Article 18

The Management Authority shall ensure that every access to and all exchanges of personal data within CS-SIS are recorded for the purposes mentioned in Article 12(1) and (2). The records shall show, in particular, the history of the alerts, the date and time of the data transmitted, the data used to perform searches, the reference to the data transmitted and the name of the competent authority responsible for processing the data. The records may only be used for the purposes mentioned in paragraph 1 and shall be deleted at the earliest one year, and at the latest three years, after their creation. The records which include the history of alerts shall be erased after one to three years after deletion of the alerts. Records may be kept longer if they are required for monitoring procedures that are already underway. The competent authorities in charge of checking whether or not a search is lawful, monitoring the lawfulness of data processing, self-monitoring and ensuring the proper functioning of CS-SIS, data integrity and security, shall have access, within the limits of their competence and at their request, to those records for the purpose of fulfilling their tasks.

← art_17__para_2__text_1 · All articles · 1. →

Source: EUR-Lex (Cellar) · retrieved 2026-11-14 · Text as adopted (Official Journal); later amendments are not incorporated in this text.