Council of the European Union Brussels, 30 November 2020 (OR. en) 9617/04 DCL 1 LIMITE SCH-EVAL 33 COMIX 344 DECLASSIFICATION of document: 9617/04 RESTREINT UE dated: 17 May 2004 new status: LIMITE Subject: Questionnaire – Questions to UK on data protection arrangements relating to the UK’s national implementation of the Schengen Information System. - Answers from the UK Delegations will find attached the declassified version of the above document. The text of this document is identical to the previous version. 9617/04 DCL 1 KAL SMART 2.C.S1 LIMITE EN RESTREINT UE COUNCIL OF Brussels, 17 May 2004 THE EUROPEAN UNION 9617/04 RESTREINT UE SCH-EVAL 33 COMIX 344 NOTE from : UK delegation to : Schengen Evaluation Working Party No. prev. doc. : 9227/04 SCH-EVAL 25 COMIX 308 + ADD 1 Subject : Questionnaire – Questions to UK on data protection arrangements relating to the UK’s national implementation of the Schengen Information System. - Answers from the UK The United Kingdom has asked the Schengen Evaluation Group to undertake an evaluation of the data protection arrangements which it has in place to support the introduction of the Schengen Information System to the UK. As the UK’s technical solution to the SIS has not yet been finalised, the questions relate only to data protection arrangements. Questions relating to the management and handling of the data will be answered in the context of the full SIS evaluation which will take place once the UK’s national solution has been fully implemented. 1. Provide the list of services with access to SIS data See Annex A and Annex B 9617/04 WvdR/kve 1 DG H RESTREINT UE EN RESTREINT UE 2. Has the list of authorities authorised to consult the SIS been amended recently? A provisional list has been adopted at the time of our original application, but this has now been amended. The final list is the one provided under question 1. 3. Describe the legislative and regulatory provisions adopted to set up the N.SIS; No legislation was needed to set up the UK N.SIS, except for the purpose of extending the Information Commissioner's right to inspect personal data recorded in the UK sections of the SIS (and also the EIS and the CIS) without a warrant. These provisions are set out in Section 81 of the Crime (International Co-operation) Act 2003. 4. Describe the legislative and regulatory provisions adopted to set up the SIRENE Bureau; Same answer as for previous question. 5. Is there in your country a national supervisory authority within the meaning of Article 114 of the Convention? If not, when is one to be set up? Yes, the Information Commissioner's Office (ICO) will act as a national supervisory authority within the meaning of Article 114. The Office is also responsible for overseeing compliance with the Data Protection Act 1998. 9617/04 WvdR/kve 2 DG H RESTREINT UE EN RESTREINT UE 6. Has the supervisory authority used its right of access to the national part of the SIS? Is access occasional or frequent? As the UK does not yet have the SIS in place, the answer to this question would be no. However, as an illustration, the Supervisory Authority, the Information Commissioner’s Office [I.C.O.] (who acts equally for SIS and Europol) has used its right of access to the national part of the Europol system twice in the last 5 years. This was as part of their on-going commitment to audit and inspection. They are currently in the pre-inspection stage for a third evaluation of Europol. As NCIS will host both Europol and SIS in the future, we would expect a similar level and frequency of inspection. The ICO envisages that there will be occasional, general inspections of the data, as well as any access that is needed to respond to specific requests from individuals for their data to be checked. 7. Can this right of access be used in situ? Would it be possible to have supervision organised in parallel (one person in the SIRENE Bureau and the other with the final user)? The ICO was offered a facility for direct access to the national section of SIS to enable it to perform its functions. It turned down the offer for security reasons. Access will be obtained via a suitable final user or at the SIRENE Bureau. It should be possible for checks to be organised in parallel where this is considered necessary. This could be provided either with NCIS, as an end user in its own right, or with any other end user. NCIS will cooperate with any such request made by the ICO. The ICO does not have a general power to inspect data processing but does have a specific power to inspect any personal data recorded in the SIS. This power is set out in Section 81 of the Crime (International Co-operation) Act 2003. As mentioned before, the ICO has had experience of inspecting the UK national unit for Europol. On those occasions, the inspectors have been allowed full access to the national part of the system. They have been given access to the records (although trained staff have navigated the Europol system on their behalf) both in London and The Hague, and been able to compare results. Europol staff have been questioned regarding their training and knowledge of Data Protection. 9617/04 WvdR/kve 3 DG H RESTREINT UE EN RESTREINT UE 8. In cases of subject access on the basis of Article 109 of the Schengen Convention, does the national supervisory authority also play a supervisory role or does it simply act as the authorised representative of the applicant? Under UK law individuals make their own subject access requests to the data controller. In the case of the SIS this is the National Criminal Intelligence Service (NCIS). The role of the ICO is, on receipt of a complaint from an individual, to make an assessment as to whether NCIS has met its legal obligations under UK law and the Schengen convention. If appropriate the ICO will then take enforcement action to bring about compliance e.g. an order to release information to the individual. Individuals can also enforce their rights through the courts. 9. Does the role of the national supervisory authority in such cases relate to the legality of the procedure or does it also relate to the validity of the grounds for the alert? The ICO will investigate whatever aspects of compliance the individual complains about. This may be any or all of the following; whether the individual has received a response from NCIS within the time limits set down by law whether the individual has been supplied with all the data to which he/she is entitled whether there are valid grounds for the alert whether the information forming the alert is accurate and up to date. 10. What arrangements will there be for co-operation between your national supervisory authority and other national supervisory authorities if it transpires that another Schengen country has recorded a person and your national SIRENE Bureau does not have the complete file? The ICO has well established arrangements for co-operation with other supervisory authorities in the Schengen area. These cover the general exchange of information on matters that are of common as well as on the investigation of individual cases where there is a cross border element. 9617/04 WvdR/kve 4 DG H RESTREINT UE EN RESTREINT UE 11. Will every tenth transmission of personal data be recorded for the purposes of supervising the admissibility of the query? As a matter of policy the UK records 100% of its queries for the purpose of ensuring the admissibility of such actions. One of the identified tasks of the Sirene Bureau is conducting an on- going sampling of such queries and checking their validity and admissibility with end users. The records will be available to the ICO for their inspection. 12. a) What rules will be applied for retaining data in the national system? b) What happens to the paper files relating to the SIS alert? c) Are they archived? Are they destroyed? After how long? a) Data (i.e. the Alert itself) held in the N.SIS will follow the retention rules outlined in Article 112 and 113, unless the national weeding rules for PNC records dictate a shorter period of retention. Records supporting the application of such alerts will be held locally by the initiating force/agency. The Supplementary data relating to the alert will be kept by the Sirene Bureau for a maximum of 7 years if it is data relating to a UK national/ UK crime. This follows standard practice for UK law enforcement. b) With the exception of a hard copy of the EAW it is anticipated that there will be no paper files kept in the Sirene bureau; an electronic case management system will support the storage of additional information where required for the designated retention period c) Where the Supplementary Information relates to a UK national or UK crime or where the UK has taken action on the alert the 7 year rule will apply. Otherwise this information will be deleted in a systematic manner by the case management system. It is anticipated this process will be completed within 7 days of Sirene Bureau being notified of the deletion of the alert. The hard copy of the EAW would be destroyed by shredding at this point. 9617/04 WvdR/kve 5 DG H RESTREINT UE EN RESTREINT UE 13. Will the authorities responsible for recording vehicle registrations have access to the SIS? At present the authorities responsible for recording vehicle registrations, the Driver and Vehicle Licensing Agency, will not have access to the SIS.