Visa Information System

Legal Basis

The VIS has its legal bases in the VIS Regulation (EC) No 767/2008 of 9 July 2008, which has since been adapted and extended several times. At national level, access to the VIS data for the purpose of preventing, detecting and investigating terrorist offences and other serious criminal offences was additionally regulated in the Act on access by police and law enforcement authorities and intelligence services to the Visa Information System (VIS Access Act - VISZG).

 

Purposes of the Visa Information System

For the visa authorities, the exchange of visa data stored in the VIS facilitates the examination of short-stay visa applications and the decision whether to extend, revoke and annul visas. The VIS is also used to check visas and to verify and identify visa applicants and visa holders. The VIS also facilitates the fight against fraud in the visa procedure as well as checks at external border crossing points and within the territory of the Member States.

Where justified, the data can also be used by law enforcement authorities for the purposes of preventing, detecting or investigating terrorist offences and other serious criminal offences.

 

What data are processed?

Fingerprints are taken from all fingers of persons applying for a visa to a Schengen State or Associated State. A digital photograph of the applicant is also taken. These biometric data are stored in a central database along with the data provided when applying for a visa. In some cases, this also includes the data of persons issuing the invitation whose data are contained in the visa application.

Persons who regularly travel to the Schengen area do not have to provide fingerprints again each time they apply for a visa. The fingerprints stored in the VIS can be used for a five-year period.

Data protection

Access to the data in the VIS shall be restricted to the competent staff in the performance of their statutory duties. It must be ensured that access takes place only to the extent necessary for the performance of the task. The storage period shall not exceed five years. This period shall run from the date the visa expires, is applied for, or modified. In some cases, such as when applicants acquire the citizenship of a Schengen State, deletion of the data must happen in advance.

The BfDI monitors the data processing in the VIS carried out by the federal authorities. This applies in particular to the areas of the Federal Foreign Office, the Federal Office of Administration and the Federal Police.

In addition, regular exchanges take place with the representatives of the national data protection authorities of the 27 Member States of the European Union, the European Data Protection Supervisor and with representatives of the national data protection authorities of Iceland, Liechtenstein, Norway and Switzerland to ensure the coordination of data protection supervision of the VIS. More information can be found here.

 

Your rights as a data subject

Every data subject has the right to access his or her personal data stored in the VIS. Requests for access can be submitted to the Federal Office of Administration. The request can be submitted electronically or by post. More information can be found here. In addition, you can request that incorrect data be corrected and that unlawfully stored data be deleted.

In cases where you have acquired the citizenship of a Schengen State, there is generally an ex officio obligation to delete your data. According to my knowledge, there are currently shortcomings in this procedure, so I recommend in these cases to additionally file a request for deletion at the Federal Office of Administration.

If you have any questions about the procedure or need assistance in exercising your rights, please feel free to contact me.