Introductory text

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EC) No 767/2008 of the European Parliament and of the Council of 9 July 2008 concerning the Visa Information System (VIS) and the exchange of data between Member States on short-stay visas (VIS Regulation)^f1, and in particular Article 32 thereof,

Whereas:

Article 32(3) of Regulation (EC) No 767/2008 provides that the Management Authority shall take the necessary measures in order to achieve the objectives in the field of security prescribed in Article 32(2) as regards the operation of the VIS, including the adoption of the security plan.

Article 26(4) of Regulation (EC) No 767/2008 provides that during a transitional period before the Management Authority takes up its responsibilities, the Commission shall be responsible for the operational management of the VIS.

Regulation (EC) No 45/2001 of the European Parliament and of the Council^f2 applies to the processing of personal data by the Commission when carrying out its responsibilities in the operational management of VIS.

Article 26(7) of Regulation (EC) No 767/2008 provides that where the Commission delegates its responsibilities during the transitional period before the Management Authority takes up its responsibilities, it shall ensure that this delegation does not adversely affect any effective control mechanism under Union law, whether of the Court of Justice, the Court of Auditors or the European Data Protection Supervisor.

The Management Authority should set out its own security plan in relation to the VIS once it will have taken up its responsibilities.

Commission Decision 2008/602/EC of 17 June 2008 laying down the physical architecture and requirements of the national interfaces and of the communication infrastructure between the central VIS and the national interfaces for the development phase^f3 has described the required security services applicable for the network for VIS.

Article 27 of Regulation (EC) No 767/2008 provides that the principal central VIS, which performs technical supervision and administration functions, shall be located in Strasbourg (France) and a backup central VIS, capable of ensuring all functionalities of the principal central VIS in the event of failure of the system, shall be located in Sankt Johann im Pongau (Austria).

The roles of the security officers should be laid down in order to ensure efficient and prompt response to security incidents and reporting thereof.

A Security Policy should be set up describing all technical and organisational details in line with the provisions of this Decision.

Measures should be defined to ensure the appropriate level of security of the operation of VIS,

HAS ADOPTED THIS DECISION: