Skip to content
DRAFT REPORT (COM(2021)0784 – C90455/2021 – 2021/0410(COD))

On the proposal for a regulation of the European Parliament and of the Council on automated data exchange for police cooperation (“Prüm II”), amending Council Decisions 2008/615/JHA and 2008/616/JHA and Regulations (EU) 2018/1726, 2019/817 and 2019/818 of the European Parliament and of the Council

LIBE-PR-736469

Committee on Civil Liberties, Justice and Home Affairs · Rapporteur: Paulo Rangel

Official HTML ↗ PDF DOCX
✦ In shortFull text
✦ In short · AI summary of this text, generated 26 Sept 2026

Written by a language model from the full text only; every figure comes from the text. The paragraph links open the paragraph a statement rests on — check the text itself before relying on it.

This is the rapporteur's draft report on the proposed Prüm II regulation on automated data exchange for police cooperation. It sets out Parliament's amendments to the Commission proposal. The amendments widen the purpose to searching for missing persons and identifying unidentified human remains, and add facial images and police records to the data categories exchanged. They require searches to be proportionate and necessary, manual confirmation of matches, human decisions on releasing core data, and deadlines of 24 or 72 hours for returning core data. They create a router and EPRIS, allow Europol to search Member States' databases with third-country-sourced data, and set data protection, logging and reporting rules.

Committee position. The rapporteur proposes that Parliament adopt its first reading position with amendments to the Commission proposal, widening the purpose to missing persons and unidentified human remains, adding facial images and police records, strengthening data protection and human oversight, and creating a router and EPRIS.

Key points

  1. The regulation's purpose is to step up cross-border police cooperation and to allow searches for missing persons and identification of unidentified human remains.
  2. It applies to national databases for DNA profiles, dactyloscopic data, facial images, police records and certain vehicle registration data.
  3. Member States must open national DNA databases and allow national contact points of other Member States and Europol to conduct automated searches of DNA profiles.
  4. Searches must be conducted only in individual cases, where proportionate and necessary for preventing, detecting or investigating a criminal offence, and in compliance with national law.
  5. Matches of DNA, dactyloscopic data and facial images must be manually confirmed by the requesting Member State.
  6. Member States must ensure availability of dactyloscopic reference data and facial images of suspects and convicted persons, without additional nominal data allowing direct identification.
  7. Participation in automated exchange of police records is voluntary; participating Member States must ensure national police records indexes with biographical data of suspects and convicted persons.
  8. A router is established for querying, retrieving and scoring biometric data, and EPRIS for searching national police records indexes.
  9. Upon confirmed match, the requested Member State must return core data via the router within 24 hours, or within 72 hours where judicial authorisation is required.
  10. Release of core data must not be automated but subject to a human decision.
  11. Europol may search Member States' databases via the router with third-country-sourced biometric data, and Member States may access such data held by Europol.
  12. Processing of personal data is permitted solely for the purposes for which it was supplied, with other purposes requiring prior authorisation; logs must be erased two years after creation.

Who is affected

  • Member States' competent law enforcement authorities, which gain access to other Member States' databases and must meet search, quality and logging requirements.
  • Europol, which may search Member States' databases and must keep logs and notify CERT-EU of cyber incidents.
  • eu-LISA, which develops and manages the router and must report on its development.
  • Data subjects, whose personal data is processed and who may contest accuracy, triggering a flag on the data.

Figures and deadlines

  • 24 hours: deadline for returning core data via the router after a confirmed match.
  • 72 hours: deadline for returning core data where judicial authorisation is required under national law.
  • Two years: period after which logs of queries must be erased.
  • 48 hours: deadline for correcting or deleting data received from a requested Member State after notification that it was incorrect or unlawfully transmitted.
  • 24 hours: deadline for Europol and eu-LISA to notify CERT-EU of significant cyber threats, vulnerabilities and incidents.
  • One year: period after which Member States and Europol shall start using the router, following the date set by the Commission.
  • One year at most: possible postponement of the date from which Member States and Europol must start using the router.
  • Two years: period after the start of operations of the router and EPRIS before the Commission produces an overall evaluation of Prüm II.

Legal basis: Article 294(2) and Articles 16(2) and 87(2), point (a), and Article 88(2) of the Treaty on the Functioning of the European Union.