The Schengen-wide entry ban: how are non-citizens’ personal data protected?

ABSTRACT

The article addresses the Schengen-wide entry ban, which is one of the key measures laid down in the EU Returns Directive (2008/115/EC). The entry ban entails that a non-citizen expelled from one member state is barred from returning to the whole Schengen area for up to five years, or longer in case of a threat to public policy or national security. The pan-European validity of the entry ban is ensured by an alert entered in the Schengen Information System (SIS). The alert is a set of personal data registered in the SIS which states may process to identify the person with a view of the refusal of entry. Processing personal data of non-citizens may pose a challenge to the protection of their data. The article assesses data protection rules laid down in the SIS Regulation (Regulation 1987/2006) and the Regulation which will replace it (Regulation 2018/1861). As it argues, SIS-specific data protection safeguards are frequently narrower than rules under data protection law, including the General Data Protection Regulation and Council of Europe Convention 108, and fall short of requirements flowing from the right to privacy under the European Convention of Human Rights and EU Charter of Fundamental Rights.

KEYWORDS:

• Data protection
• right to privacy
• Schengen Information System (SIS)
• entry ban
• Returns Directive

Disclosure statement

No potential conflict of interest was reported by the author(s).

Correction Statement

This article has been republished with minor changes. These changes do not impact the academic content of the article.

Notes

1 The name has been changed. This is an adapted story of a rejected asylum seeker whom the author met in a detention centre in Switzerland.

2 OJ 2008 L 348/98, 24 December 2008.

3 The article draws on the discussion in Chapter 7 of The EU Return Policy and its Compatibility with International Human Rights Law (Majcher 2019).

4 OJ 2000 L 239/19, 22 September 2000.

5 OJ 2006 L 381/4, 28 December 2006.

6 OJ 2007 L 205/63, 7 August 2007.

7 OJ 2018 L 312/14, 7 December 2018.

8 OJ 2016 L 77/5, 23 March 2016.

9 OJ 2009 L 243/1, 15 September 2009.

10 In October 2018, the CoE adopted a protocol amending the Convention to address the challenges to privacy resulting from the use of new information technologies. As of June 2020, it has not yet entered into force.

11 OJ 2016 L 119/1, 4 May 2016.

12 OJ 1995 L 281/31, 23 November 1995.

13 OJ 2016 L 251/1, 16 September 2016.

14 This is more explicitly stressed in the preamble to the Regulation 2018/1861 than in the SIS Regulation. Accordingly, the GDPR applies to the processing of personal data without prejudice to more specific rules laid down in the Regulation (§36).

15 For a brief overview of procedures in each member states to exercise the right of access, correction, or deletion, see SIS II Supervision Coordination Group (2014, 11-88).

16 As defined in the GDPR (art.4(7)), ‘controller’ means ‘the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data.’ In most member states the function of controller is exercised by police, see SIS II Supervision Coordination Group (2014, 11–88).

17 On the other hand, in similar circumstance, there was no breach of art.8 of the ECHR because the applicant was granted access to non-identifying information about her mother what enabled her tracing her roots, while ensuring the protection of other person interests (ECtHR 2003, para. 48–49).

18 OJ 2018 L 312/1, 7 December 2018.

19 OJ 2019 L 125/27, 22 May 2019.