Directive (EU) 2019/884 of the European Parliament and of the Council of 17 April 2019 amending Council Framework Decision 2009/315/JHA, as regards the exchange of information on third-country nationals and as regards the European Criminal Records Information System (ECRIS), and replacing Council Decision 2009/316/JHA

This Framework Decision: (a) defines the conditions under which a convicting Member State shares information with other Member States on convictions; (b) defines obligations for the convicting Member State and for the Member State of the convicted person’s nationality (the “Member State of the person’s nationality”), and specifies the methods to be followed when replying to a request for information extracted from criminal records; (c) establishes a decentralised information technology system for the exchange of information on convictions based on the criminal records databases in each Member State, the European Criminal Records Information System (ECRIS).’;

1 In order to exchange information extracted from criminal records in accordance with this Framework Decision electronically, a decentralised information technology system based on the criminal records databases in each Member State, the European Criminal Records Information System (ECRIS), is established. It is composed of the following elements: (a) ECRIS reference implementation; (b) a common communication infrastructure between central authorities that provides an encrypted network. To ensure the confidentiality and integrity of criminal records information transmitted to other Member States, appropriate technical and organisational measures shall be used, taking into account the state of the art, the cost of implementation and the risks posed by the processing of information.

2 All criminal records data shall be stored solely in databases operated by the Member States.

3 The central authorities of the Member States shall not have direct access to the criminal records databases of other Member States.

4 The ECRIS reference implementation and databases storing, sending and receiving information extracted from criminal records shall operate under the responsibility of the Member State concerned. The European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) established by Regulation (EU) 2018/1726 of the European Parliament and of the Council shall support the Member States in accordance with its tasks as laid down in Regulation (EU) 2019/816 of the European Parliament and of the Council .

5 The common communication infrastructure shall be operated under the responsibility of the Commission. It shall fulfil the necessary security requirements and fully meet the needs of ECRIS.

6 eu-LISA shall provide, further develop and maintain the ECRIS reference implementation.

7 Each Member State shall bear its own costs arising from the implementation, administration, use and maintenance of its criminal records database and the installation and use of the ECRIS reference implementation. The Commission shall bear the costs arising from the implementation, administration, use, maintenance and future development of the common communication infrastructure.

8 The Member States which use their national ECRIS implementation software in accordance with paragraphs 4 to 8 of Article 4 of Regulation (EU) 2019/816 may continue to use their national ECRIS implementation software instead of the ECRIS reference implementation, provided that they fulfil all the conditions set out in those paragraphs.

1 The Commission shall lay down the following in implementing acts: (a) the standardised format referred to in Article 11(3), including as regards information on the offence giving rise to the conviction and information on the content of the conviction; (b) the rules concerning the technical implementation of ECRIS and the exchange of fingerprint data; (c) any other technical means of organising and facilitating exchanges of information on convictions between central authorities of Member States, including: (i) the means of facilitating the understanding and automatic translation of transmitted information; (ii) the means by which information may be exchanged electronically, particularly as regards the technical specifications to be used and, if need be, any applicable exchange procedures.

2 The implementing acts referred to in paragraph 1 of this Article shall be adopted in accordance with the examination procedure referred to in Article 12a(2).

1 The Commission shall be assisted by a committee. That committee shall be a committee within the meaning of Regulation (EU) No 182/2011.

2 Where reference is made to this paragraph, Article 5 of Regulation (EU) No 182/2011 shall apply. Where the committee delivers no opinion, the Commission shall not adopt the draft implementing act and the third subparagraph of Article 5(4) of Regulation (EU) No 182/2011 shall apply.’;

1 By 29 June 2023, the Commission shall submit a report on the application of this Framework Decision to the European Parliament and to the Council. The report shall assess the extent to which the Member States have taken the necessary measures to comply with this Framework Decision, including its technical implementation.

2 The report shall be accompanied, where appropriate, by relevant legislative proposals.

3 The Commission shall regularly publish a report concerning the exchange of information extracted from the criminal record through ECRIS and concerning the use of ECRIS-TCN based in particular on the statistics provided by eu-LISA and the Member States in accordance with Regulation (EU) 2019/816. The report shall be published for the first time one year after the report referred to in paragraph 1 is submitted.

4 The Commission report referred to in paragraph 3 shall cover in particular the level of exchange of information between Member States, including that relating to third-country nationals, as well as the purpose of requests and their respective number, including requests for purposes other than criminal proceedings, such as background checks and requests for information from the persons concerned on their own criminal record.’.

Decision 2009/316/JHA is replaced with regard to the Member States bound by this Directive, without prejudice to the obligations of those Member States with regard to the date for implementation of that Decision.

1 Member States shall bring into force the laws, regulations and administrative provisions necessary to comply with this Directive by 28 June 2022. They shall immediately communicate the text of those measures to the Commission. When Member States adopt those measures, they shall contain a reference to this Directive or be accompanied by such a reference on the occasion of their official publication. They shall also include a statement that references in existing laws, regulations and administrative provisions to the Decision replaced by this Directive shall be construed as references to this Directive. Member States shall determine how such reference is to be made and how that statement is to be formulated.

2 Member States shall communicate to the Commission the text of the main provisions of national law which they adopt in the field covered by this Directive.

3 Member States shall carry out the technical alterations referred to in Article 11(5) of Framework Decision 2009/315/JHA, as amended by this Directive, by 28 June 2022.

This Directive shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union. Article 2 shall apply from 28 June 2022.

This Directive is addressed to the Member States in accordance with the Treaties.