The "Puzzle" of EU Large-Scale Information Systems for Third-Country Nationals: Surveillance of Movement and Its Challenges for Privacy and Personal Data Protection

The past three decades have been marked by the proliferation of EU databases processing various personal data collected from different categories of third-country nationals. At present, three databases are fully operational: the second-generation Schengen Information System (SIS II), the Visa Information System (VIS) and Eurodac. However, in the future three new databases will be set up: an Entry/Exit System (EES); a European Travel and Information Authorisation System (ETIAS); and a European Criminal Record Information System for third-country nationals (ECRIS-TCN). In addition, interoperability among these systems is in the making. By mapping the historical evolution of databases for third-country nationals in three distinct waves, this article demonstrates the progressive generalisation of their surveillance via the mass collection of their personal data, which are used for various purposes. Then, drawing on the jurisprudence of the European Courts, this article examines key privacy and data protection concerns about the necessity of setting up or maintaining information systems, their personal scope, the categories of personal data processed, access to stored data for law enforcement purposes and interoperability among the systems.