Skip to content
REPORT (COM(2021)0784(COR1) – C90455/2021 – 2021/0410(COD))

On the proposal for a regulation of the European Parliament and of the Council on automated data exchange for police cooperation (“Prüm II”), amending Council Decisions 2008/615/JHA and 2008/616/JHA and Regulations (EU) 2018/1726, 2019/817 and 2019/818 of the European Parliament and of the Council

A-9-2023-0200

Committee on Civil Liberties, Justice and Home Affairs · Rapporteur: Paulo Rangel

Official HTML ↗ PDF DOCX
✦ In shortFull textProcedure & committee votes
✦ In short · AI summary of this text, generated 26 Sept 2026

Written by a language model from the full text only; every figure comes from the text. The paragraph links open the paragraph a statement rests on — check the text itself before relying on it.

Parliament's amended version of the Commission proposal for a regulation on automated data exchange for police cooperation (Prüm II) sets conditions and procedures for automated searching of DNA profiles, dactyloscopic data, facial images, police records and certain vehicle registration data. It creates a router and the European Police Records Index System (EPRIS) to connect national databases, with Europol able to search Member States' databases and Member States able to search third-country data held by Europol. It requires human review of matches, sets deadlines for returning core data, and lays down data protection safeguards including impact assessments, logging, and coordinated supervision. It amends Regulations (EU) 2018/1726, 2019/817 and 2019/818 to give eu-LISA tasks for the router and to store router reports and statistics in the central repository.

Committee position. The Committee on Civil Liberties, Justice and Home Affairs proposes amendments to the Commission proposal, adding data protection safeguards, human review of matches, deadlines for returning core data, and rules on Europol access and supervision.

Key points

  1. The regulation establishes a framework for automated searching of DNA profiles, dactyloscopic data, facial images, police records and certain vehicle registration data, and rules for exchanging core data after a confirmed match.
  2. Member States must open national DNA databases and allow national contact points of other Member States and Europol automated access for investigating criminal offences.
  3. Searches must be proportionate, necessary and in individual cases; a human review by a forensic expert must confirm DNA and dactyloscopic matches.
  4. Automated searches of facial images are allowed only for preventing, detecting or investigating a serious criminal offence, with human review by two forensic experts; profiling is prohibited.
  5. Participation in exchanging police record indexes is voluntary; participating Member States must make their data available and searches are limited to serious criminal offences.
  6. A router and EPRIS are established to connect national databases; the router queries Member States' databases and Europol data simultaneously and ranks replies by score.
  7. Europol may search Member States' databases and Member States may search third-country-sourced data held by Europol, with follow-up under Regulation (EU) 2016/794.
  8. After a confirmed match, the requested Member State must return core data via the router within 24 hours, or within 72 hours where judicial authorisation is required.
  9. Member States must conduct a data protection impact assessment and consult the supervisory authority before connecting national databases to the router, EPRIS or Eucaris.
  10. Logs of queries must be kept, protected against unauthorised access and erased three years after creation; justifications for queries are used for fundamental rights and data protection monitoring.
  11. Supervisory authorities and the European Data Protection Supervisor must cooperate on coordinated supervision and send a joint report to Parliament, the Council, the Commission, Europol and eu-LISA every two years.
  12. The Commission must produce an overall evaluation of Prüm II two years after the start of operations of the router and EPRIS and every four years thereafter.

Who is affected

  • Member States' competent law enforcement authorities, which gain access to other Member States' databases and must meet data quality and logging duties.
  • Europol, which may search Member States' databases and make third-country-sourced data available, and must keep logs and notify CERT-EU of incidents.
  • eu-LISA, which develops and manages the router and must report annually on its development.
  • Data subjects, who must be informed about processing and whose data must be corrected or deleted if inaccurate.
  • Third countries and international organisations, which may receive personal data only under Chapter V of Directive (EU) 2016/680 and with the requested Member State's authorisation.

Figures and deadlines

  • 24 hours: deadline for the requested Member State to return core data via the router after a confirmed match.
  • 72 hours: deadline for returning core data where judicial authorisation is required under national law.
  • three years: period after which logs of queries must be erased.
  • 24 hours: deadline for correcting, updating or deleting data received from a requested Member State after notification.
  • 24 hours: deadline for Europol and eu-LISA to notify CERT-EU of significant cyber threats, vulnerabilities and incidents.
  • two years: period after the start of operations of the router and EPRIS for the Commission's overall evaluation, and every four years thereafter.
  • one year: period after the date determined for starting to use the router, after which Member States and Europol shall start using it.
  • at least three years: maximum period of custodial sentence for an offence to qualify as a serious criminal offence.

Legal basis: Article 294(2) and Articles 16(2) and 87(2), point (a), and Article 88(2) of the Treaty on the Functioning of the European Union.