Flagged in the Schengen system (SIS): consequences and remedies

What is the Schengen Information System?

The SIS is Europe’s largest police- and migration-cooperation database, shared by the States of the Schengen area. When one country enters a person, the information becomes accessible to the authorities of every other State — consulates, border police, immigration services.

For a third-country national, two distinct legal regimes may justify the entry:

• Regulation (EU) 2018/1861 — an alert for refusal of entry and stay (Article 24): the most common; it leads to visa refusal and refusal of entry into the Schengen area.
• Regulation (EU) 2018/1860 — an alert on a third-country national subject to a return decision, to ensure its follow-up across Europe.

The distinction is not academic: it determines the nature of the obstacle and how to lift it.

Why an alert blocks a visa or entry

A refusal-of-entry alert has a cascading effect. The consulate examining a visa application checks the SIS; if it finds an entry, the application is in principle refused, absent compelling reasons. At the border, the flagged person is denied entry. And because the database is shared, the obstacle is not limited to the country that entered the alert: it applies across the whole Schengen area.

A key point: an alert may be inaccurate, outdated or disproportionate. States sometimes enter a person following an old decision that has already been enforced or annulled. The frozen record does not update on its own: it is for the person concerned, or their counsel, to trigger its verification and correction.

Finding out whether you are flagged — and by whom

A visa-refusal decision often mentions the alert without stating its author or grounds. Yet one can only meaningfully challenge what one knows. The first step is exercising the right of access: anyone may ask whether data concerning them is held in the SIS, which data, and which State entered it.

This right may be exercised before the competent authority of any Member State, but the issuing State remains in control of the data: it alone may amend or delete it. Identifying that country conditions everything that follows.

Challenging the alert and obtaining its deletion

EU law provides precise safeguards, which combine:

1. Right of access — obtaining the data entered and the identity of the issuing State.
2. Rectification and erasure — correcting inaccurate data and erasing data unlawfully stored (for instance following a decision that has been annulled or whose effects have ceased).
3. Application to the issuing State — sending it a reasoned request for review and deletion, supported by evidence.
4. Remedies — in the event of refusal or silence: referral to the competent data-protection authority and, where appropriate, court action to order rectification or erasure and to obtain compensation.

Alongside these “personal-data” avenues, one may — depending on the case — challenge the underlying decision (entry ban, return decision) on which the alert is based: removing the cause deprives the entry of its foundation.

An alert is not forever

Refusal-of-entry alerts are subject to periodic review by the State that created them: failing justification for keeping them, the entry must be deleted. But waiting for that review is passive and uncertain; where the alert is ill-founded, active steps toward deletion are almost always preferable.