIS II data under the governing legislation. Europol has only recently established its own information system, after extensive delays. Neither agency has sufficient relevant expertise in managing large-scale information systems. In the case of Europol there might be a conflict of interest, or at least a perception of one, between its role as a user of the service and as a service provider, particularly since it is supposed to have access only to limited categories of data.

85.  Furthermore, both agencies have specialised functions of their own: Frontex has the first pillar function of assisting Member States to enforce external border controls, while Europol has the third pillar role of assisting police investigations. Europol has no direct involvement in the judicial aspects of the SIS (transmitting extradition or EAW requests, and requesting witnesses and evidence for trial purposes). Mrs Yli-Vakkuri questioned whether it was even legally possible for a first pillar agency to process third pillar information, or conversely for a third pillar agency to process first pillar information. (Q 494)

86.  The planned Visa Information System (VIS), which will store information on all applications for short-term visas to visit the Schengen States, is likely to develop into a system even larger than SIS II. (Q 96) The intention is that a dedicated agency should be set up for the management of VIS. It appears that discussions have already taken place to link the VIS and the SIS II, which complicates decisions over the future management of such large-scale European databases. (QQ 403, 420, 511)

87.  Whatever is eventually decided, the legislation to establish the Authority must set out clear rules as regards the responsibility of the Commission, which is empowered to adopt many implementing rules governing the operation of SIS II, and the role of the Authority managing the system. It is also important to ensure that Member States' governments, parliaments and the public are able to scrutinize the management of SIS II effectively, and that the Authority is fully accountable for its activities. This would be even more important if, as suggested, the Authority also has responsibility for the Visa Information System, along with responsibility for other information systems or related functions, and if the EU develops the principle of "interoperable" information systems.

88.  The Government should press for the establishment as soon as possible of a dedicated Management Authority for the Central SIS II. The legislation setting it up must provide for:

  • the Authority to have the required technical expertise in overseeing and operating large-scale information systems;
  • the Authority to be required to publish full and clear statistics at regular intervals;[71]
  • the Authority to be subject to effective scrutiny, including by the Court of Auditors;
  • clear differentiation between the tasks which remain the responsibility of the Commission, and those delegated to the Authority;
  • clear lines of accountability.

89.  Questions also arise in relation to the accountability of the Authority before the courts. There may be differences depending on whether the Authority is carrying out duties under the first or the third pillar. It should be made clear to what extent Community and national courts will have jurisdiction in proceedings brought against the Authority in the first or third pillar, for example where a data subject alleges a breach of confidentiality.

90.  The Government should ensure that individuals affected by the actions of the Management Authority are not left without an effective recourse to justice.

64   See Article 92(4) of the Schengen Convention. Back

65   Article 12 of the proposed Regulation and proposed Decision, respectively COM(2005)236 and 238. Back

66   Article 15 of the Regulation and Decision. Back

67   Article 15(7) of the Regulation and Decision. Back

68   Regulation 45/2001 (OJ 2001 L 8/1). Back

69   See Articles 46 and 47 of Regulation 45/2001, ibid. Back

70   Article 211 requires the Commission to ensure that the provisions of the Treaty and the measures taken pursuant to it are applied; to formulate recommendations and deliver opinions; to have its own power of decision under the Treaty; and to exercise powers conferred on it by the Council. Back

71   We do not believe that the requirements of Article 50(3) of the Regulation and Article 66(3) of the Decision go far enough. We explain in paragraph 68 above what these statistics should include. Back

previous page contents next page

House of Lords home page Parliament home page House of Commons home page search page enquiries index

© Parliamentary copyright 2007