Division 5.1 Keeping the records of data processing operations

Each data processing operation within the VIS shall be recorded as a log entry with a field ‘TypeOfAction’ including the purpose of access in accordance with Article 34(1) of the VIS Regulation.

The log entry shall be recorded with the timestamp of the moment it was received. This timestamp shall later be used to identify the log entries to be deleted.

For all data processing operations, the authority entering or retrieving the data shall be stored in the log entry. The user and the central VIS shall be specified in the log entry either as a sender or as a recipient.

No other operational data than the authority entering or retrieving the data and the visa application number shall be included in the log entry. The type of data transmitted or used for interrogation referred to in Article 34(1) of the VIS Regulation shall be stored.

When records referred in Article 34(2) of the VIS Regulation, having the field ‘TypeOfAction’ set to either ‘Delete Application’ or ‘Automatic Deletion’ are found by the VIS, it shall calculate that one year has passed since the expiration of the retention period referred to in Article 23(1) of the VIS Regulation and then proceed to the deletion. All records of data processing operations having the same application number shall be deleted simultaneously, if not required for data-protection monitoring purposes, in accordance with Article 34(2) of the VIS Regulation.

Records of data processing operations shall neither be modified nor deleted before one year after the expiration of the retention period referred to in Article 23(1) of the VIS Regulation.