The creation of pan-European centralised databases that process the personal data of non-EU citizens is inextricably linked with the emergence of ‘a Europe without internal frontiers’. The story begins in the mid-1980s with the evolution of European integration and the addition of borders to the list of responsibilities shared by the Member States and the EU (then European Community). In parallel, a more limited number of Member States decided to abolish their internal border controls within the framework of the so-called Schengen Agreement and Convention:1 a person allowed to enter the territory of one of the participating countries was automatically permitted to circulate within the Schengen area, without being subjected again to checks at the border. As irregular migrants and criminals were not excluded from free circulation, the dismantlement of internal checks was accompanied by so-called compensatory or flanking measures providing for, among other things, a common set of rules on external borders, short-stay visas and asylum applications.2 With the Treaty of Amsterdam, the law developed under the Schengen Convention, the so-called Schengen acquis, was integrated within EU law.3 At the same time, the EU competence in Justice and Home Affairs (JHA) that had been introduced with the Maastricht Treaty was modified to include the overarching objective of establishing an Area of Freedom, Security and Justice (AFSJ).4 Since then, a substantial corpus of legislation regulating access to, stay in and removal from the Schengen area has been progressively constructed.5 Efforts to control the movement of non-EU nationals within the Schengen area have been coupled with efforts to prevent them from reaching the EU external border,6 thus necessitating action outside the physical border.7 In all of these developments, the growing tendency to associate non-EU nationals with irregular migration and criminality has been critical. Asylum and visa applications, as well as entry and exit procedures, have been instrumentalised for the purpose of the prevention and investigation of crimes, particularly of terrorism.8 More broadly speaking, security considerations have had a major impact in determining the objectives and rules of immigration control instruments.9