FantasticSearch

1. Without prejudice to Regulation (EU) 2016/679, Member States shall ensure the security, integrity, authenticity and confidentiality of the data collected, accessed and stored for the purpose of this Regulation.

2. For the purpose of this Regulation, the authorities responsible for issuing identity cards and residence documents shall be considered as the controller referred to in Article 4, point (7), of Regulation (EU) 2016/679 and shall have responsibility for the processing of personal data.

3. Member States shall ensure that supervisory authorities can fully exercise their tasks as referred to in Regulation (EU) 2016/679, including access to all personal data and all necessary information as well as access to any premises or data processing equipment of the competent authorities.

4. Cooperation with external service providers shall not exclude any liability on the part of a Member State which may arise under Union or national law in respect of breaches of obligations with regard to personal data.

5. Information in machine-readable form shall only be included in an identity card or residence document in accordance with this Regulation and the national law of the issuing Member State.

6. The facial image of the holder stored on the storage medium of identity cards and residence documents shall only be accessed by duly authorised staff of competent national authorities, Union agencies and private entities and in compliance with Union data protection law for the purposes of verifying:

(a) the authenticity of the identity card or residence document;

(b) the identity of the holder by means of directly available comparable features where the identity card or residence document is required to be produced by law. Access to the facial image by private entities shall also require the consent of the holder, unless access regardless of consent is strictly necessary for the purposes set out in the first subparagraph and provided for by Union or national law in compliance with Union data protection law. The facial image accessed pursuant to the first subparagraph shall not be retained unless its further processing is necessary for the purposes set out in first subparagraph and is provided for by Union or national law, in compliance with Union data protection law. The facial image shall not be retained for longer than is necessary for those purposes, otherwise it shall be deleted as soon as the verification referred to in the first subparagraph has been completed and shall not be transferred to third countries or international organisations unless permitted by Union data protection law.

7. The two fingerprints of the holder stored on the storage medium of identity cards and residence documents shall only be accessed:

(a) for the purposes set out in paragraph 6, first subparagraph;

(b) in compliance with Union data protection law;

(c) by duly authorised staff of competent national authorities and Union agencies; and (d) where the document is required to be produced by Union or national law. The two fingerprints accessed pursuant to this paragraph shall not be retained.