- Home /
- News /
- 2005 /
- September /
- EU Data protection working party criticise proposals on VIS (Visa Information System)
EU Data protection working party criticise proposals on VIS (Visa Information System)
01 September 2005
The EU's Article 29 Data Protection Working Party has issued a critical report on the proposed Regulation on the Visa Information System (VIS). The report opens by saying:
"The project of setting up a central database and a system of exchange of information concerning short-stay visas raises important questions for fundamental rights and freedoms of individuals and in particular their right to privacy.
It will lead to a massive collection and processing of personal and biometric data, their storage in a centralised database and to large scale exchanges of information concerning a huge number of persons."
It notes that the VIS central database is intended to deal with 20 million visa applications a year resulting in 70 million set of fingerprint data within five year (an estimated 30% will be frequent visitors).
Fingerprinting for visas will be compulsory and:
"links will be established with other applications possibly submitted by the same individual and already recorded in the VIS as well as with the data of individuals travelling in a group and with people providing accommodation in the EU countries requiring the visas.."
The issue of the data being used for other purposes is of great concern:
"the use of the system for multiple purposes – is related to the objective of achieving “enhanced interoperability between European databases” and creating synergies between, namely, SIS II, VIS and Eurodac."
Legal basis
The legal basis of the proposal is questioned, in particular whether the obligation to provide data requires a specific, detailed legal instrument or whether the legal power to collect personal data, in compliance with Article 6 of the 1995 Directive, can be provided by an amendment to the Common Consular Instructions (issued to EU member states embassies abroad).
Proportionality and purpose
The question of "purpose(s) of the processing is paramount". In order to be lawful:
"personal data must be collected only for specified, explicit and legitimate purposes, may not be further processed in a way that is incompatible with those purposes, must be adequate, relevant and not excessive in relation to the purposes for which they are collected and further processed." (emphasis in original)
The Working Party is thus particularly concerned about what "would appear to refer to other purposes" (letters a-f in Article 1 para 2 of the VIS proposal). Specifically where:
"the reference to “threats to internal security” is concerned, this seems to be a broad, cross-sectoral purpose, which is already pursued by the many tools available for police cooperation - including the SIS – and must be referred to only in the light of the main purpose of the VIS - which is and must remain that of improving the common visa policy, and therefore may only be deployed insofar as it is compatible with the said policy.
and
“facilitate checks at external border and within the territory”; “assist in the identification and return of illegal immigrants”; “facilitate the application of Regulation (EC) No. 343/2003”; these purposes would not appear to be in line with the first requirement set forth in Article 8 of the ECHR, as they are not included in the measures that may be adopted by having regard to the legal basis underlying the proposal."
and this extends to:
“purpose of examination of applications”, Article 13;
“purposes of consultation between authorities”, Article 14;
“purposes of reporting and statistics”, Article 15; and
“purposes of identification”, Article 16 and 17).
The Working Party says that:
"This multiplicity of “purposes” should be reconsidered in order to meet specific requirements that should not be in contradiction with the essence of the purpose limitation principle."
and concludes that:
"In the light of Article 6 of the Directive, the “purposes” of the data processin