As I understand it, you have been refused a Schengen visa for the formulaic reason...
One or more member state(s) consider you to be a threat to public
policy, internal security, public health as defined in Article 2(19)
of Regulation (EC) No 562/2006 (Schengen Borders Code) or the
international relations of one or more of the member states).
...expressed in whatever language the Schengen member uses. You believe this reason is a mistake and you want something like a 'road map' for how to fix it. Whatever you do, do not apply again until there's some shape on your case.
There is no easy way or quick way to do this and instructing a lawyer at some point is inevitable. There are some generic steps to take, but first let's define what is useful to know...
Subject Access Rights under EC Data Protection Directive (95/46/EC): Each member state has implemented local laws that provide an individual the right to know what information is held about them. All aspects of a Schengen refusal are covered with the EU's data protection regime and you may be able to use this provision to find out what information is stored about you. The problem you may have is that those laws provide an exemption for sensitive cases and it's likely you will need to appeal against their exemption.
Article 19 of the Universal Declaration of Human Rights: This has also been enacted into local laws in the various member states. Part of it requires member states to fix inaccurate data. You will be relying heavily on its provisions so it's worthwhile to spend time reading about it. There are hundreds of on-the-ground cases where people have benefited from Article 19.
There is also the avenue of judicial review, which can force a public body to reverse an unreasonable decision. More about that later.
Having said all of that, your "road map" would be...
- Study your access rights under EC Data Protection Directive
(95/46/EC) and submit the form requesting disclosure of your data.
They have a maximum of 40 days to respond from the time your request
is complete, which means you should expect them to require proof of
identity and prepare for it. You can actually instruct a
practitioner to handle this step, but it's just as effective and
cheaper to do this yourself.
- When they respond, even with a refusal, you will then be in a
position to instruct a local practitioner. There is no requirement
to hire a practitioner, but knowledge of the local language can
accelerate the process. Usually they are happy to communicate in
English also, but failing that you can expect to pay a premium if
they have to translate all the correspondence for you. In selecting
a practitioner, be sure they have credentials in Article 19 cases.
- The practitioner will go about the hoops of fixing the inaccurate
information (if it can be done). This may entail an appearance at
the local court (you will need to get a special type of visa for
this). You will also be required to present evidence showing that
the information is not accurate and you should begin doing this at
the outset so that it is translated and organized.
- Once the information has been corrected locally it will need to
propagate through the other systems in order for you to travel
comfortably, this could take up to six weeks.
- You can apply for another Schengen when your practitioner gives you
the go-ahead. It is unwise to try to get another visa before that
because it builds a separate case against your credibility.
Finally, if the above fails and you are convinced the information is in error, your practitioner may suggest a judicial review. These laws vary widely between the member states and some will offer more latitude than others. On the plus side, lots of JR's are resolved during the pre-action protocol stage. On the down side, JR's require court appearances and take a very long time. For that reason, consider Article 19 to be your most fruitful avenue.
There is more information here Schengen visa refusal on threat to public policy, security, health (Germany)
The controlling technical reference for Subject Access Rights is here: http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=URISERV%3Al14012
The controlling technical reference for Article 19 is here: http://www.un.org/en/universal-declaration-human-rights/ Also searching the net, you'll find hundreds of cases where Article 19 was used successfully to remove inaccurate information.
You can locate a licensed EU legal practitioner with credentials in Article 19 here: http://communities.lawsociety.org.uk/brussels/