02018R1240 — EN — 03.08.2021 — 002.001

This text is meant purely as a documentation tool and has no legal effect. The Union's institutions do not assume any liability for its contents. The authentic versions of the relevant acts, including their preambles, are those published in the Official Journal of the European Union and available in EUR-Lex. Those official texts are directly accessible through the links embedded in this document

Amended by:





Corrected by:









▼B

REGULATION (EU) 2018/1240 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

of 12 September 2018

establishing a European Travel Information and Authorisation System (ETIAS) and amending Regulations (EU) No 1077/2011, (EU) No 515/2014, (EU) 2016/399, (EU) 2016/1624 and (EU) 2017/2226







CHAPTER I

GENERAL PROVISIONS

Article 1

Subject matter

1. This Regulation establishes a ‘European Travel Information and Authorisation System’ (ETIAS) for third-country nationals exempt from the requirement to be in possession of a visa when crossing the external borders (‘the visa requirement’) enabling consideration of whether the presence of those third-country nationals in the territory of the Member States would pose a security, illegal immigration or high epidemic risk. For this purpose, a travel authorisation and the conditions and procedures to issue or refuse it are introduced.

2. This Regulation lays down the conditions under which Member States’ designated authorities and Europol may consult data stored in the ETIAS Central System for the purposes of the prevention, detection and investigation of terrorist offences or of other serious criminal offences falling under their competence.

▼M1

3. By storing identity data and travel document data in the common identity repository (CIR) established by Article 17(1) of Regulation (EU) 2019/817 of the European Parliament and of the Council ( 1 ), ETIAS contributes to facilitating and assisting in the correct identification of persons registered in ETIAS under the conditions and for the purposes of Article 20 of that Regulation.

▼B

Article 2

Scope

1. This Regulation applies to the following categories of third-country nationals: (a) nationals of third countries listed in Annex II to Council Regulation (EC) No 539/2001 ( 2 ) who are exempt from the visa requirement for intended stays in the territory of the Member States of a duration of no more than 90 days in any 180-day period; (b) persons who, pursuant to Article 4(2) of Regulation (EC) No 539/2001, are exempt from the visa requirement for intended stays in the territory of the Member States of a duration of no more than 90 days in any 180-day period; (c) third-country nationals who are exempt from the visa requirement and who fulfil the following conditions: (i) they are family members of a Union citizen to whom Directive 2004/38/EC applies or of a national of a third country enjoying the right of free movement equivalent to that of Union citizens under an agreement between the Union and its Member States on the one hand and a third country on the other; and (ii) they do not hold a residence card pursuant to Directive 2004/38/EC or a residence permit pursuant to Regulation (EC) No 1030/2002.

2. This Regulation does not apply to: (a) refugees or stateless persons or other persons who do not hold the nationality of any country who reside in a Member State and who are holders of a travel document issued by that Member State; (b) third-country nationals who are family members of a Union citizen to whom Directive 2004/38/EC applies and who hold a residence card pursuant to that Directive; (c) third-country nationals who are family members of a third-country national enjoying a right of free movement equivalent to that of Union citizens, under an agreement between the Union and its Member States on the one hand and a third country on the other, and who hold a residence card pursuant to Directive 2004/38/EC or a residence permit pursuant to Regulation (EC) No 1030/2002; (d) holders of residence permits referred to in point 16 of Article 2 of Regulation (EU) 2016/399; (e) holders of uniform visas; (f) holders of national long-stay visas; (g) nationals of Andorra, Monaco and San Marino and holders of a passport issued by the Vatican City State or the Holy See; (h) nationals of third countries who are holders of a local border traffic permit issued by the Member States pursuant to Regulation (EC) No 1931/2006 of the European Parliament and of the Council ( 3 ) when such holders exercise their right within the context of the Local Border Traffic regime; (i) persons or categories of persons referred to in points (a) to (f) of Article 4(1) of Regulation (EC) No 539/2001; (j) third-country nationals holding diplomatic or service passports who have been exempted from the visa requirement pursuant to an international agreement concluded by the Union and a third country; (k) persons who are subject to a visa requirement pursuant to Article 4(3) of Regulation (EC) No 539/2001; (l) third-country nationals exercising their right to mobility in accordance with Directive 2014/66/EU ( 4 ) or (EU) 2016/801 ( 5 ) of the European Parliament and of the Council.

Article 3

Definitions

1. For the purposes of this Regulation, the following definitions apply: (1) ‘external borders’ means the external borders as defined in point 2 of Article 2 of Regulation (EU) 2016/399; (2) ‘law enforcement’ means the prevention, detection or investigation of terrorist offences or other serious criminal offences; (3) ‘second line check’ means a second line check as defined in point 13 of Article 2 of Regulation (EU) 2016/399; (4) ‘border authority’ means the border guard assigned in accordance with national law to carry out border checks as defined in point 11 of Article 2 of Regulation (EU) 2016/399; (5) ‘travel authorisation’ means a decision issued in accordance with this Regulation which is required for third-country nationals referred to in Article 2(1) of this Regulation to fulfil the entry condition laid down in point (b) of Article 6(1) of Regulation (EU) 2016/399 and which indicates: (a) that no factual indications or reasonable grounds based on factual indications have been identified to consider that the presence of the person on the territory of the Member States poses or will pose a security, illegal immigration or high epidemic risk; (b) that no factual indications or reasonable grounds based on factual indications have been identified to consider that the presence of the person on the territory of the Member States poses or will pose a security, illegal immigration or high epidemic risk, although doubt remains concerning the existence of sufficient reasons to refuse the travel authorisation, in accordance with Article 36(2); (c) where factual indications have been identified to consider that the presence of the person on the territory of the Member States poses or will pose a security, illegal immigration or high epidemic risk, that the territorial validity of the authorisation has been limited in accordance with Article 44; or (d) where factual indications have been identified to consider that the presence of the person on the territory of the Member States poses or will pose a security risk, that the traveller is the subject of an alert in SIS on persons for discreet checks or specific checks or of an alert in SIS on persons wanted for arrest for surrender purposes on the basis of an European Arrest Warrant or wanted for arrest for extradition purposes, in support of the objectives of SIS referred to in point (e) of Article 4; (6) ‘security risk’ means the risk of a threat to public policy, internal security or international relations for any of the Member States; (7) ‘illegal immigration risk’ means the risk of a third-country national not fulfilling the conditions of entry and stay as set out in Article 6 of Regulation (EU) 2016/399; (8) ‘high epidemic risk’ means any disease with epidemic potential as defined by the International Health Regulations of the World Health Organization (WHO) or the European Centre for Disease Prevention and Control (ECDC) and other infectious diseases or contagious parasitic diseases if they are the subject of protection provisions applying to nationals of the Member States; (9) ‘applicant’ means any third-country national referred to in Article 2 who has submitted an application for a travel authorisation; (10) ‘travel document’ means a passport or other equivalent document entitling the holder to cross the external borders and to which a visa may be affixed; (11) ‘short stay’ means stays in the territory of the Member States within the meaning of Article 6(1) of Regulation (EU) 2016/399; (12) ‘overstayer’ means a third-country national who does not fulfil, or no longer fulfils the conditions relating to the duration of a short stay on the territory of the Member States; (13) ‘app for mobile devices’ means a software application designed to run on mobile devices such as smartphones and tablet computers; (14) ‘hit’ means the existence of a correspondence established by comparing the personal data recorded in an application file of the ETIAS Central System with the specific risk indicators referred to in Article 33 or with the personal data present in a record, file or alert registered in the ETIAS Central System, in another EU information system or database listed in Article 20(2) (‘EU information systems’), in Europol data or in an Interpol database queried by the ETIAS Central System; (15) ‘terrorist offence’ means an offence which corresponds or is equivalent to one of the offences referred to in Directive (EU) 2017/541; (16) ‘serious criminal offence’ means an offence which corresponds or is equivalent to one of the offences referred to in Article 2(2) of Framework Decision 2002/584/JHA, if it is punishable under national law by a custodial sentence or a detention order for a maximum period of at least three years; (17) ‘Europol data’ means personal data processed by Europol for the purpose referred to in point (a) of Article 18(2) of Regulation (EU) 2016/794; (18) ‘electronically signed’ means the confirmation of agreement through the ticking of an appropriate box in the application form or the request for consent; (19) ‘minor’ means a third-country national or a stateless person below the age of 18 years; (20) ‘consulate’ means a Member State’s diplomatic mission or a Member State’s consular post as defined by the Vienna Convention on Consular Relations of 24 April 1963; (21) ‘designated authority’ means an authority designated by a Member State pursuant to Article 50 as responsible for the prevention, detection or investigation of terrorist offences or of other serious criminal offences; (22) ‘immigration authority’ means the competent authority responsible, in accordance with national law, for one or more of the following: (a) checking within the territory of the Member States whether the conditions for entry to, or stay on, the territory of the Member States are fulfilled; (b) examining the conditions for, and taking decisions related to, the residence of third-country nationals on the territory of the Member States insofar as that authority does not constitute a ‘determining authority’ as defined in point (f) of Article 2 of Directive 2013/32/EU of the European Parliament and of the Council ( 6 ), and, where relevant, providing advice in accordance with Council Regulation (EC) No 377/2004 ( 7 ); (c) the return of third-country nationals to a third country of origin or transit; ▼M1 (23) ‘CIR’ means the common identity repository established by Article 17(1) of Regulation (EU) 2019/817; (24) ‘ESP’ means the European search portal established by Article 6(1) of Regulation (EU) 2019/817; (25) ‘ETIAS Central System’ means the Central System referred to in point (a) of Article 6(2) together with the CIR to the extent that the CIR contains the data referred to in Article 6(2a); (26) ‘identity data’ means the data referred to in points (a), (b) and (c) of Article 17(2); (27) ‘travel document data’ means the data referred to in points (d) and (e) of Article 17(2) and the three letter code of the country issuing the travel document as referred to in point (c) of Article 19(3) ►M2 ; ◄ ▼M2 (28) ‘other EU information systems’ means the Entry/Exit System (‘EES’), established by Regulation (EU) 2017/2226, the Visa Information System (‘VIS’), established by Regulation (EC) No 767/2008 of the European Parliament and of the Council ( 8 ), the Schengen Information System (‘SIS’), established by Regulations (EU) 2018/1860 ( 9 ), (EU) 2018/1861 ( 10 ) and (EU) 2018/1862 ( 11 ) of the European Parliament and of the Council, Eurodac, established by Regulation (EU) No 603/2013 of the European Parliament and of the Council ( 12 ) and the European Criminal Record Information System – Third-Country Nationals (‘ECRIS-TCN’), established by Regulation (EU) 2019/816 of the European Parliament and of the Council ( 13 ) ▼B

2. The terms defined in Article 2 of Regulation (EC) No 45/2001 shall have the same meaning in this Regulation insofar as personal data are processed by the European Border and Coast Guard Agency and eu-LISA.

3. The terms defined in Article 4 of Regulation (EU) 2016/679 shall have the same meaning in this Regulation insofar as personal data are processed by the authorities of Member States for the purposes laid down in points (a) to (e) of Article 4 of this Regulation.

4. The terms defined in Article 3 of Directive (EU) 2016/680 shall have the same meaning in this Regulation insofar as personal data are processed by the authorities of the Member States for the purposes laid down in point (f) of Article 4 of this Regulation.

Article 4

Objectives of ETIAS

By supporting the competent authorities of the Member States, ETIAS shall:

(a) contribute to a high level of security by providing for a thorough security risk assessment of applicants, prior to their arrival at external border crossing points, in order to determine whether there are factual indications or reasonable grounds based on factual indications to conclude that the presence of the person on the territory of the Member States poses a security risk;

(b) contribute to the prevention of illegal immigration by providing for an illegal immigration risk assessment of applicants prior to their arrival at external border crossing points;

(c) contribute to the protection of public health by providing for an assessment of whether the applicant poses a high epidemic risk within the meaning of point 8 of Article 3(1) prior to his or her arrival at external border crossing points;

(d) enhance the effectiveness of border checks;

▼M2

(e) support the objectives of SIS related to alerts on third-country nationals subject to a refusal of entry and stay, alerts on persons wanted for arrest for surrender purposes or extradition purposes, alerts on missing persons, alerts on persons sought to assist with a judicial procedure, alerts on persons for discreet checks or specific checks and alerts on third-country nationals subject to a return decision;

▼M2

(ea) support the objectives of the EES;

▼B

(f) contribute to the prevention, detection and investigation of terrorist offences or of other serious criminal offences;

▼M1

(g) contribute to the correct identification of persons.

▼B

Article 5

General structure of ETIAS

ETIAS consists of:

(a) the ETIAS Information System as referred to in Article 6;

(b) the ETIAS Central Unit as referred to in Article 7;

(c) the ETIAS National Units as referred to in Article 8.

Article 6

Establishment and technical architecture of the ETIAS Information System

1. The European Agency for the operational management of large-scale IT systems in the area of freedom, security and justice (‘eu-LISA’) shall develop the ETIAS Information System and ensure its technical management.

2. The ETIAS Information System shall be composed of: ▼M1 (a) a Central System, including the ETIAS watchlist referred to in Article 34; ▼M1 (aa) the CIR; ▼B (b) a national uniform interface (NUI) in each Member State based on common technical specifications and identical for all Member States enabling the ETIAS Central System to connect to the national border infrastructures and to the central access points in Member States referred to in Article 50(2) in a secure manner; (c) a communication infrastructure between the ETIAS Central System and the NUIs which shall be secure and encrypted; ▼M1 (d) a secure communication infrastructure between the Central System and the central infrastructures of the ESP and the CIR; ▼M2 (da) a secure communication channel between the ETIAS Central System and the EES Central System; ▼B (e) a public website and an app for mobile devices; (f) an email service; (g) a secure account service enabling applicants to provide any additional information or documentation required; (h) a verification tool for applicants; (i) a tool enabling applicants to give or withdraw their consent for an additional retention period of their application file; (j) a tool enabling Europol and Member States to assess the potential impact of entering new data into the ETIAS watchlist on the proportion of applications that are manually processed; (k) a carrier gateway; (l) a secure web service enabling the ETIAS Central System to communicate with the public website, the app for mobile devices, the email service, the secured account service, the carrier gateway, the verification tool for applicants, the consent tool for applicants, the payment intermediary and the Interpol databases; (m) software enabling the ETIAS Central Unit and the ETIAS National Units to process applications and to manage consultations with other ETIAS National Units as referred to in Article 28 and with Europol as referred to in Article 29; (n) a central repository of data for the purposes of reporting and statistics.

▼M1

2a. The CIR shall contain the identity data and travel document data. The remaining data shall be stored in the Central System.

▼B

3. The ETIAS Central System, the NUIs, the web service, the carrier gateway and the communication infrastructure of ETIAS shall to the extent technically possible share and re-use the hardware and software components of the EES Central System, of the EES National Uniform Interfaces, of the EES web service and of the EES Communication Infrastructure referred to in Regulation (EU) 2017/2226.

4. The Commission shall adopt delegated acts in accordance with Article 89 in order to define the requirements of the secure account service referred to in point (g) of paragraph 2 of this Article.

Article 7

ETIAS Central Unit

1. An ETIAS Central Unit is hereby established within the European Border and Coast Guard Agency.

2. The ETIAS Central Unit shall be operational 24 hours a day, 7 days a week. It shall have the following responsibilities: ▼M2 (a) in cases where the automated application process has reported a hit, verifying in accordance with Article 22 whether the applicant’s personal data correspond to the personal data of the person having triggered that hit in the ETIAS Central System, any of the EU information systems that are consulted, Europol data, any of the Interpol databases referred to in Article 12, or the specific risk indicators referred to in Article 33, and where a correspondence is confirmed or where after such verification doubts remain, launching the manual processing of the application as referred to in Article 26; ▼B (b) ensuring that the data it enters in the applications files are up to date in accordance with the relevant provisions of Articles 55 and 64; (c) defining, establishing, assessing ex ante, implementing, evaluating ex post, revising and deleting the specific risk indicators as referred to in Article 33 after consultation of the ETIAS Screening Board; (d) ensuring that the verifications performed in accordance with Article 22 and the corresponding results are recorded in the application files; (e) carrying out regular audits of the processing of applications and of the implementation of Article 33, including by regularly assessing their impact on fundamental rights, in particular with regard to privacy and personal data protection; (f) indicating, where necessary, the Member State responsible for the manual processing of applications as referred to in Article 25(2); (g) in cases of technical problems or unforeseen circumstances, facilitating where necessary the consultations between Member States referred to in Article 28 and between the Member State responsible and Europol referred to in Article 29; (h) notifying carriers in cases of a failure of the ETIAS Information System as referred to in Article 46(1); (i) notifying the ETIAS National Units of the Member States of a failure of the ETIAS Information System as referred to in Article 48(1); (j) processing requests for consultation of data in the ETIAS Central System by Europol as referred to in Article 53; (k) providing the general public with all relevant information in relation to the application for a travel authorisation as referred to in Article 71; (l) cooperating with the Commission as regards the information campaign referred to in Article 72; (m) providing support in writing to travellers who have encountered problems when filling in the application form and have requested assistance through a standard contact form; maintaining a list of frequent questions and answers available online; (n) ensuring follow-up and regularly reporting to the Commission on reported abuses by commercial intermediaries as referred to in Article 15(5).

3. The ETIAS Central Unit shall publish an annual activity report. That report shall include: (a) statistics on: (i) the number of travel authorisations issued automatically by the ETIAS Central System; (ii) the number of applications verified by the ETIAS Central Unit; (iii) the number of applications processed manually per Member State; (iv) the number of applications that were refused by third country and the grounds for the refusal; (v) the extent to which the deadlines referred to in Article 22(6) and Articles 27, 30 and 32 have been met. (b) general information on the functioning of the ETIAS Central Unit, its activities as set out in this Article and information on current trends and challenges affecting the conduct of its tasks.

The annual activity report shall be transmitted to the European Parliament, the Council and the Commission by 31 March of the following year.

▼M2

4. The ETIAS Central Unit shall provide periodical reports to the Commission and eu-LISA concerning false hits as referred to in Article 22(4) which are generated during the automated verifications pursuant to Article 20(2).

▼B

Article 8

ETIAS National Units

1. Each Member State shall designate a competent authority as the ETIAS National Unit.

2. The ETIAS National Units shall be responsible for: (a) examining and deciding on applications for travel authorisation where the automated application process has reported a hit and the manual processing of the application has been initiated by the ETIAS Central Unit; (b) ensuring that the tasks performed under point (a) and the corresponding results are recorded in the application files; (c) ensuring that the data they enter in the application files are up to date in accordance with the relevant provisions of Articles 55 and 64; (d) deciding to issue travel authorisations with limited territorial validity as referred to in Article 44; (e) ensuring coordination with other ETIAS National Units and Europol concerning the consultation requests referred to in Articles 28 and 29; (f) providing applicants with information regarding the procedure to be followed in the event of an appeal under Article 37(3); (g) annulling and revoking a travel authorisation as referred to in Articles 40 and 41.

3. Member States shall provide the ETIAS National Units with adequate resources for them to fulfil their tasks in accordance with the deadlines set out in this Regulation.

Article 9

ETIAS Screening Board

1. An ETIAS Screening Board with an advisory function is hereby established within the European Border and Coast Guard Agency. It shall be composed of a representative of each ETIAS National Unit, of the European Border and Coast Guard Agency and of Europol.

2. The ETIAS Screening Board shall be consulted: (a) by the ETIAS Central Unit on the definition, establishment, assessment ex ante, implementation, evaluation ex post, revision and deletion of the specific risk indicators referred to in Article 33; (b) by Member States on the implementation of the ETIAS watchlist referred to in Article 34; (c) by Europol on the implementation of the ETIAS watchlist referred to in Article 34.

3. The ETIAS Screening Board shall issue opinions, guidelines, recommendations and best practices for the purposes referred to in paragraph 2. When issuing recommendations, the ETIAS Screening Board shall take into consideration the recommendations issued by the ETIAS Fundamental Rights Guidance Board.

4. The ETIAS Screening Board shall meet whenever necessary, and at least twice a year. The costs and servicing of its meetings shall be borne by the European Border and Coast Guard Agency.

5. The ETIAS Screening Board may consult the ETIAS Fundamental Rights Guidance Board on specific issues related to fundamental rights, in particular with regard to privacy, personal data protection and non-discrimination.

6. The ETIAS Screening Board shall adopt rules of procedure at its first meeting by a simple majority of its members.

Article 10

ETIAS Fundamental Rights Guidance Board

1. An independent ETIAS Fundamental Rights Guidance Board with an advisory and appraisal function is hereby established. Without prejudice to their respective competences and independence, it shall be composed of the Fundamental Rights Officer of the European Border and Coast Guard Agency, a representative of the consultative forum on fundamental rights of the European Border and Coast Guard Agency, a representative of the European Data Protection Supervisor, a representative of the European Data Protection Board established by Regulation (EU) 2016/679 and a representative of the European Union Agency for Fundamental Rights.

2. The ETIAS Fundamental Rights Guidance Board shall perform regular appraisals and issue recommendations to the ETIAS Screening Board on the impact on fundamental rights of the processing of applications and of the implementation of Article 33, in particular with regard to privacy, personal data protection and non-discrimination.

The ETIAS Fundamental Rights Guidance Board shall also support the ETIAS Screening Board in the execution of its tasks when consulted by the latter on specific issues related to fundamental rights, in particular with regard to privacy, personal data protection and non-discrimination.

The ETIAS Fundamental Rights Guidance Board shall have access to the audits referred to in point (e) of Article 7(2).

3. The ETIAS Fundamental Rights Guidance Board shall meet whenever necessary, and at least twice a year. The costs and servicing of its meetings shall be borne by the European Border and Coast Guard Agency. Its meetings shall take place in premises of the European Border and Coast Guard Agency. The secretariat of its meetings shall be provided by the European Border and Coast Guard Agency. The ETIAS Fundamental Rights Guidance Board shall adopt rules of procedure at its first meeting by a simple majority of its members.

4. One representative of the ETIAS Fundamental Rights Guidance Board shall be invited to attend the meetings of the ETIAS Screening Board in an advisory capacity. The members of the ETIAS Fundamental Rights Guidance Board shall have access to the information and files of the ETIAS Screening Board.

5. The ETIAS Fundamental Rights Guidance Board shall produce an annual report. The report shall be made publicly available.

▼M2

Article 11

Interoperability with other EU information systems and Europol data

1. Interoperability between the ETIAS Information System, on the one hand, and other EU information systems and Europol data, on the other hand, shall be established to enable the automated verifications pursuant to Article 20, Article 23, point (c)(ii) of Article 24(6), Article 41 and point (b) of Article 54(1) of this Regulation and shall rely on the European Search Portal (‘ESP’), established by Article 6 of Regulation (EU) 2019/817 and Article 6 of Regulation (EU) 2019/818 of the European Parliament and of the Council ( 14 ), from the date referred to in Article 72(1b) of Regulation (EU) 2019/817 and Article 68(1b) of Regulation (EU) 2019/818.

2. For the purpose of proceeding with the verifications referred to in point (i) of Article 20(2), the automated verifications pursuant to Article 20, point (c)(ii) of Article 24(6) and point (b) of Article 54(1) shall enable the ETIAS Central System to query VIS with the following data provided by applicants under points (a), (aa), (c) and (d) of Article 17(2): (a) surname (family name); (b) surname at birth; (c) first name(s) (given name(s)); (d) date of birth; (e) place of birth; (f) country of birth; (g) sex; (h) current nationality; (i) other nationalities (if any); (j) type, number, the country of issue of the travel document.

3. For the purpose of proceeding with the verifications referred to in points (g) and (h) of Article 20(2), the automated verifications pursuant to Article 20, point (c)(ii) of Article 24(6), Article 41 and point (b) of Article 54(1) shall enable the ETIAS Central System to query the EES with the following data provided by applicants under points (a) to (d) of Article 17(2): (a) surname (family name); (b) surname at birth; (c) first name(s) (given name(s)); (d) date of birth; (e) sex; (f) current nationality; (g) other names (alias(es)); (h) artistic name(s); (i) usual name(s); (j) other nationalities (if any); (k) type, number, the country of issue of the travel document.

4. For the purpose of proceeding with the verifications referred to in points (c), (m)(ii) and (o) of Article 20(2) and in Article 23 of this Regulation, the automated verifications pursuant to Article 20, Article 23, point (c)(ii) of Article 24(6), Article 41 and point (b) of Article 54(1) of this Regulation shall enable the ETIAS Central System to query SIS, as established by Regulations (EU) 2018/1860 and (EU) 2018/1861, with the following data provided by applicants under points (a) to (d) and (k) of Article 17(2) of this Regulation: (a) surname (family name); (b) surname at birth; (c) first name(s) (given name(s)); (d) date of birth; (e) place of birth; (f) sex; (g) current nationality; (h) other names (alias(es)); (i) artistic name(s); (j) usual name(s); (k) other nationalities (if any); (l) type, number, the country of issue of the travel document; (m) for minors, surname and first name(s) of the person exercising parental authority or of the applicant’s legal guardian.

5. For the purpose of proceeding with the verifications referred to in points (a), (d) and (m)(i) of Article 20(2) and in Article 23(1) of this Regulation, the automated verifications pursuant to Article 20, Article 23, point (c)(ii) of Article 24(6), Article 41 and point (b) of Article 54(1) of this Regulation shall enable the ETIAS Central System to query SIS, as established by Regulation (EU) 2018/1862, with the following data provided by applicants under points (a) to (d) and (k) of Article 17(2) of this Regulation: (a) surname (family name); (b) surname at birth; (c) first name(s) (given name(s)); (d) date of birth; (e) place of birth; (f) sex; (g) current nationality; (h) other names (alias(es)); (i) artistic name(s); (j) usual name(s); (k) other nationalities (if any); (l) type, number, the country of issue of the travel document; (m) for minors, surname and first name(s) of the person exercising parental authority or of the applicant’s legal guardian.

6. For the purpose of proceeding with the verifications referred to in point (n) of Article 20(2), the automated verifications pursuant to Article 20, point (c)(ii) of Article 24(6), and point (b) of Article 54(1) shall enable the ETIAS Central System to query ECRIS-TCN with the following data provided by applicants under points (a) to (d) of Article 17(2): (a) surname (family name); (b) surname at birth; (c) first name(s) (given name(s)); (d) date of birth; (e) place of birth; (ea) country of birth; (f) sex; (g) current nationality; (h) other names (alias(es)); (i) artistic name(s); (j) usual name(s); (k) other nationalities (if any); (l) type, number, the country of issue of the travel document.

7. For the purpose of proceeding with the verifications referred to in point (j) of Article 20(2), the automated verifications pursuant to Article 20, point (c)(ii) of Article 24(6) and point (b) of Article 54(1) shall enable the ETIAS Central System to query Europol data with the data referred to in points (a), (aa), (b), (c), (d), (f), (g), (j), (k) and (m) of Article 17(2) and in Article 17(8).

8. Where the automated verifications pursuant to Articles 20 and 23 report a hit, the ESP shall provide the ETIAS Central Unit with temporary read-only access to the results of those automated verifications. In the case of the automated verifications pursuant to Article 20, that access shall be provided in the application file until the end of the manual processing pursuant to Article 22(2). Where the data made available correspond to those of the applicant or where, after the automated verifications pursuant to Articles 20 and 23, doubts remain, the unique reference number of the record in the queried EU information systems of the data having triggered the hit shall be kept in the application file.

Where the automated verifications pursuant to Article 20 report a hit, those automated verifications shall receive the appropriate notification in accordance with Article 21(1a) of Regulation (EU) 2016/794.

9. A hit shall be triggered where all or some of the data from the application file used for the query correspond fully or partially to the data present in a record, alert or file of the other EU information systems consulted. The Commission shall adopt delegated acts in accordance with Article 89 in order to specify the conditions for the correspondence between the data present in a record, alert or file of the other EU information systems consulted and an application file.

10. For the purpose of paragraph 1 of this Article, the Commission, shall, by means of an implementing act, establish the technical arrangements for the implementation of point (c)(ii) of Article 24(6) and point (b) of Article 54(1) related to data retention. That implementing act shall be adopted in accordance with the examination procedure referred to in Article 90(2).

11. For the purpose of Articles 25(2), 28(8) and 29(9), when registering the data related to hits in the application file, the origin of the data shall be indicated by the following data: (a) the type of the alert, with the exception of alerts as referred to in Article 23(1); (b) the source of the data, namely the other EU information system from which the data originated or Europol data, as appropriate; (c) the reference number in the queried EU information system of the record having triggered the hit and the Member State that entered or supplied the data having triggered the hit; and (d) where available, the date and time when the data was entered in the other EU information system or Europol data.

The data referred to in points (a) to (d) of the first subparagraph shall only be accessible and visible by the ETIAS Central Unit where the ETIAS Central System is not able to identify the Member State responsible.

▼M2

Article 11b

Support of the objectives of the EES

For the purpose of Articles 6, 14, 17 and 18 of Regulation (EU) 2017/2226, an automated process, using the secure communication channel referred to in point (da) of Article 6(2) of this Regulation, shall query and import from the ETIAS Central System the information referred to in Article 47(2) of this Regulation, as well as the application number and the expiry date of the ETIAS travel authorisation, and shall create or update the entry/exit record or the refusal of entry record in the EES accordingly.

Article 11c

Interoperability between ETIAS and the EES for the purpose of the revocation of an ETIAS travel authorisation at the request of an applicant

1. For the purpose of implementing Article 41(8), an automated process, using the secure communication channel referred to in point (da) of Article 6(2), shall query the EES Central System to verify that applicants requesting the revocation of their travel authorisations are not present on the territory of the Member States.

2. Where the outcome of the verification in the EES Central System under paragraph 1 indicates that the applicant is not present on the territory of the Member States, the revocation shall be effective immediately.

3. Where the outcome of the verification under paragraph 1 of this Article indicates that the applicant is present on the territory of the Member States, Article 41(8) shall apply. The EES Central System shall record the fact that a notification is to be sent to the ETIAS Central System as soon as an entry/exit record indicating that the applicant having requested revocation of the travel authorisation has left the territory of the Member States has been created.

▼M2

Article 12

Querying the Interpol databases

1. The ETIAS Central System shall query the Interpol Stolen and Lost Travel Document database (SLTD) and the Interpol Travel Documents Associated with Notices database (TDAWN).

2. Any queries and verification shall be performed in such a way that no information is revealed to the owner of the Interpol alert.

3. If the implementation of paragraph 2 is not ensured, the ETIAS Central System shall not query the Interpol databases.

▼B

Article 13

Access to data stored in ETIAS

1. Access to the ETIAS Information System shall be reserved exclusively for duly authorised staff of the ETIAS Central Unit and of the ETIAS National Units.

2. Access by border authorities to the ETIAS Central System in accordance with Article 47 shall be limited to searching the ETIAS Central System to obtain the travel authorisation status of a traveller present at an external border crossing point and to the data referred to in points (a), (c) and (d) of Article 47(2). In addition, border authorities shall be informed automatically of the flags referred to in Article 36(2) and (3) and of the reasons for the flags.

When exceptionally, according to a flag, a second line check is recommended at the border or additional verifications are needed for the purpose of a second line check, border authorities shall access the ETIAS Central System to obtain the additional information provided for in point (e) of Article 39(1) or point (f) of Article 44(6).

3. Access by carriers to the ETIAS Information System in accordance with Article 45 shall be limited to sending queries to the ETIAS Information System to obtain the travel authorisation status of a traveller.

4. Access by immigration authorities to the ETIAS Central System in accordance with Article 49 shall be limited to obtaining the travel authorisation status of a traveller present on the territory of the Member State, and to certain data as referred to in that Article.

Access by immigration authorities to the ETIAS Central System in accordance with Article 65(3) shall be limited to the data referred to in that Article.

▼M1

4a. Access to the ETIAS identity data and travel document data stored in the CIR shall also be reserved exclusively for the duly authorised staff of the national authorities of each Member State and for the duly authorised staff of the Union agencies that are competent for the purposes laid down in Article 20 and Article 21 of Regulation (EU) 2019/817. Such access shall be limited according to the extent that the data are required for the performance of their tasks for those purposes, and proportionate to the objectives pursued.

▼M1

5. Each Member State shall designate the competent national authorities referred to in paragraphs 1, 2, 4 and 4a of this Article and shall communicate a list of these authorities to eu-LISA without delay, in accordance with Article 87(2). That list shall specify for which purpose the duly authorised staff of each authority shall have access to the data in ETIAS Information System in accordance with paragraphs 1, 2, 4 and 4a of this Article.

▼B

Article 14

Non-discrimination and fundamental rights

Processing of personal data within the ETIAS Information System by any user shall not result in discrimination against third-country nationals on the grounds of sex, race, colour, ethnic or social origin, genetic features, language, religion or belief, political or any other opinion, membership of a national minority, property, birth, disability, age or sexual orientation. It shall fully respect human dignity and integrity and fundamental rights, including the right to respect for one’s private life and to the protection of personal data. Particular attention shall be paid to children, the elderly and persons with a disability. The best interests of the child shall be a primary consideration.







CHAPTER II

APPLICATION

Article 15

Practical arrangements for submitting an application

1. Applicants shall submit an application by filling in the online application form via the dedicated public website or via the app for mobile devices sufficiently in advance of any intended travel, or, if they are already present on the territory of Member States, before the expiry of an existing travel authorisation they hold.

2. Holders of a travel authorisation may submit an application for a new travel authorisation from 120 days before the expiry of the travel authorisation.

120 days before the expiry of the travel authorisation, the ETIAS Central System shall automatically inform the holder of that travel authorisation via the email service of:

(a) the expiry date of the travel authorisation;

(b) the possibility to submit an application for a new travel authorisation;

(c) the obligation to be in possession of a valid travel authorisation for the entire duration of a short stay on the territory of Member States.

3. All notifications to the applicant for the purpose of his or her application for a travel authorisation shall be sent to the email address provided by the applicant in the application form as referred to in point (g) of Article 17(2).

4. Applications may be submitted by the applicant or by a person or a commercial intermediary authorised by the applicant to submit the application on his or her behalf.

5. The Commission shall, by means of an implementing act, create a form allowing abuses by the commercial intermediaries referred to in paragraph 4 of this Article to be reported. This form shall be made accessible via the dedicated public website or via the app for mobile devices referred to in paragraph 1 of this Article. Such completed forms shall be sent to the ETIAS Central Unit which shall take appropriate action, including by regularly reporting to the Commission. That implementing act shall be adopted in accordance with the examination procedure referred to in Article 90(2).

Article 16

The public website and the app for mobile devices

1. The public website and the app for mobile devices shall enable third-country nationals subject to the travel authorisation requirement to submit a travel authorisation application, to provide the data required in the application form in accordance with Article 17 and to pay the travel authorisation fee.

2. The public website and the app for mobile devices shall make the application form widely available and easily accessible to applicants free of charge. Specific attention shall be paid to the accessibility of the public website and the app for mobile devices for persons with disabilities.

3. The public website and the app for mobile devices shall be available in all the official languages of the Member States.

4. Where the official language(s) of the countries listed in Annex II to Regulation (EC) No 539/2001 do not correspond to the languages referred to in paragraph 3, factsheets with explanatory information concerning ETIAS, the application procedure, the use of the public website and the app for mobile devices as well as a step-by-step guide to the application shall be made available by eu-LISA on the public website and on the app for mobile devices in at least one of the official languages of the countries referred to. Where any such country has more than one official language, such factsheets shall only be necessary if none of those languages correspond to the languages referred to in paragraph 3.

5. The public website and the app for mobile devices shall inform applicants of the languages which may be used when filling in the application form.

6. The public website and the app for mobile devices shall provide the applicant with an account service enabling applicants to provide additional information or documentation, where required.

7. The public website and the app for mobile devices shall inform applicants of their right to an appeal under this Regulation if a travel authorisation is refused, revoked or annulled. To this end, they shall contain information about the national law applicable, the competent authority, how to lodge an appeal, the time limit for lodging an appeal and information as to any assistance that may be provided by the national data protection authority.

8. The public website and the app for mobile devices shall enable applicants to indicate that the purpose of their intended stay relates to humanitarian grounds or international obligations.

9. The public website shall contain the information referred to in Article 71.

10. The Commission shall, by means of implementing acts, adopt detailed rules on the operation of the public website and the app for mobile devices, and detailed rules on data protection and security applicable to the public website and the app for mobile devices. Those detailed rules shall be based on information security risk management and on principles of data protection by design and by default. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 90(2).

Article 17

Application form and personal data of the applicant

1. Each applicant shall submit a completed application form including a declaration of the authenticity, completeness, correctness and reliability of the data submitted and a declaration of the veracity and reliability of the statements made. Each applicant shall also state that he or she has understood the conditions for entry referred to in Article 6 of Regulation (EU) 2016/399 and that he or she may be requested to provide the relevant supporting documents at each entry. Minors shall submit an application form electronically signed by a person exercising permanent or temporary parental authority or legal guardianship.

2. The applicant shall provide the following personal data in the application form: ▼M1 (a) surname (family name), first name(s) (given name(s)), surname at birth; date of birth, place of birth, sex, current nationality; ▼M1 (aa) country of birth, first name(s) of the parents of the applicant; ▼B (b) other names (alias(es), artistic name(s), usual name(s)), if any; (c) other nationalities, if any; (d) type, number and country of issue of the travel document; (e) the date of issue and the date of expiry of the validity of the travel document; (f) the applicant’s home address or, if not available, his or her city and country of residence; (g) email address and, if available, phone numbers; (h) education (primary, secondary, higher or none); (i) current occupation (job group); where the application is subject to the manual processing in accordance with the procedure laid down in Article 26, the Member State responsible may in accordance with Article 27 request that the applicant provide additional information concerning his or her exact job title and employer or, for students, the name of their educational establishment; (j) Member State of first intended stay, and optionally, the address of first intended stay; (k) for minors, surname and first name(s), home address, email address and, if available, phone number of the person exercising parental authority or of the applicant’s legal guardian; (l) where he or she claims the status of family member referred to in point (c) of Article 2(1): (i) his or her status of family member; (ii) the surname, first name(s), date of birth, place of birth, country of birth, current nationality, home address, email address and, if available, phone number of the family member with whom the applicant has family ties; (iii) his or her family ties with that family member in accordance with Article 2(2) of Directive 2004/38/EC; (m) in the case of applications filled in by a person other than the applicant, the surname, first name(s), name of firm, organisation if applicable, email address, mailing address and phone number if available of that person; relationship to the applicant and a signed representation declaration.

3. The applicant shall choose his or her current occupation (job group) from a predetermined list. The Commission shall adopt delegated acts in accordance with Article 89 to lay down this predetermined list.

4. In addition, the applicant shall provide answers to the following questions: ▼M2 (a) whether he or she has been convicted in the previous 25 years of a terrorist offence or in the previous 15 years of any other criminal offence listed in the Annex, and if so when and in which country; ▼B (b) whether he or she has stayed in a specific war or conflict zone over the previous 10 years and the reasons for the stay; (c) whether he or she has been the subject of any decision requiring him or her to leave the territory of a Member State or of any third countries listed in Annex II to Regulation (EC) No 539/2001 or whether he or she was subject to any return decision issued over the previous 10 years.

5. The Commission shall adopt delegated acts in accordance with Article 89 specifying the content and format of the questions referred to in paragraph 4 of this Article. The content and format of those questions shall enable applicants to give clear and precise answers.

6. Where the applicant answers affirmatively to any of the questions referred to in paragraph 4, he or she shall be required to provide answers to an additional set of predetermined questions on the application form by selecting from a predetermined list of answers. The Commission shall adopt delegated acts in accordance with Article 89 to lay down the content and format of those additional questions and the predetermined list of answers to those questions.

7. The data referred to in paragraphs 2 and 4 shall be introduced by the applicant in Latin alphabet characters.

8. On submission of the application form, the ETIAS Information System shall collect the IP address from which the application form was submitted.

9. The Commission shall, by means of implementing acts, define the requirements concerning the format of the personal data referred to in paragraphs 2 and 4 of this Article to be inserted in the application form as well as parameters and verifications to be implemented for ensuring the completeness of the application and the coherence of those data. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 90(2).

Article 18

Travel authorisation fee

1. A travel authorisation fee of EUR 7 shall be paid by the applicant for each application.

2. The travel authorisation fee shall be waived for applicants under 18 years or above 70 years of age at the time of the application.

3. The travel authorisation fee shall be charged in euros.

4. The Commission shall adopt delegated acts in accordance with Article 89 on the payment methods and process for the travel authorisation fee and on changes to the amount of that fee. Changes to the amount shall take into account any increase in the costs referred to in Article 85.







CHAPTER III

CREATION OF THE APPLICATION FILE AND EXAMINATION OF THE APPLICATION BY THE ETIAS CENTRAL SYSTEM

Article 19

Admissibility and creation of the application file

1. The ETIAS Information System shall automatically verify whether, following submission of an application: (a) all the fields of the application form are filled in and contain all the items referred to in Article 17(2) and (4); (b) the travel authorisation fee has been collected.

2. If the conditions in points (a) and (b) of paragraph 1 are met, the application shall be deemed admissible. The ETIAS Central System shall then automatically create an application file without delay and assign it an application number.

3. Upon creation of the application file, the ETIAS Central System shall record and store the following data: (a) the application number; (b) status information, indicating that a travel authorisation has been requested; (c) the personal data referred to in Article 17(2) and, where applicable, Article 17(4) and (6), including the three-letter code of the country issuing the travel document; (d) the data referred to in Article 17(8); (e) the date and the time the application form was submitted as well as a reference to the successful payment of the travel authorisation fee and the unique reference number of the payment.

4. ►M1 ◄ with the personal data of the application files stored in the ETIAS Central System. In such a case, the ETIAS Central System shall link the new application file to any previous existing application file created for the same applicant. Upon creation of the application file, the ETIAS Central System shall determine whether the applicant already has another application file in the ETIAS Central System by comparing the data referred to inpoints (a) and (aa) of Article 17(2)with the personal data of the application files stored in the ETIAS Central System. In such a case, the ETIAS Central System shall link the new application file to any previous existing application file created for the same applicant.

5. Upon creation of the application file, the applicant shall immediately receive a notification via the email service explaining that, during the processing of the application, the applicant may be asked to provide additional information or documentation or, in exceptional circumstances, attend an interview. This notification shall include: (a) status information, acknowledging the submission of an application for travel authorisation; and (b) the application number.

The notification shall enable the applicant to make use of the verification tool provided for in point (h) of Article 6(2).

Article 20

Automated processing

1. The application files shall be automatically processed by the ETIAS Central System to identify hit(s). The ETIAS Central System shall examine each application file individually.

▼M2

2. The ETIAS Central System shall launch a query by using the ESP to compare the relevant data referred to in points (a), (aa), (b), (c), (d), (f), (g), (j), (k) and (m) of Article 17(2) and in Article 17(8) to the data present in a record, file or alert registered in an application file stored in the ETIAS Central System, SIS, the EES, the VIS, Eurodac, ECRIS-TCN, Europol data and in the Interpol SLTD and TDAWN databases. In particular, the ETIAS Central System shall verify: (a) whether the travel document used for the application corresponds to a travel document reported lost, stolen, misappropriated or invalidated in SIS; (b) whether the travel document used for the application corresponds to a travel document reported lost, stolen or invalidated in the SLTD; (c) whether the applicant is subject to a refusal of entry and stay alert entered in SIS; (d) whether the applicant is subject to an alert in respect of persons wanted for arrest for surrender purposes on the basis of a European Arrest Warrant or wanted for arrest for extradition purposes in SIS; (e) whether the applicant and the travel document correspond to a refused, revoked or annulled travel authorisation in the ETIAS Central System; (f) whether the data provided in the application concerning the travel document correspond to another application for travel authorisation associated with different identity data referred to in point (a) of Article 17(2) in the ETIAS Central System; (g) whether the applicant is currently reported as an overstayer or whether he or she has been reported as an overstayer in the past in the EES; (h) whether the applicant is recorded as having been refused entry in the EES; (i) whether the applicant has been subject to a decision to refuse, annul or revoke a short stay visa recorded in VIS; (j) whether the data provided in the application correspond to data recorded in Europol data; (k) whether the applicant is registered in Eurodac; (l) whether the travel document used for the application corresponds to a travel document recorded in a file in TDAWN; (m) in cases where the applicant is a minor, whether the applicant’s parental authority or legal guardian: (i) is subject to an alert in respect of persons wanted for arrest for surrender purposes on the basis of a European Arrest Warrant or wanted for arrest for extradition purposes in SIS; (ii) is subject to a refusal of entry and stay alert entered in SIS; (n) whether the applicant corresponds to a person whose data has been recorded in ECRIS-TCN and flagged in accordance with point (c) of Article 5(1) of Regulation (EU) 2019/816; those data shall be used only for the purpose of the verification by the ETIAS Central Unit pursuant to Article 22 of this Regulation and for the purpose of the consultation of the national criminal records by the ETIAS National Units pursuant to Article 25a(2) of this Regulation; ETIAS National Units shall consult national criminal records prior to the assessments and decisions referred to in Article 26 of this Regulation and, where applicable, prior to the assessments and opinions pursuant to Article 28 of this Regulation; (o) whether the applicant is subject to an alert on return entered in SIS.

▼B

3. The ETIAS Central System shall verify whether the applicant has replied affirmatively to any of the questions listed in Article 17(4) and whether the applicant has not provided a home address but only his city and country of residence, as referred to in point (f) of Article 17(2).

4. ►M1 ◄ and in Article 17(8) to the data present in the ETIAS watchlist referred to in Article 34. The ETIAS Central System shall compare the relevant data referred to inpoints (a), (aa), (b), (c), (d), (f), (g), (j), (k) and (m) of Article 17(2)and in Article 17(8) to the data present in the ETIAS watchlist referred to in Article 34.

5. ►M1 ◄ to the specific risk indicators referred to in Article 33. The ETIAS Central System shall compare the relevant data referred to inpoints (a), (aa), (c), (f), (h) and (i) of Article 17(2)to the specific risk indicators referred to in Article 33.

6. The ETIAS Central System shall add a reference to any hit obtained pursuant to paragraphs 2 to 5 to the application file.

7. Where the data recorded in the application file correspond to the data triggering a hit pursuant to paragraphs 2 and 4, the ETIAS Central System shall identify, where relevant, the Member State(s) that entered or supplied the data having triggered the hit and shall record this in the application file.

8. Following any hit pursuant to paragraph 2(j) and paragraph 4 and where no Member State had supplied the data having triggered the hit, the ETIAS Central System shall identify whether Europol entered the data and shall record this in the application file.

Article 21

Results of the automated processing

1. Where the automated processing laid down in Article 20(2) to (5) does not report any hit, the ETIAS Central System shall automatically issue a travel authorisation in accordance with Article 36 and shall notify the applicant in accordance with Article 38.

2. Where the automated processing laid down in Article 20(2) to (5) reports one or several hits, the application shall be processed in accordance with the procedure laid down in Article 22.

3. Where verification under Article 22 confirms that the data recorded in the application file correspond to the data triggering a hit during the automated processing pursuant to Article 20(2) to (5) or where doubts remain concerning the identity of the applicant following such verification, the application shall be processed in accordance with the procedure laid down in Article 26.

4. Where automated processing under Article 20(3) reports that the applicant has replied affirmatively to any of the questions listed in Article 17(4), and if there is no other hit, the application shall be sent to the ETIAS National Unit of the Member State responsible, for manual processing as set out in Article 26.

Article 22

Verification by the ETIAS Central Unit

1. Where the automated processing pursuant to Article 20(2) to (5) reports one or several hits the ETIAS Central System shall automatically consult the ETIAS Central Unit.

▼M2

2. When consulted, the ETIAS Central Unit shall have access to the application file and any linked application files, as well as to all the hits triggered during automated verifications pursuant to Article 20(2), (3) and (5) and to the information identified by the ETIAS Central System under Article 20(7) and (8).

▼B

3. The ETIAS Central Unit shall verify whether the data recorded in the application file correspond to one or more of the following: (a) the specific risk indicators referred to in Article 33; ▼M2 (b) the data present in the ETIAS Central System; ▼B (c) the data present in one of the EU information systems that are consulted; (d) Europol data; (e) the data present in the Interpol SLTD or TDAWN databases.

4. Where the data do not correspond, and no other hit has been reported during automated processing pursuant to Article 20(2) to (5), the ETIAS Central Unit shall delete the false hit from the application file and the ETIAS Central System shall automatically issue a travel authorisation in accordance with Article 36.

▼M2

5. Where the data correspond to those of the applicant, where doubts remain concerning the identity of the applicant or where the automated verifications pursuant to Article 20(4) have reported a hit, the application shall be processed manually in accordance with the procedure laid down in Article 26.

▼B

6. The ETIAS Central Unit shall complete the manual processing within a maximum of 12 hours from receipt of the application file.

▼M2

7. The ETIAS Information System shall keep records of all data processing operations carried out by the ETIAS Central Unit for the purpose of verification under paragraphs 2 to 6. Those records shall be created and entered automatically in the application file. They shall show the date and time of each operation, the data linked to the hit reported, the staff member having performed the manual processing under paragraphs 2 to 6 and the outcome of the verification and the corresponding justification.

▼B

Article 23

Support of the objectives of SIS

▼M1

1. The ETIAS Central System shall launch a query by using the ESP to compare the relevant data referred to in points (a), (aa), (b) and (d) of Article 17(2) to the data present in SIS in order to determine whether the applicant is the subject of one of the following alerts: (a) an alert on missing persons; (b) an alert on persons sought to assist with a judicial procedure; ▼M2 (c) an alert on persons for discreet checks, inquiry checks or specific checks.

2. Where the comparison referred to in paragraph 1 reports one or several hits, the ETIAS Central System shall send an automated notification to the ETIAS Central Unit. When notified, the ETIAS Central Unit shall have access in accordance with Article 11(8) to the application file and any linked application files in order to verify whether the applicant’s personal data correspond to the personal data contained in the alert having triggered that hit and if a correspondence is confirmed, the ETIAS Central System shall send an automated notification to the SIRENE Bureau of the Member State that entered the alert. The SIRENE Bureau concerned shall further verify whether the applicant’s personal data correspond to the personal data contained in the alert having triggered the hit and take any appropriate follow-up action.

▼B

The ETIAS Central System shall also send an automated notification to the SIRENE Bureau of the Member State that entered the alert having triggered a hit against SIS during the automated processing referred to in Article 20 where, following verification by the ETIAS Central Unit as referred to in Article 22, that alert has led to manual processing of the application in accordance with Article 26.

▼M2

When the hit concerns an alert on return, the SIRENE Bureau of the issuing Member State shall verify, in cooperation with its ETIAS National Unit, whether the deletion of the alert on return in accordance with Article 14(1) of Regulation (EU) 2018/1860 and the entry of an alert for refusal of entry and stay in accordance with Article 24(3) of Regulation (EU) 2018/1861 is required.

▼B

3. The notification provided to the SIRENE Bureau of the Member State that entered the alert shall contain the following data: (a) surname(s), first name(s) and, if any, alias(es); (b) place and date of birth; (c) sex; (d) nationality and, if any, other nationalities; (e) Member State of first intended stay, and if available, the address of first intended stay; (f) the applicant’s home address or, if not available, his or her city and country of residence; (g) travel authorisation status information, indicating whether a travel authorisation has been issued, refused or whether the application is subject to manual processing pursuant to Article 26; (h) a reference to any hits obtained in accordance with paragraphs 1 and 2, including the date and time of the hit.

▼M2

4. The ETIAS Central System shall add a reference to any hit reported pursuant to paragraph 1 to the application file. That reference shall only be visible to and accessible by the ETIAS Central Unit and the SIRENE Bureau notified in accordance with paragraph 3, unless other limitations are provided for in this Regulation.

▼B

Article 24

Specific rules for family members of Union citizens or of other third-country nationals enjoying the right of free movement under Union law

1. For third-country nationals referred to in point (c) of Article 2(1), the travel authorisation as defined in point 5 of Article 3(1) shall be understood as a decision issued in accordance with this Regulation indicating that there are no factual indications or reasonable grounds based on factual indications to conclude that the presence of the person on the territory of the Member States poses a security or high epidemic risk in accordance with Directive 2004/38/EC.

2. When a third-country national referred to in point (c) of Article 2(1) applies for a travel authorisation, the following specific rules shall apply: (a) the applicant shall not reply to the question referred to in point (c) of Article 17(4); (b) the fee referred to in Article 18 shall be waived.

3. When processing an application for a travel authorisation for a third-country national referred to in point (c) of Article 2(1), the ETIAS Central System shall not verify whether: (a) the applicant is currently reported as an overstayer or whether he or she has been reported as an overstayer in the past through consultation of the EES as referred to in point (g) of Article 20(2); (b) the applicant corresponds to a person whose data is recorded in Eurodac as referred to in point (k) of Article 20(2).

The specific risk indicators based on illegal immigration risks determined pursuant to Article 33 shall not apply.

4. An application for a travel authorisation shall not be refused on the ground of an illegal immigration risk as referred to in point (c) of Article 37(1).

5. Where automated processing under Article 20 has reported a hit corresponding to a refusal of entry and stay alert referred to in Article 24 of Regulation (EC) No 1987/2006 of the European Parliament and of the Council ( 15 ), the ETIAS National Unit shall verify the basis for the decision following which this alert was entered in SIS. If this basis is related to an illegal immigration risk, the alert shall not be taken into consideration for the assessment of the application. The ETIAS National Unit shall proceed according to Article 25(2) of the Regulation (EC) No 1987/2006.

6. The following rules shall also apply: (a) in the notification laid down in Article 38(1) the applicant shall receive information regarding the fact that, when crossing the external border, he or she needs to be able to prove his or her status as family member referred to in point (c) of Article 2(1); such information shall also include a reminder that the family member of a citizen exercising the right of free movement who is in possession of a travel authorisation only has a right to enter if that family member is accompanied by or joining the Union citizen or other third-country national exercising his or her right of free movement; (b) an appeal as referred to in Article 37(3) shall be lodged in accordance with Directive 2004/38/EC; (c) the retention period of the application file referred to in Article 54(1) shall be: (i) the period of validity of the travel authorisation; (ii) five years from the last decision to refuse, annul or revoke the travel authorisation in accordance with Articles 37, 40 and 41. If the data present in a record, file or alert registered in one of the EU information systems, Europol data, the Interpol SLTD or TDAWN databases, the ETIAS watchlist, or the ETIAS screening rules giving rise to such a decision are deleted before the end of that five-year period, the application file shall be deleted within seven days from the date of the deletion of the data in that record, file or alert. For that purpose, the ETIAS Central System shall regularly and automatically verify whether the conditions for the retention of application files referred to in this point are still fulfilled. Where they are no longer fulfilled, it shall delete the application file in an automated manner.

For the purpose of facilitating a new application after the expiry of the validity period of an ETIAS travel authorisation, the application file may be stored in the ETIAS Central System for an additional period of no more than three years after the end of the validity period of the travel authorisation and only where, following a request for consent, the applicant freely and explicitly consents by means of an electronically signed declaration. Requests for consent shall be presented in a manner which is clearly distinguishable from other matters, in an intelligible and easily accessible form and using clear and plain language, in accordance with Article 7 of Regulation (EU) 2016/679.

Consent shall be requested following the provision of information under Article 15(2). The automatically provided information shall remind the applicant of the purpose of the data retention in line with the information referred to in point (o) of Article 71.







CHAPTER IV

EXAMINATION OF THE APPLICATION BY THE ETIAS NATIONAL UNITS

Article 25

Member State responsible

1. The Member State responsible for the manual processing of applications under Article 26 (the ‘Member State responsible’) shall be identified by the ETIAS Central System as follows: (a) where only one Member State is identified as having entered or supplied the data that triggered the hit pursuant to Article 20, that Member State shall be the Member State responsible; (b) where several Member States are identified as having entered or supplied the data that triggered the hits pursuant to Article 20, the Member State responsible shall be: (i) the Member State that has entered or supplied the most recent data on an alert referred to in point (d) of Article 20(2); or (ii) if none of those data correspond to an alert referred to in point (d) of Article 20(2), the Member State that has entered or supplied the most recent data on an alert referred to in point (c) of Article 20(2); or (iii) if none of those data correspond to an alert referred to in either point (c) or (d) of Article 20(2), the Member State that has entered or supplied the most recent data on an alert referred to in point (a) of Article 20(2); (c) where several Member States are identified as having entered or supplied the data that triggered the hits pursuant to Article 20, but none of those data correspond to alerts referred to in point (a), (c) or (d) of Article 20(2), the Member State responsible shall be the one that entered or supplied the most recent data.

For the purposes of points (a) and (c) of the first subparagraph, hits triggered by data not entered or supplied by a Member State shall not be taken into account in order to identify the Member State responsible. Where the manual processing of an application is not triggered by data entered or supplied by a Member State, the Member State responsible shall be the Member State of first intended stay.

2. The ETIAS Central System shall indicate the Member State responsible in the application file. Where the ETIAS Central System is not able to identify the Member State responsible as referred to in paragraph 1, the ETIAS Central Unit shall identify it.

▼M2

Article 25a

Use of other EU information systems for the manual processing of applications by the ETIAS National Units

1. Without prejudice to Article 13(1), the duly authorised staff of the ETIAS National Units shall have direct access to and may consult, in a read-only format, the other EU information systems for the purposes of examining applications for travel authorisation and adopting decisions relating to those applications in accordance with Article 26. The ETIAS National Units may consult: (a) the data referred to in Articles 16, 17 and 18 of Regulation (EU) 2017/2226; (b) the data referred to in Articles 9 to 14 of Regulation (EC) No 767/2008; (c) the data referred to in Article 20 of Regulation (EU) 2018/1861 processed for the purposes of Articles 24, 25 and 26 of that Regulation; (d) the data referred to in Article 20 of Regulation (EU) 2018/1862 processed for the purposes of Article 26 and points (k) and (l) of Article 38(2) of that Regulation; (e) the data referred to in Article 4 of Regulation (EU) 2018/1860 processed for the purposes of Article 3 of that Regulation.

2. Insofar as a hit results from the verification pursuant to point (n) of Article 20(2), the duly authorised staff of the ETIAS National Units shall also have access, directly or indirectly, in accordance with national law, to the relevant data from the national criminal records of their own Member State in order to obtain information on third-country nationals, as defined in Regulation (EU) 2019/816, convicted of a terrorist offence or any other criminal offence listed in the Annex to this Regulation, for the purposes referred to in paragraph 1 of this Article.

▼B

Article 26

Manual processing of applications by the ETIAS National Units

1. Where the automated processing laid down in Article 20(2) to (5) has reported one or several hits, the application shall be processed manually by the ETIAS National Unit of the Member State responsible. That ETIAS National Unit shall have access to the application file and any linked application files, as well as to any hits triggered during the automated processing laid down in Article 20(2) to (5). The ETIAS Central Unit shall inform the ETIAS National Unit of the Member State responsible whether one or several other Member States or Europol were identified as having entered or supplied the data that triggered the hit pursuant to Article 20(2) or (4). Where one or several Member States have been identified as having entered or supplied the data that triggered such a hit, the ETIAS Central Unit shall also specify the Member States concerned.

2. Following the manual processing of the application, the ETIAS National Unit of the Member State responsible shall: (a) issue a travel authorisation; or (b) refuse a travel authorisation.

3. Where the automated processing laid down in Article 20(2) has reported a hit, the ETIAS National Unit of the Member State responsible shall: (a) refuse a travel authorisation where the hit corresponds to one or several of the verifications referred to in points (a) and (c) of Article 20(2); ▼M2 (b) assess the security or illegal immigration risk and decide whether to issue or refuse a travel authorisation where the hit corresponds to any of the verifications referred to in points (b) and (d) to (o) of Article 20(2).

▼M2

3a. Where the automated processing under point (o) of Article 20(2) has reported a hit, the ETIAS National Unit of the Member State responsible shall: (a) refuse the applicant’s travel authorisation where the verification under the third subparagraph of Article 23(2) led to the deletion of the alert on return and the entry of an alert for refusal of entry and stay; (b) assess the security or illegal immigration risk and decide whether to issue or refuse a travel authorisation in all other cases.

The ETIAS National Unit of the Member State having entered the data shall consult its SIRENE Bureau to verify whether the deletion of the alert on return in accordance with Article 14(1) of Regulation (EU) 2018/1860 and, where applicable, the entry of an alert for refusal of entry and stay in accordance with Article 24(3) of Regulation (EU) 2018/1861 is required.

▼B

4. Where automated processing under Article 20(3) has reported that the applicant replied affirmatively to one of the questions referred to in Article 17(4), the ETIAS National Unit of the Member State responsible shall assess the security or illegal immigration risk and decide whether to issue or refuse a travel authorisation.

▼M2

Where the automated processing under point (n) of Article 20(2) has reported a hit, but has not reported a hit under point (c) of that paragraph, the ETIAS National Unit of the Member State responsible shall give particular consideration to the absence of such a hit in its assessment of the security risk in order to decide whether to issue or refuse a travel authorisation.

▼B

5. Where automated processing under Article 20(4) has reported a hit, the ETIAS National Unit of the Member State responsible shall assess the security risk and decide whether to issue or refuse a travel authorisation.

6. Where automated processing under Article 20(5) has reported a hit, the ETIAS National Unit of the Member State responsible shall assess the security, illegal immigration or high epidemic risk and decide whether to issue or refuse a travel authorisation. In no circumstances may the ETIAS National Unit of the Member State responsible take a decision automatically on the basis of a hit based on specific risk indicators. The ETIAS National Unit of the Member State responsible shall individually assess the security, illegal immigration and high epidemic risks in all cases.

7. The ETIAS Information System shall keep records of all data processing operations carried out for assessments under this Article by the ETIAS National Unit of the Member State responsible or by the ETIAS National Units of the Member States consulted in accordance with Article 28. Those records shall be created and entered automatically in the application file. They shall show the date and time of each operation, the data used for consultation of other EU information systems, the data linked to the hit received and the staff member having performed the risk assessment.

The results of the assessment of the security, illegal immigration or high epidemic risk and the justification behind the decision to issue or refuse a travel authorisation shall be recorded in the application file by the staff member having performed the risk assessment.

Article 27

Request for additional information or documentation from the applicant

1. Where the ETIAS National Unit of the Member State responsible deems the information provided by the applicant in the application form to be insufficient to enable it to decide whether to issue or refuse a travel authorisation, it may request additional information or documentation from the applicant. The ETIAS National Unit of the Member State responsible shall request additional information or documentation upon the request of a Member State consulted in accordance with Article 28.

2. The request for additional information or documentation shall be notified through the email service referred to in point (f) of Article 6(2) to the contact email address recorded in the application file. The request for additional information or documentation shall clearly indicate the information or documentation that the applicant is required to provide, as well as a list of the languages in which the information or documentation may be submitted. That list shall include at least English or French or German unless it includes an official language of the third country of which the applicant has declared to be a national. Where additional documentation is requested, an electronic copy of the original documentation shall also be requested. The applicant shall provide the additional information or documentation directly to the ETIAS National Unit of the Member State responsible through the secure account service referred to in point (g) of Article 6(2) within 10 days of the date of receipt of the request. The applicant shall provide such information or documentation in one of the languages notified in the request. The applicant shall not be required to provide an official translation. Only additional information or documentation necessary for the assessment of the ETIAS application may be requested.

3. For the purpose of requesting additional information or documentation as referred to in paragraph 1, the ETIAS National Unit of the Member State responsible shall use a predetermined list of options. The Commission shall adopt delegated acts in accordance with Article 89 to lay down the content and format of that predetermined list of options.

4. In exceptional circumstances and as a last resort after processing the additional information or documentation, when serious doubts remain regarding the information or documentation provided by the applicant, the ETIAS National Unit of the Member State responsible may invite the applicant to an interview in his or her country of residence at its consulate located the nearest to the place of residence of the applicant. Exceptionally and when in the interest of the applicant, the interview may take place in a consulate located in a different country than the country of residence of the applicant.

If the consulate located the nearest to the place of residence of the applicant is at a distance of more than 500 km, the applicant shall be offered the possibility to conduct the interview by remote means of audio and video communication. If the distance is less than 500 km, the applicant and the ETIAS National Unit of the Member State responsible may jointly agree to the use of such means of audio and video communication. Where such means of audio and video communication are used, the interview shall be conducted by the ETIAS National Unit of the Member State responsible or, exceptionally, by one of that Member State’s consulates. The remote means of audio and video communication shall ensure an appropriate level of security and confidentiality.

The reason for requesting an interview shall be recorded in the application file.

5. The Commission shall, by means of implementing acts, define the requirements for the means of audio and video communication referred to in paragraph 4, including as regards data protection, security and confidentiality rules and adopt rules on testing and selecting suitable tools and on their operation.

Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 90(2).

6. The invitation to an interview shall be issued to the applicant by the ETIAS National Unit of the Member State responsible through the email service referred to in point (f) of Article 6(2) to the contact email address recorded in the application file. The invitation to the interview shall be issued within 72 hours of the applicant’s submission of additional information or documentation pursuant to paragraph 2 of this Article. The invitation to the interview shall include information on the Member State issuing the invitation, on the options referred to in paragraph 4 of this Article and relevant contact details. The applicant shall contact the ETIAS National Unit of the Member State responsible or the consulate as soon as possible, but no later than five days after the invitation to the interview was issued, to agree on a mutually suitable time and date for the interview and on whether the interview shall take place remotely. The interview shall take place within 10 days of the date of the invitation.

The invitation to the interview shall be recorded in the application file by the ETIAS Central System.

7. Where the applicant fails to attend the interview in accordance with paragraph 6 of this Article following an invitation to the interview, the application shall be refused in accordance with point (g) of Article 37(1). The ETIAS National Unit of the Member State responsible shall inform the applicant without delay.

8. For the purpose of the interview referred to in paragraph 4, the ETIAS National Unit of the Member State responsible shall indicate the elements to be addressed by the interviewer. Those elements shall relate to the reasons for which the interview was requested.

The interview by remote means of audio and video communication shall be conducted in the language of the ETIAS National Unit of the Member State responsible requesting the interview or its chosen language for the submission of additional information or documentation.

The interview taking place in a consulate shall be conducted in an official language of the third country in which the consulate is located, or any other language agreed by the applicant and the consulate.

Following the interview, the interviewer shall issue an opinion which provides justifications for his or her recommendations.

The elements addressed and the opinion shall be included in a form to be recorded in the application file on the same day as the date of the interview.

9. Upon the applicant’s submission of additional information or documentation in accordance with paragraph 2, the ETIAS Central System shall record and store that information or documentation in the application file. Additional information or documentation provided during an interview in accordance with paragraph 6 shall be added to the application file by the ETIAS National Unit of the Member State responsible.

The form used for the interview and the additional information or documentation recorded in the application file shall be consulted only for the purpose of assessing and deciding on the application, for the purpose of managing an appeal procedure and for the purpose of processing a new application by the same applicant.

10. The ETIAS National Unit of the Member State responsible shall resume the examination of the application from the moment the applicant provides the additional information or documentation or, where applicable, from the date of the interview.

Article 28

Consultation of other Member States

1. Where one or several Member States are identified as having entered or supplied the data having triggered a hit in accordance with Article 20(7) following verification under Article 22, the ETIAS Central Unit shall notify the ETIAS National Unit of the Member State(s) involved, thereby launching a consultation process between them and the ETIAS National Unit of the Member State responsible.

2. The ETIAS National Units of the Member States consulted shall have access to the application file for the purpose of the consultation.

3. The ETIAS National Unit of the Member States consulted shall: (a) provide a reasoned positive opinion on the application; or (b) provide a reasoned negative opinion on the application.

The positive or negative opinion shall be recorded in the application file by the ETIAS National Unit of the Member State consulted.

▼M2

For the purpose of the manual processing pursuant to Article 26, the reasoned positive or negative opinion shall only be visible by the ETIAS National Unit of the Member State consulted and by the ETIAS National Unit of the Member State responsible.

▼B

4. The ETIAS National Unit of the Member State responsible may also consult the ETIAS National Units of one or several Member States following the reply of an applicant to a request for additional information. Where such additional information was requested on behalf of a Member State consulted pursuant to Article 27(1), the ETIAS National Unit of the Member State responsible shall consult the ETIAS National Unit of the consulted Member State following the reply of the applicant to that request for additional information. In such cases, the ETIAS National Units of the Member States consulted shall also have access to the relevant additional information or documentation provided by the applicant following a request from the ETIAS National Unit of the Member State responsible in relation to the matter for which they are being consulted. Where several Member States are consulted, the ETIAS National Unit of the Member State responsible shall ensure the coordination.

5. The ETIAS National Unit of the Member States consulted shall reply within 60 hours of the notification of the consultation. A failure to reply within the deadline shall be considered to be a positive opinion on the application.

6. During the consultation process, the consultation request and the replies thereto shall be transmitted through the software referred to in point (m) of Article 6(2) and shall be made available to the ETIAS National Unit of the Member State responsible.

7. Where the ETIAS National Unit of at least one Member State consulted provides a negative opinion on the application, the ETIAS National Unit of the Member State responsible shall refuse the travel authorisation pursuant to Article 37. This paragraph is without prejudice to Article 44.

8. Where necessary in cases of technical problems or unforeseen circumstances, the ETIAS Central Unit shall determine the Member State responsible and Member States to be consulted and shall facilitate the consultations between Member States referred to in this Article.

Article 29

Consultation of Europol

1. Where Europol is identified as having supplied the data having triggered a hit in accordance with Article 20(8) of this Regulation, the ETIAS Central Unit shall notify it, thereby launching a consultation process between Europol and the ETIAS National Unit of the Member State responsible. Such consultation shall take place in accordance with Regulation (EU) 2016/794 and in particular its Chapter IV.

2. Where Europol is consulted, the ETIAS Central Unit shall transmit to Europol the relevant data of the application file and of the hits which are necessary for the purpose of the consultation.

3. In any case, Europol shall not have access to the personal data concerning the education of the applicant referred to in point (h) of Article 17(2).

4. Where consulted in accordance with paragraph 1, Europol shall provide a reasoned opinion on the application. Europol’s opinion shall be made available to the ETIAS National Unit of the Member State responsible which shall record it in the application file.

5. The ETIAS National Unit of the Member State responsible may consult Europol following the reply of an applicant to a request for additional information. In such cases, the ETIAS National Unit shall transmit to Europol the relevant additional information or documentation provided by the applicant relating to the request for a travel authorisation on which Europol is being consulted.

6. Europol shall reply within 60 hours of the notification of the consultation. The failure by Europol to reply within the deadline shall be considered to be a positive opinion on the application.

7. During the consultation process, the consultation request and the replies thereto shall be transmitted through the software referred to in point (m) of Article 6(2) and shall be made available to the ETIAS National Unit of the Member State responsible.

8. Where Europol provides a negative opinion on the application and the ETIAS National Unit of the Member State responsible decides to issue the travel authorisation, it shall justify its decision and shall record the justification in the application file.

9. Where necessary in cases of technical problems or unforeseen circumstances, the ETIAS Central Unit shall determine the Member State responsible and facilitate the consultations between the Member State responsible and Europol referred to in this Article.

Article 30

Deadlines for notification to the applicant

Within 96 hours of the submission of an application which is admissible in accordance with Article 19, the applicant shall receive a notification indicating:

(a) whether his or her travel authorisation has been issued or refused; or

(b) that additional information or documentation is requested and that the applicant may be invited to an interview, indicating the maximum processing times applicable under Article 32(2).

Article 31

Verification tool

The Commission shall arrange for a verification tool for applicants to check the status of their applications and to check the period of validity and status of their travel authorisations (valid, refused, annulled or revoked). This tool shall be made accessible via the dedicated public website or via the app for mobile devices referred to in Article 16.

The Commission shall adopt delegated acts in accordance with Article 89 to further define the verification tool.

Article 32

Decision on the application

1. Applications shall be decided on no later than 96 hours after the submission of an application which is admissible in accordance with Article 19.

2. Exceptionally, when a request for additional information or documentation is notified, and when the applicant is invited to an interview, the period laid down in paragraph 1 of this Article shall be extended. Such applications shall be decided on no later than 96 hours after the submission of the additional information or documentation by the applicant. When the applicant is invited to an interview as referred to in Article 27(4), the application shall be decided on no later than 48 hours after the interview has taken place.

3. Before expiry of the deadlines referred to in paragraphs 1 and 2 of this Article, a decision shall be taken to: (a) issue a travel authorisation in accordance with Article 36; or (b) refuse a travel authorisation in accordance with Article 37.







CHAPTER V

THE ETIAS SCREENING RULES AND THE ETIAS WATCHLIST

Article 33

The ETIAS screening rules

1. The ETIAS screening rules shall be an algorithm enabling profiling as defined in point 4 of Article 4 of Regulation (EU) 2016/679 through the comparison in accordance with Article 20 of this Regulation of the data recorded in an application file of the ETIAS Central System with specific risk indicators established by the ETIAS Central Unit under paragraph 4 of this Article pointing to security, illegal immigration or high epidemic risks. The ETIAS Central Unit shall register the ETIAS screening rules in the ETIAS Central System.

2. The Commission shall adopt a delegated act in accordance with Article 89 to further define the risks related to security or illegal immigration or a high epidemic risk on the basis of: (a) statistics generated by the EES indicating abnormal rates of overstaying and refusals of entry for a specific group of travellers; (b) statistics generated by ETIAS in accordance with Article 84 indicating abnormal rates of refusals of travel authorisations due to a security, illegal immigration or high epidemic risk associated with a specific group of travellers; (c) statistics generated by ETIAS in accordance with Article 84 and the EES indicating correlations between information collected through the application form and overstaying by travellers or refusals of entry; (d) information substantiated by factual and evidence-based elements provided by Member States concerning specific security risk indicators or threats identified by that Member State; (e) information substantiated by factual and evidence-based elements provided by Member States concerning abnormal rates of overstaying and refusals of entry for a specific group of travellers for that Member State; (f) information concerning specific high epidemic risks provided by Member States as well as epidemiological surveillance information and risk assessments provided by the ECDC and disease outbreaks reported by the WHO.

3. The Commission shall, by means of an implementing act, specify the risks, as defined in this Regulation and in the delegated act referred to in paragraph 2 of this Article, on which the specific risks indicators referred to in paragraph 4 of this Article shall be based. That implementing act shall be adopted in accordance with the examination procedure referred to in Article 90(2).

The specific risks shall be reviewed at least every six months and, where necessary, a new implementing act shall be adopted by the Commission in accordance with the examination procedure referred to in Article 90(2).

4. Based on the specific risks determined in accordance with paragraph 3, the ETIAS Central Unit shall establish a set of specific risk indicators consisting of a combination of data including one or several of the following: (a) age range, sex, nationality; (b) country and city of residence; (c) level of education (primary, secondary, higher or none); (d) current occupation (job group).

5. The specific risk indicators shall be targeted and proportionate. They shall in no circumstances be based solely on a person’s sex or age. They shall in no circumstances be based on information revealing a person’s colour, race, ethnic or social origin, genetic features, language, political or any other opinion, religion or philosophical belief, trade union membership, membership of a national minority, property, birth, disability or sexual orientation.

6. The specific risk indicators shall be defined, established, assessed ex ante , implemented, evaluated ex post , revised and deleted by the ETIAS Central Unit after consultation of the ETIAS Screening Board.

Article 34

The ETIAS watchlist

1. The ETIAS watchlist shall consist of data related to persons who are suspected of having committed or taken part in a terrorist offence or other serious criminal offence or persons regarding whom there are factual indications or reasonable grounds, based on an overall assessment of the person, to believe that they will commit a terrorist offence or other serious criminal offence. The ETIAS watchlist shall form part of th