VG Stuttgart orders deletion of SIS alert for refusal of entry under Art. 17 GDPR

K 12737/25 ECLI: ECLI:DE:VGSTUTT:2026:0714.1K12737.25.00 Document Type: Judgement Source: Legal Provisions: Art. 24(1) TEU 2018/1861, Art. 53(2) TEU 2018/1861, Art. 53(1) TEU 2016/679, § 42(1) VwGO Alert in the Schengen Information System Headnote 1 An action to enforce a legal obligation may be admissible for a request for the erasure of data stored in the Schengen Information System.

A claim for the erasure of personal data pursuant to Art. 53(1), Art. 24(1) and (2) of Regulation 2018/1861/EU is admissible. 2 A right to the erasure of personal data pursuant to Art. 53(1), Art. 24(1) and (2) Regulation 2018/1861/EU in conjunction with Art. 17(1) of the GDPR may also arise from the fact that the Tenor The defendant is ordered to delete the alert concerning the plaintiff regarding the refusal of entry and residence from the Schengen Information System. The defendant shall bear the costs of the proceedings. Facts 1 The plaintiff seeks the erasure of personal data stored about him in the Schengen Information System. 2 The plaintiff is a national of North Macedonia. He has previously stayed in the Federal Republic of Germany on several occasions, at times with a residence permit pursuant to para 18(3) of the Residence Act (AufenthG). By a decision dated September 2, 2021, he was expelled from the territory of the Federal Republic and a two-year ban on entry and residence was imposed on him. According According to the entry stamp in his passport, he re-entered the Federal Republic on December 2, 2024, without a visa via B. Airport. On July 27, 2025, the plaintiff departed for North Macedonia again via the Karlsruhe-Baden-Baden Airport, together with his then-fiancée and now-wife. As part of the departure procedure, he presented himself at the border police exit control.

In a letter dated April 2, 2025, the plaintiff was informed of his alert in the SIS, which was valid until April 1, 2028. He was informed that the Federal Police had determined that he met the requirements of Art. 24(2) of Regulation (EU) 2018/1861 and that he posed a threat within the meaning of that provision. The letter was handed to the plaintiff as he was leaving the country. On August 1, 2025, the Stuttgart Federal Police Directorate ordered the alert and entered it into both systems.

In a letter dated September 8, 2025, the Stuttgart Federal Police Directorate rejected the request to perform the erasure of the wanted notice and stated that the wanted notice would remain in effect until April 1, 2028. It provided the following reasoning: He is accused of unlawful residence without a residence permit pursuant to § 95 (1)(2) of the Residence Act (AufenthG). In the past, he had already been ordered to leave the country on multiple occasions by the Immigration Office and had also been subject to an entry and residence ban. Repeated disregard for the provisions of immigration law necessarily results in an entry ban pursuant to Art. 24 of Regulation (EU) 2018/1861. Through his conduct, he poses a threat to public safety and order. The conditions for revoking the alert were not met. The notice regarding the alert for denial of entry pursuant to Art 52(1) of Regulation (EU) 2018/1861 had been served on him.

In a brief filed by his attorney on October 9, 2025, the plaintiff requested that the alert for denial of entry be corrected due to incorrect data entry, in the alternative, to have it deleted, and, in the further alternative, to impose a time limit on it retroactively. The unauthorized stay prior to departure was not punishable under para 95(1)(2) of the Residence Act (AufenthG) because he was a so-called “positive-status national.” Apart from the notification from the O. Federal Police Station, apparently no official decision had been issued. For the entry of an alert, it is always necessary that an administrative or Court decision denying entry and residence have been issued. A mere notification of the alert is therefore insufficient. He has since married his German partner and wishes to file a visa application for spousal reunification as soon as possible. In its statement dated October 22, 2025, the Stuttgart Federal Police Headquarters argued that the reasoning regarding criminal liability could not be understood. The decision to deny entry and residence had been made by the Stuttgart Federal Police Directorate, and the applicant had been flagged in SIS and INPOL. A formal decision was not required because no entry and residence ban had been imposed pursuant to § 11 of the Residence Act (AufenthG), but only an alert pursuant to Art. 24(1) lit. a of Regulation (EU) 2018/1861. - Page 2 of 7 -

In his lawsuit filed on October 27, 2025, with the Administrative Court of Stuttgart, the plaintiff argues that it is questionable whether a mere notification of the refusal of entry is sufficient to produce legal effect. From the wording and the reference in Art. 3(17) of Regulation (EU) 2018/1861 to Art. 3 of the Return Directive (2008/115/EC), it follows that an administrative or Court order must have been issued. The entry in the SIS itself—that is, the entry of the data—does not constitute an administrative act but is simply an exercise of sovereign authority. The entry of a Schengen visa requires— pursuant to Art. 32(1)(1)(a) of Regulation (EC) No. 810/2009 of the European Parliament and of the Council of July 13, 2009, on a Community Visa Code (Visa Code), the absence of an alert in the SIS regarding a refusal of entry. For this reason alone, the entry has direct external effect. The exception of unauthorized entry under Article 6(1) of Regulation (EU) 2016/399 of the European Parliament and of the Council of March 9, 2016, on a Community Code on the Crossing by persons (Schengen Borders Code) does not apply. If the alert therefore constitutes an administrative act, the defendant would first have to issue such an act. The notification pursuant to Article 52 of Regulation (EU) 2018/1861 does not replace the notification of the necessary administrative decision, which, moreover, must also have been substantiated and exercised at the discretion of the authorities. The entry should therefore be subject to an erasure. With regard to the duration of the refusal of entry, it must be taken into account that the expulsion at that time and the entry and residence bans had already expired and therefore could no longer be held against him. The passage of time implies precisely that he no longer poses a threat. Furthermore, his actions do not constitute a criminal offense. With regard to the marriage that has since taken place in North Macedonia, a time limit should be imposed, which is why the defendant has committed an error of discretion. The German Embassy in Skopje does not make a decision on the visa application for the purpose of spousal reunification based on the alert. However, even if a visa had been granted, the alert would prevent lawful entry pursuant to Art. 6(1)(d) of the Schengen Borders Code. The national alert, on the other hand, is not being challenged.

It argues that the plaintiff has remained 148 days longer than the period specified in Art. 21 of the Convention implementing the Schengen Agreement of June 14, 1985, between the Governments of the States of the Benelux Economic Union, the - Page 3 of 7 - the Federal Republic of Germany, and the French Republic concerning the gradual abolition of controls at common borders of June 19, 1990 (Schengen Implementation Convention); this constitutes a significant violation of the Residence Act. The order to issue the alert was issued on August 1, 2025, by the Federal Police Directorate in Stuttgart and was subsequently entered into both systems. The order, based on para. 24(1) (a) in conjunction with para. 2(c) of Regulation (EU) 2018/1861 in conjunction with § 30(5) of the Federal Police Act (BPolG) was lawful and was not based on incorrect data. The plaintiff had violated European Union legal provisions or national legal provisions regarding entry into and residence in the territory of the Member States, or had circumvented them within the meaning of the provision, which constituted an unlawful stay in the Schengen Area. He had thus repeatedly acted in gross disregard of immigration law provisions. The decisive factor is the repeated disregard of the legal provisions governing entry into and residence within the territory of the Member States. Whether his actions constitute a criminal offense is irrelevant in this context. The applicant had repeatedly made it clear through his conduct that he was indifferent to the provisions governing residence. The necessary administrative decision consisted of the Federal Police’s entry of the alert in the SIS. The alert does not constitute an administrative act in this context, which is why no formal notice had to be issued. The notification of the alert was therefore sufficient. The alert does not constitute an obstacle to the examination of an application for a visa for spousal reunification. In the event of premature erasure, there would be a risk that the plaintiff would once again be staying in the federal territory without authorization and that his presence would pose a threat to public security within the meaning of Art. 24(1)(a) and (2)(c) of Regulation (EU) 2018/1861. Furthermore, a retroactive reduction is not an option. To the extent that the visa is issued for the purpose of spousal reunification or the embassy notifies that the requirements for visa issuance have been met, the alert may be lifted.

With the consent of the parties, the lawsuit is decided pursuant to para 101(2) VwGO without an oral hearing.

An action for performance is admissible under § 42(1) VwGO if the claim seeks to compel a public authority to issue an administrative act that has been refused or omitted. It is also applicable when a lawsuit is directed at an actual act by an administrative authority, but the sought-after actual act of the authority is preceded by an administrative act. In such cases, the legal focus of the authority’s activity lies not in the actual act as such, but in the underlying decision, which is issued in the form of an administrative act - Page 4 of 7 - (Federal Administrative Court, judgements of Nov. 28, 2007—6 A 2.07—BVerwGE 130, 29, para. 13, and of September 16, 2020—6 C 10.19—Buchholz 403.1 Allg DatenschutzR No. 21, para. 12). This is the case, for example, when the authority, prior to taking the actual action, makes a decision that must be made on the basis of a statutory review procedure and in which the authority must observe specific procedural requirements, such as the duty to state reasons or the duty to hear the parties (Federal Administrative Court, Judgement of September 16, 2020 – 6 C 10.19 – Buch- holz 403.1 General Data Protection Law No. 21, para. 12). In this context, the regulatory nature of the decision—which is required for an administrative act— presupposes that, based on its objective meaning, the decision is intended to establish a legal consequence. It must establish, define in substance, amend, repeal, or determine rights or obligations that are legally binding on the person concerned, or legally and bindingly reject such a determination. An administrative act of determination therefore exists when the result of the authority’s application of the law is legally bindingly established (Federal Administrative Court, Judgement of March 2, 2022 – 6 C 7.20 –, juris para. 19).

Based on this, the claim for the erasure of incorrect entries in the SIS is directed not solely at the actual act of erasure, but at a prior administrative act. The focus lies on the decision regarding this amendment, which must comply with the review criteria set forth in Art. 53(1), Art. 24(1) and (2) of Regulation (EU) 2018/1861 in conjunction with Art. 17(1) of Regulation (EU) 2016/679 (GDPR), in the context of which the authority, in particular, makes a decision regarding the accuracy or inaccuracy of the data in question (see Federal Administrative Court, judgement of March 2, 2022—6 C 7.20—juris para. 20 regarding the right under Art. 16(1) of the GDPR). The respondent’s brief dated September 8, 2025, is thus an administrative act within the meaning of § 35, sentence 1, of the Administrative Procedure Act (VwVfG), by which the request of September 3, 2025, for the erasure of the entry. In the absence of information on available remedies, this decision has not (yet) become final, and the revocation period has therefore not yet expired (Section 58 (2), first sentence, and § 74(1), first sentence, VwGO).

The right to erasure thus arises from Art. 53(1) and Art. 24(1) and (2) of Regulation (EU) 2018/1861 in conjunction with Art. 17(1) of the GDPR. In the absence of its own provisions, Regulation (EU) 2018/1861 refers in Article 53(1) to Articles 15 through 17 of the GDPR. Pursuant to Article 17 (1) of the GDPR, the data subject has the right to obtain from the controller, without undue delay, the erasure of inaccurate personal data concerning him or her, if, pursuant to subparagraph (a), the personal data are no longer necessary for the purposes for which they were collected or otherwise processed, or, pursuant to subparagraph (d), the personal data have been unlawfully processed. - Page 5 of 7 -

The inaccuracy of the personal data stored about the plaintiff in the lawsuit SIS alert in the present case stems from the fact that the conditions for the alert pursuant to Art. 24(1) and (2) of Regulation (EU) 2018/1861 are no longer met.

Pursuant to Article 24(1) of Regulation (EU) 2018/1861, Member States shall issue an alert for refusal of entry and stay if one of the following conditions is met: a) The Member State has concluded, on the basis of an individual assessment, which includes an evaluation of the personal circumstances of the third-country national in question and the implications of the refusal of entry and stay for that third-country national, that the presence of third-country national in its territory poses a threat to public order or to public or national security within its territory, and the Member State has consequently, in accordance with its national law,- has issued a judicial or administrative decision denying entry and residence and has entered the third-country national in a national alert system for denial of entry and residence, or (b) the Member State, in accordance with procedures consistent with Directive 2008/115/EC, has imposed an entry ban on a third-country national . The situations referred to in paragraph 1(a) apply if a) a third-country national has been convicted in a Member State of a criminal offense punishable by a prison sentence of at least one year; (b) there is reasonable suspicion that a third-country national has committed a serious criminal offense—including terrorist offenses—or if there is concrete evidence that he or she is planning such acts within the territory of a Member State; or c) a third- country national has circumvented or attempted to circumvent Union or national legislation governing entry into and residence in the territory.

This in itself constitutes a violation of European Union law within the meaning of Article 24(2)(c) of Regulation (EU) 2018/1806. However, at the relevant time of the Court’s decision, it cannot be assumed that the plaintiff’s presence in the Federal Republic poses a threat to public order or to public or national security within the Federal Republic. To the extent that the defendant’s assumption is based on an individual assessment by the defendant in which the claimant’s personal circumstances and the effects of the denial of entry were taken into account, it is erroneous. This element of Article 24(1)(a) of Regulation (EU) 2018/1806 reflects the principle of proportionality under Article 21 of Regulation (EU) 2018/1806, which, under paragraph 1, requires that the appropriateness, relevance, and significance of the case sufficiently justify an alert in the SIS - Page 6 of 7 - (Potsdam Administrative Court, judgement of Dec. 14, 2023 – 3 K 1458/19 –, juris para. 35). It is also supported by Recitals 31 and 32 of the Regulation, according to which alerts may not be stored in the SIS for longer than is necessary for the specific purpose for which the entry was made, and the entry of an alert is subject to a proportionality review.

The resulting right to erasure is also not precluded under Art. 17(3) of the GDPR .