I would say it's more generic than that. Not all the data is for EU citizens, and not all the data has photos and fingerprints. What dangerface quoted from the

I would say it's more generic than that. Not all the data is for EU citizens, and not all the data has photos and fingerprints. What dangerface quoted from the euobserver[1] seems to be the best approach, maybe make it shorter... As I said in another comment, I would emphasize more on the "classified" than "personal information", but that's only me (I would say Facebook has way more info on "normal" people than what's in the SIS database). There's also the issue of "copied to US", which was not demonstrated. It's really hard to keep all the US companies out of the SIS when you are using an Oracle database. I would put it like this: "UK made illegal copies of classified personal information from the Schengen Information System" [1] https://euobserver.com/justice/145530 https://euobserver.com/justice/145530