Eurodac

Council Regulation 2725/2000 of 11 December 2000 concerning the establishment of 'Eurodac' for the comparison of fingerprints for the effective application of the Dublin Convention, OJ L 316, 15.12.2000, p. 1.

The EDPS performed a first inspection of the EURODAC Central Unit in 2006, followed by a security audit in 2007. This resulted in a list of recommendations with regard to the security of the Central Unit. The European Commission's DG HOME committed to implement the recommendations in the context of the upgrade to EURODAC plus, which aimed at enhancing performance, quality and security.   

The scope of the second inspection was to verify implementation of the EDPS recommendations, and to assess the overall organisational and technical procedures with regard to the protection of personal data and security in EURODAC plus, in accordance with Regulation 45/2001 and the EURODAC Regulation.

The EDPS inspectors found that the overall level of data protection and security of the EURODAC Central Unit is high. Most of the EDPS recommendations made in the 2006-2007 inspection and security audit have been taken into account in EURODAC plus.  This being said, there are some elements which need further improvement in order to assure data protection and security of the overall system.

EDPS Inspection Report:

Executive summary:

Coordinated Inspection Report on advance deletion of data

Under certain circumstances, the fingerprints of persons registered in Eurodac have to be deleted before the normal end of the retention period. This is for example the case when the person acquires citizenship of a Member State. The Eurodac Supervision Coordination Group investigated how this obligation is implemented in the Member States. The report encourages those Member States that do not yet have procedures for advance deletion in force to adopt such procedures, provide better information to data subjects and to improve the keeping of statistics.

Recommendations on the use of DubliNet

On 24 June 2009, the Eurodac Supervision Coordination Group issued a report on their second coordinated inspection of the large-scale database that contains fingerprints of asylum seekers in order to assist asylum procedures in the European Union. The Supervision Group has investigated how the database has been used in practice over the last two years. Two main issues were scrutinised: the right of information of asylum seekers and the methods for assessing the age of young asylum seekers in view of their registration in the system. The report presents both the findings and the recommendations based on the replies to the questionnaire received from all the Member States. The Group hopes that the report will usefully contribute to the ongoing revision of the Eurodac and Dublin Regulations.

Executive summary

The national data protection authorities and EDPS have worked in cooperation during the last years to ensure the supervision of Eurodac. From 2005 on, the Eurodac Supervision Coordination Group has achieved considerable results. It developed both actual supervisory actions and where appropriate, procedural aspects while at the same time keeping abreast of new developments in this area and exchanging relevant information. The Activity Report 2005-2007 presents the work carried out by this Group. Finally, this report also addresses the prospects for future activities in a time of intensive change in the field of Eurodac.

Initially, the Eurodac Supervision Coordination Group dealt with the coordinated supervision of Eurodac in an informal manner, based on the Eurodac Regulation (mainly Article 20) and the experience in other bodies. The adoption of rules of procedure allows for a more structured approach.

The rules of procedure were adopted on 19 December 2007 and amended on 17 December 2008. You will find below the consolidated version.

On 9 November 2007, the EDPS delivered the report on the results of a security audit on the EURODAC system to the European Commission.

The report details the findings of an audit team, comprised of one representative from the EDPS, two representatives from BSI, the Federal Office for Information Security in Germany and one representative from DCSSI (Direction centrale de la sécurité des systèmes d'information) in France. The European Networks and Information Security Agency (ENISA) reviewed the quality standards of the report.

While the report is EU Restricted, a short summary is presented here.

On 17 July 2007, the Eurodac Supervision Coordination Group issued a report on their first coordinated inspection. The responsible data protection authorities have investigated how the large scale database that contains fingerprints of more than 250.000 asylum seekers and illegal immigrants, has been used over the last 2,5 years. Three main issues - 'special searches', ‘further use’ and ‘data quality’ - were scrutinised. The group concluded that overall, there is no abuse of the Eurodac system. However some aspects, such as information to the people concerned, need to be improved.