Prováděcí rozhodnutí Komise (EU) 2025/2281 ze dne 13. listopadu 2025, kterým se mění prováděcí rozhodnutí (EU) 2022/2470, pokud jde o technické specifikace pro kvalitu, rozlišení a zpracování zobrazení obličeje nezbytné pro technický vývoj a zavedení centralizovaného systému pro identifikaci členských států, jež mají informace o odsouzeních státních příslušníků třetích zemí a osob bez státní příslušnosti (ECRIS-TCN)

Identifier:: 32025D2281
Status:: effective
Text language:: en

THE EUROPEAN COMMISSION,

Article 2 Article 2 Entry into force

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2019/816 of the European Parliament and of the Council of 17 April 2019 establishing a centralised system for the identification of Member States holding conviction information on third-country nationals and stateless persons (ECRIS-TCN) to supplement the European Criminal Records Information System and amending Regulation (EU) 2018/1726OJ L 135, 22.5.2019, p. 85 , ELI: http://data.europa.eu/eli/reg/2019/816/oj. , and in particular Article 10(1) thereof,

OJ L 135, 22.5.2019, p. 85 , ELI: http://data.europa.eu/eli/reg/2019/816/oj.

(1) Regulation (EU) 2019/816 established the centralised system for the identification of Member States holding conviction information on third-country nationals and stateless persons (ECRIS-TCN). That system allows the central authority of a Member State or other competent authority to find out promptly and efficiently which Member States hold criminal records information on a third-country national.

(2) Commission Implementing Decision (EU) 2022/2470Commission Implementing Decision (EU) 2022/2470 of 14 December 2022 laying down measures necessary for the technical development and implementation of the centralised system for the identification of Member States holding conviction information on third-country nationals and stateless persons (ECRIS-TCN) (OJ L 322, 16.12.2022, p. 107 , ELI: http://data.europa.eu/eli/dec_impl/2022/2470/oj). lays down measures necessary for the technical development and implementation of ECRIS-TCN, including the technical specifications concerning alphanumeric and fingerprint data.

(3) The European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) established by Regulation (EU) 2018/1726 of the European Parliament and of the CouncilRegulation (EU) 2018/1726 of the European Parliament and of the Council of 14 November 2018 on the European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA), and amending Regulation (EC) No 1987/2006 and Council Decision 2007/533/JHA and repealing Regulation (EU) No 1077/2011 (OJ L 295, 21.11.2018, p. 99 , ELI: http://data.europa.eu/eli/reg/2018/1726/oj). is responsible for the development of ECRIS-TCN, including the development and implementation of the relevant technical specifications and testing, as well as for the operational management of the system.

(4) In order to ensure the interoperability of public services at Union level, the ECRIS-TCN architecture should conform to the European interoperability framework set out in Regulations (EU) 2019/817Regulation (EU) 2019/817 of the European Parliament and of the Council of 20 May 2019 on establishing a framework for interoperability between EU information systems in the field of borders and visa and amending Regulations (EC) No 767/2008, (EU) 2016/399, (EU) 2017/2226, (EU) 2018/1240, (EU) 2018/1726 and (EU) 2018/1861 of the European Parliament and of the Council and Council Decisions 2004/512/EC and 2008/633/JHA (OJ L 135, 22.5.2019, p. 27 , ELI: http://data.europa.eu/eli/reg/2019/817/oj). and (EU) 2019/818Regulation (EU) 2019/818 of the European Parliament and of the Council of 20 May 2019 on establishing a framework for interoperability between EU information systems in the field of police and judicial cooperation, asylum and migration and amending Regulations (EU) 2018/1726, (EU) 2018/1862 and (EU) 2019/816 (OJ L 135, 22.5.2019, p. 85 , ELI: http://data.europa.eu/eli/reg/2019/818/oj). of the European Parliament and of the Council. That framework includes a shared biometric matching service which, pursuant to Article 13(1), point (b), of Regulation (EU) 2019/818, stores facial images templates, including templates of facial images entered into ECRIS-TCN, which enables querying with biometric data across various Union information systems.

(5) To enable central authorities to enter facial images into ECRIS-TCN, it is necessary to lay down technical specifications for the quality, resolution and processing of the facial images.

(6) Until the entry into force of the delegated act provided for in Article 6(2) of Regulation (EU) 2019/816, facial images should not be used for the purpose of querying the system. Their use should be currently limited to confirming the identity of a third-country national who has been identified as a result of an alphanumeric search or a search using fingerprint data, in accordance with Article 6(1) of Regulation (EU) 2019/816, and to enabling detection of multiple identities across the interoperable IT systems in accordance with Article 13(1), point (b), and Article 27(2) of Regulation (EU) 2019/818.

(7) Data quality is a key element to obtain accuracy, which is one of the basic data protection principles laid down in Article 5(1), point (d), of Regulation (EU) 2016/679 of the European Parliament and of the CouncilRegulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1 , ELI: http://data.europa.eu/eli/reg/2016/679/oj). and Article 4(1), point (d), of Regulation (EU) 2018/1725 of the European Parliament and of the CouncilRegulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39 , ELI: http://data.europa.eu/eli/reg/2018/1725/oj). . The quality of the facial images stored impacts on the proper functioning of any automated matching processes derived from them, as well as on the visual inspection in the process of confirming an identity, in accordance with Article 6(1) of Regulation (EU) 2019/816. Therefore, the quality of the facial images in ECRIS-TCN should satisfy the data quality requirements set for the shared biometric matching service and the other systems feeding it to guarantee a reliable match.

(8) Facial images should be entered into ECRIS-TCN only where the national law of the convicting Member State allows the collection and storage of facial images of convicted persons pursuant to Article 5(3) of Regulation (EU) 2019/816.

(9) As Implementing Decision (EU) 2022/2470 focuses on the technical specifications concerning alphanumeric and fingerprint data, this Decision introduces the relevant technical specifications regarding facial images.

(10) The production of separate statistics on the number of records containing flags established in accordance with Article 5(1), point (c), of Regulation (EU) 2019/816, for the convictions of a terrorist offence and for any other criminal offence listed in the Annex to Regulation (EU) 2018/1240 of the European Parliament and of the CouncilRegulation (EU) 2018/1240 of the European Parliament and of the Council of 12 September 2018 establishing a European Travel Information and Authorisation System (ETIAS) and amending Regulations (EU) No 1077/2011, (EU) No 515/2014, (EU) 2016/399, (EU) 2016/1624 and (EU) 2017/2226 (OJ L 236, 19.9.2018, p. 1 , ELI: http://data.europa.eu/eli/reg/2018/1240/oj). proved to be technically impossible. Therefore, it should not be necessary any longer to produce such separate statistics.

(11) Implementing Decision (EU) 2022/2470 should therefore be amended accordingly.

(12) In accordance with Articles 1 and 2 of Protocol No 22 on the position of Denmark, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, Denmark did not take part in the adoption of Regulation (EU) 2019/816 and is not bound by it or subject to its application. Denmark is therefore not bound to implement this Decision.

(13) In accordance with Article 1 and 2 and Article 4a(1) of Protocol No 21 on the position of the United Kingdom and Ireland in respect to area of freedom, security and justice, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, and without prejudice to Article 4 of that Protocol, Ireland did not take part in the adoption of Regulation (EU) 2019/816 and is not bound by it or subject to its application. Ireland is therefore not bound to implement this Decision.

(14) The European Data Protection Supervisor has been consulted pursuant to Article 42(1) of Regulation (EU) 2018/1725 and delivered an opinion on 5 June 2025 .

(15) This Decision introduces binding requirements for trans-European digital public services within the meaning of Regulation (EU) 2024/903 of the European Parliament and of the CouncilRegulation (EU) 2024/903 of the European Parliament and of the Council of 13 March 2024 laying down measures for a high level of public sector interoperability across the Union (Interoperable Europe Act) (OJ L, 2024/903, 22.3.2024, ELI: http://data.europa.eu/eli/reg/2024/903/oj). . Accordingly, an interoperability assessment has been carried out and the resulting report has been published on the Interoperable Europe Portal.

(16) The measures provided for in this Decision are in accordance with the opinion of the Committee established by Article 38 of Regulation (EU) 2019/816,

When entering or modifying alphanumeric data, fingerprint data or facial images in ECRIS-TCN the central authority of the convicting Member State shall use a data quality verification mechanism or its equivalent in their national ECRIS implementation software referred to in Article 4(4) to (7) of Regulation (EU) 2019/816.

The data quality verification mechanism referred to in paragraph 1 shall be integrated into the ECRIS reference implementation, developed as a software application and established in the ECRIS-TCN central system.

eu-LISA shall be responsible for the development, maintenance and updating of the data quality verification mechanism, pursuant to Article 11(2) of Regulation (EU) 2019/816.

Where Member States do not make use of the data quality verification mechanism referred to in paragraph 1 and use instead its equivalent in their national ECRIS implementation software, they shall ensure that it guarantees the same alphanumeric data, fingerprints data and facial images quality verification as that data quality verification mechanism.

This Decision shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union .

Commission Implementing Decision (EU) 2022/2470 of 14 December 2022 laying down measures necessary for the technical development and implementation of the centralised system for the identification of Member States holding conviction information on third-country nationals and stateless persons (ECRIS-TCN) (OJ L 322, 16.12.2022, p. 107 , ELI: http://data.europa.eu/eli/dec_impl/2022/2470/oj).

Article 2a Article 2a Data quality verification mechanism 1.When entering or modifying alphanumeric data, fingerprint data or facial images in ECRIS-TCN the central authority of the convicting Member State shall use a data quality verification mechanism or its equivalent in their national ECRIS implementation software referred to in Article 4(4) to (7) of Regulation (EU) 2019/816. 2.The data quality verification mechanism referred to in paragraph 1 shall be integrated into the ECRIS reference implementation, developed as a software application and established in the ECRIS-TCN central system. 3.eu-LISA shall be responsible for the development, maintenance and updating of the data quality verification mechanism, pursuant to Article 11(2) of Regulation (EU) 2019/816. 4.Where Member States do not make use of the data quality verification mechanism referred to in paragraph 1 and use instead its equivalent in their national ECRIS implementation software, they shall ensure that it guarantees the same alphanumeric data, fingerprints data and facial images quality verification as that data quality verification mechanism.

Article 4a Article 4a Facial images quality 1.The data quality verification process shall apply to all facial images entered into or modified in ECRIS-TCN, and shall ensure that at least the following conditions are met: (a) only one facial image is provided in the NIST file and is submitted in accordance with the ANSI/NIST-ITL 1-2011 Update 2015 standard, or any newer version available;(b) the facial images are either grayscale, colour or near infrared;(c) the quality of the facial images is based on the image requirements of ISO/IEC 19794-5:2011 Frontal image type, or any newer version available;(d) the NIST file allows the inclusion of complementary information, including the date when the image was taken;(e) the facial images, in portrait mode, are at a minimum resolution of 600 pixels by 800 pixels and a maximum resolution of 1200 pixels by 1600 pixels;(f) the face occupies a space within the image which ensures a minimum of 120 pixels between the centre of each eye. 2.Facial images, entered into or modified in ECRIS-TCN, which do not comply with the conditions set out in paragraph 1, shall be rejected by ECRIS-TCN and shall neither be stored nor processed.;

Regulation (EU) 2018/1726 of the European Parliament and of the Council of 14 November 2018 on the European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA), and amending Regulation (EC) No 1987/2006 and Council Decision 2007/533/JHA and repealing Regulation (EU) No 1077/2011 (OJ L 295, 21.11.2018, p. 99 , ELI: http://data.europa.eu/eli/reg/2018/1726/oj).

The data quality verification process shall apply to all facial images entered into or modified in ECRIS-TCN, and shall ensure that at least the following conditions are met:

(a) only one facial image is provided in the NIST file and is submitted in accordance with the ANSI/NIST-ITL 1-2011 Update 2015 standard, or any newer version available;

(b) the facial images are either grayscale, colour or near infrared;

(c) the quality of the facial images is based on the image requirements of ISO/IEC 19794-5:2011 Frontal image type, or any newer version available;

(d) the NIST file allows the inclusion of complementary information, including the date when the image was taken;

(e) the facial images, in portrait mode, are at a minimum resolution of 600 pixels by 800 pixels and a maximum resolution of 1200 pixels by 1600 pixels;

(f) the face occupies a space within the image which ensures a minimum of 120 pixels between the centre of each eye.

Facial images, entered into or modified in ECRIS-TCN, which do not comply with the conditions set out in paragraph 1, shall be rejected by ECRIS-TCN and shall neither be stored nor processed.;

Regulation (EU) 2019/817 of the European Parliament and of the Council of 20 May 2019 on establishing a framework for interoperability between EU information systems in the field of borders and visa and amending Regulations (EC) No 767/2008, (EU) 2016/399, (EU) 2017/2226, (EU) 2018/1240, (EU) 2018/1726 and (EU) 2018/1861 of the European Parliament and of the Council and Council Decisions 2004/512/EC and 2008/633/JHA (OJ L 135, 22.5.2019, p. 27 , ELI: http://data.europa.eu/eli/reg/2019/817/oj).

Regulation (EU) 2019/818 of the European Parliament and of the Council of 20 May 2019 on establishing a framework for interoperability between EU information systems in the field of police and judicial cooperation, asylum and migration and amending Regulations (EU) 2018/1726, (EU) 2018/1862 and (EU) 2019/816 (OJ L 135, 22.5.2019, p. 85 , ELI: http://data.europa.eu/eli/reg/2019/818/oj).

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1 , ELI: http://data.europa.eu/eli/reg/2016/679/oj).

Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39 , ELI: http://data.europa.eu/eli/reg/2018/1725/oj).

Regulation (EU) 2018/1240 of the European Parliament and of the Council of 12 September 2018 establishing a European Travel Information and Authorisation System (ETIAS) and amending Regulations (EU) No 1077/2011, (EU) No 515/2014, (EU) 2016/399, (EU) 2016/1624 and (EU) 2017/2226 (OJ L 236, 19.9.2018, p. 1 , ELI: http://data.europa.eu/eli/reg/2018/1240/oj).

Regulation (EU) 2024/903 of the European Parliament and of the Council of 13 March 2024 laying down measures for a high level of public sector interoperability across the Union (Interoperable Europe Act) (OJ L, 2024/903, 22.3.2024, ELI: http://data.europa.eu/eli/reg/2024/903/oj).

HAS ADOPTED THIS DECISION: