The European Parliament and the Council have established the legal framework that will facilitate the exchange of information on past convictions of third-country nationals (TCNs). The framework consists of the following legal acts:

• Regulation (EU) 2019/816 establishing a centralised system for the identification of Member States holding conviction information on third-country nationals and stateless persons (ECRIS-TCN) to supplement the European Criminal Records Information System and amending Regulation (EU) 2018/1726, published in the Official Journal L 135, 22.5.2019, p. 1;
• Directive (EU) 2019/884 amending Council Framework Decision 2009/315/JHA as regards the exchange of information on third-country nationals and as regards the European Criminal Records Information System (ECRIS), and replacing Council Decision 2009/316/JHA, published in the Official Journal L 157, 7.6.2019, p. 143.

The new legislation responds to the problem that the current legal framework on the European Criminal Records Information Exchange System (ECRIS), which was put in place in 2012, does not sufficiently address the particularities of requests concerning third-country nationals. Since conviction information on TCNs are currently not stored in the single repository of ECRIS, Member States are obliged to send “blanket requests” to all other Member States in order to determine whether and in which Member State a particular TCN was convicted. According to the Commission, this administrative burden deters Member States from requesting information on non-EU citizens via the network. For background information on the legislative proposal launched by the Commission in 2017, see eucrim 3/2017, p. 120.

Regulation 2019/816 now establishes a centralised system at the Union level containing the personal data of convicted third-country nationals (“ECRIS-TCN”). ECRIS-TCN will allow the central authority of a Member State to promptly and efficiently find out in which other Member States criminal records information on a third-country national is stored so that the existing ECRIS framework can be used to request the criminal records information from those Member States in accordance with Framework Decision 2009/315/JHA.

ECRIS-TCN works on a “hit/no hit” basis, i.e., the system consists of the identity data (alphanumeric and biometric data) of all TCNs convicted in the Member States. A search mechanism allows Member States to search the index online. A “hit” identifies the Member State(s) that have convicted a particular TCN. The identified Member State(s) can then be requested to provide full criminal records information through the established ECRIS.

The main features of the ECRIS-TCN Regulation are:

• Personal data related to citizens of the Union who also hold the nationality of a third country and who were subject to a conviction will be included into ECRIS-TCN. The conditions for the inclusion of fingerprint data of Union citizens is different than those for persons who have only the nationality of a non-EU country;
• ECRIS-TCN allows for the processing of fingerprint data and facial images for the purpose of identification;
• The Regulation provides for minimum rules according to which fingerprint data must be collected and entered into the system;
• In a first phase, facial images may be used only to confirm the identity of a third-country national who has been identified as a result of an alphanumeric search or a search using fingerprint data. After technical readiness, facial images can also be used for automated biometric matching.
• The use of ECRIS-TCN is not only limited to getting criminal record information for the purpose of criminal proceedings against the person concerned, but also the following purposes (if provided for under and in accordance with national law) are covered by the Regulation:
  • Checking a person’s own criminal record on his/her request;
  • Security clearance;
  • Obtaining a licence or permit;
  • Employment vetting;
  • Vetting for voluntary activities involving direct and regular contacts with children or vulnerable persons;
  • Visa, acquisition of citizenship and migration procedures, including asylum procedures;
  • Checks related to public contracts and public examinations;
  • Other purposes decided by the Member States (which must be notified to the Commission and published in the Official Journal).
• Eurojust, Europol, and the EPPO are allowed direct access to ECRIS-TCN in order to fulfill their tasks and to identify those Member States holding information on previous convictions of third-country nationals. If there is a “hit” indicating the Member States holding criminal records information on a third-country national, Eurojust, Europol, and the EPPO may use their respective contacts to the national authorities of those Member States to request the criminal records information (in the manner provided for in their respective founding legislative acts).
• Eurojust will additionally function as a central hub for information requests, addressed by third countries and international organisations, as to which Member States, if any, hold criminal records information on a third-country national.
• Retention period: Each data record will be stored in the central system for as long as the data related to the convictions of the person concerned are stored in the criminal records.
• ECRIS-TCN records can be made for convictions both after and prior to the start date for data entry;
• The Regulation establishes strict rules on access to ECRIS-TCN and the necessary safeguards, including the responsibility of Member States when collecting and using the data. It also specifies how individuals may exercise their rights to compensation, access, rectification, erasure, and redress, in particular the right to an effective remedy and the supervision of processing operations by independent public authorities.

The European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) has been mandated with the development and operation of ECRIS-TCN. After the technical and legal arrangements have been made, the Commission will set the date for the operational start of the system.

Directive 2019/884 effects the Regulation and introduces necessary modifications to the basic ECRIS act, i.e., Framework Decision 2009/315/JHA. The Directive obliges Member States to take necessary measures to ensure that convictions are accompanied by information on the nationality/nationalities of the convicted person if they have such information at their disposal. It also introduces procedures for replying to requests for information, ensures that a criminal records extract requested by a third-country national is supplemented by information from other Member States, and provides for the technical changes that are necessary to make the information exchange system work.

The Directive also incorporates into said Framework Decision the principles of Decision 2009/316/JHA which, to date, contains the regulatory framework for building and developing the computerised system for the exchange of information on convictions between Member States.

The establishment of the new, central EU database ECRIS-TCN also raised criticism. Some stakeholders, such as the Meijers Committee and Statewatch, voiced concern as to whether the inclusion of persons holding both EU and non-EU citizenship (dual nationals) is in line with the principle of non-discrimination. Another question was whether the inclusion is proportional, because a factual basis is lacking that Member State authorities really become aware of the person’s dual citizenship. The possibility to enter facial image data was also seen critically, since the actual ECRIS framework does not provide for this. Initially, MEPs took a critical stance on these issues but later gave up their opposition.