Prováděcí rozhodnutí Komise (EU) 2026/1064 ze dne 8. června 2026, kterým se stanoví prováděcí pravidla k nařízení Evropského parlamentu a Rady (EU) 2024/982, pokud jde o automatizované vyhledávání a výměnu biometrických údajů prostřednictvím prümského směrovače

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2024/982 of the European Parliament and of the Council of 13 March 2024 on the automated search and exchange of data for police cooperation, and amending Council Decisions 2008/615/JHA and 2008/616/JHA and Regulations (EU) 2018/1726, (EU) 2019/817 and (EU) 2019/818 of the European Parliament and of the Council (the Prüm II Regulation)OJ L, 2024/982, 5.4.2024, ELI: http://data.europa.eu/eli/reg/2024/982/oj. , and in particular Article 5(3), Article 8(2) and (3), Article 9(3), Article 13(2) and (3), Article 14(2), Article 22(2) and (3), Article 23(2), Article 31 and Article 37(6) thereof,

For the purposes of this Decision, the following definitions apply:

(a) entity means either a Member State or Europol;

(b) requesting entity means a Member State or Europol that initiates a query;

(c) requested entity means a Member State or Europol that receives a query and initiates a response;

(d) transaction means one query transaction and its corresponding response transaction(s);

(e) quota point means a point used for each transaction received, processed and replied by the requested entity;

(f) partial locus means a locus with only one filled allele;

(g) mugshot image means a facial image taken in a controlled environment;

(h) trace image means a facial image taken in an uncontrolled environment;

(i) re-matching means the task performed by the router for homogeneously ranking the candidates by comparing the biometric data used for querying and the biometric data supplied in the response transactions by the requested entities, in accordance with Article 37(4) of Regulation (EU) 2024/982.

OJ L, 2024/982, 5.4.2024, ELI: http://data.europa.eu/eli/reg/2024/982/oj.

(1) Regulation (EU) 2024/982 establishes a framework for the automated search and exchange of certain categories of data for cross-border police cooperation, including the automated exchange of biometric data among Member States and Europol to prevent and combat cross-border crime.

(2) Pursuant to Regulation (EU) 2024/982, the Commission is to specify the technical rules for automated search and exchange of biometric data, namely DNA profiles, dactyloscopic data and facial images, to be done via the Prüm router.

(3) It is therefore necessary to define the technical standards, procedures and specifications for the operation of the Prüm router and the associated services to enable eu-LISA to define the design of the router, as well as to elaborate the technical specifications, testing and overall project management and coordination.

(4) The effective exchange of biometric data requires standardised formats, unique identifiers and harmonised protocols for DNA profiles, dactyloscopic data, and facial images. The use of internationally recognised standards should ensure interoperability and compatibility among Member States’ systems and with Europol. The relevant technical rules set out the entity codes, message structures, data payloads, and routing mechanisms to guarantee consistent and accurate automated processing.

(5) The exchange of sensitive biometric data should be protected against unauthorised access, tampering, or loss and the Prüm router should operate as a high-availability system with redundancy across primary and backup sites. It is therefore necessary to define secure communication protocols, automated retry mechanisms and monitoring procedures. Such protocols, mechanisms and procedures should ensure system reliability, timely responses, and error handling for uninterrupted cross-border data exchange.

(6) The exchange of DNA profiles, dactyloscopic data and facial images should comply with minimum quality standards to allow reliable identification and verification. Automated matching procedures should be complemented by manual forensic review for confirmation of matches and core data requests. It is therefore essential to establish technical rules governing profile formats, resolution, loci matching, candidate ranking, re-matching procedures and reporting. That should ensure that the data exchanged can be accurately interpreted and used for criminal investigations in accordance with Regulation (EU) 2024/982.

(7) In accordance with Articles 1 and 2 of Protocol No 22 on the position of Denmark, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, Denmark did not take part in the adoption of Regulation (EU) 2024/982 and is not bound by it or subject to its application. Denmark is therefore not bound by this Decision or subject to its application.

(8) Ireland is bound by Regulation (EU) 2024/982 and is therefore bound by this Decision.

(9) The Prüm router contributes to the provision of a cross-border digital public service. As this Decision introduces binding requirements affecting its development, an interoperability assessment is required under Article 3 of Regulation (EU) 2024/903 of the European Parliament and of the CouncilRegulation (EU) 2024/903 of the European Parliament and of the Council of 13 March 2024 laying down measures for a high level of public sector interoperability across the Union (Interoperable Europe Act) (OJ L, 2024/903, 22.3.2024, ELI: http://data.europa.eu/eli/reg/2024/903/oj). (Interoperable Europe Act). The assessment has been carried out, and the resulting report will be published on the Interoperable Europe Portal.

(10) The European Data Protection Supervisor delivered an opinion on 27 January 2026 .

(11) The measures provided for in this Decision are in accordance with the opinion of the Prüm II Committee, established by Article 77 of Regulation (EU) 2024/982,

The specifications relating to the technical rules for the automated search and exchange of biometric data via the Prüm router shall be as set out in the Annex.

Regulation (EU) 2024/903 of the European Parliament and of the Council of 13 March 2024 laying down measures for a high level of public sector interoperability across the Union (Interoperable Europe Act) (OJ L, 2024/903, 22.3.2024, ELI: http://data.europa.eu/eli/reg/2024/903/oj).

Article 1 Article 1

Article 2 Article 2

Article 3 Article 3

This Decision shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union .

HAS ADOPTED THIS DECISION: