REGULATION (EU) 2018/1240 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

of 12 September 2018

establishing a European Travel Information and Authorisation System (ETIAS) and amending Regulations (EU) No 1077/2011, (EU) No 515/2014, (EU) 2016/399, (EU) 2016/1624 and (EU) 2017/2226

THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Treaty of the Functioning of the European Union, and in particular points (b) and (d) of Article 77(2) and point (a) of Article 87(2) thereof,

Having regard to the proposal from the European Commission,

After transmission of the draft legislative act to the national parliaments,

Having regard to the opinion of the European Economic and Social Committee (1),

Acting in accordance with the ordinary legislative procedure (2),

Whereas:

(1) The Communication of the Commission of 6 April 2016 entitled ‘Stronger and Smarter Information Systems for Borders and Security’ outlined the need for the Union to strengthen and improve its IT systems, data architecture and information exchange in the area of border management, law enforcement and counter-terrorism. It emphasises the need to improve the interoperability of information systems. Importantly, it sets out possible options for maximising the benefits of existing information systems and, if necessary, developing new and complementary ones to address still existing information gaps.

(2) Indeed, the Communication of 6 April 2016 identified a series of information gaps. Among them are the fact that border authorities at external Schengen borders have no information on travellers exempt from the requirement of being in possession of a visa when crossing the external borders (‘the visa requirement’). The Communication of 6 April 2016 announced that the Commission was to launch a study on the feasibility of establishing a European Travel Information and Authorisation System (ETIAS). The feasibility study was completed in November 2016. The system would determine the eligibility of visa-exempt third-country nationals prior to their travel to the Schengen Area, and whether such travel poses a security, illegal immigration or high epidemic risk.

(3) The Communication of 14 September 2016‘Enhancing security in a world of mobility: improved information exchange in the fight against terrorism and stronger external borders’ confirms the priority of securing external borders and presents concrete initiatives to accelerate and broaden the Union’s response in continuing to strengthen the management of external borders.

(4) It is necessary to specify the objectives of ETIAS, to define its technical and organisational architecture, to lay down rules concerning the operation and the use of the data to be entered into the system by the applicant and rules on the issue or refusal of the travel authorisations, to lay down the purposes for which the data are to be processed, to identify the authorities authorised to access the data and to ensure the protection of personal data.

(5) ETIAS should apply to third-country nationals who are exempt from the visa requirement.

(6) It should also apply to third-country nationals who are exempt from the visa requirement who are family members of a Union citizen to whom Directive 2004/38/EC of the European Parliament and of the Council (3) applies or of a national of a third country enjoying the right of free movement equivalent to that of Union citizens under an agreement between the Union and its Member States on the one hand and a third country on the other and who do not hold a residence card pursuant to Directive 2004/38/EC or a residence permit pursuant to Council Regulation (EC) No 1030/2002 (4). Article 21(1) of the Treaty on the Functioning of the European Union (TFEU) stipulates that every citizen of the Union shall have the right to move and reside freely within the territory of the Member States, subject to the limitations and conditions laid down in the Treaties and by the measures adopted to give them effect. The respective limitations and conditions are to be found in Directive 2004/38/EC.

(7) As confirmed by the Court of Justice (5), such family members have the right to enter the territory of the Member States and to obtain an entry visa for that purpose. Consequently, family members exempted from the visa obligation should have the right to obtain a travel authorisation. Member States should grant such persons every facility to obtain the necessary travel authorisation, which should be issued free of charge.

(8) The right to obtain a travel authorisation is not unconditional as it can be denied to those family members who represent a risk to public policy, public security or public health pursuant to Directive 2004/38/EC. Against this background, family members can be required to provide their personal data related to their identification and their status only insofar as these are relevant for assessment of the security threat they could represent. Similarly, examination of their travel authorisation applications should be made exclusively against security concerns, and not those related to migration risks.

(9) ETIAS should provide a travel authorisation for third-country nationals exempt from the visa requirement enabling consideration of whether their presence on the territory of the Member States does not pose or will not pose a security, illegal immigration or a high epidemic risk. A travel authorisation should therefore constitute a decision indicating that there are no factual indications or reasonable grounds to consider that the presence of a person on the territory of the Member States poses such risks. As such, a travel authorisation is by its nature distinct from a visa; it will not require more information or place a heavier burden on applicants than a visa does. Holding a valid travel authorisation should be a new entry condition for the territory of the Member States. Mere possession of a travel authorisation should not, however, confer an automatic right of entry.

(10) ETIAS should contribute to a high level of security, to the prevention of illegal immigration and to the protection of public health by providing an assessment of visitors prior to their arrival at the external border crossing points.

(11) ETIAS should contribute to the facilitation of border checks performed by border guards at the external border crossing points. It should also ensure a coordinated and harmonised assessment of third-country nationals subject to the travel authorisation requirement who intend to travel to Member States. Furthermore, it should enable applicants to be better informed of their eligibility to travel to Member States. In addition, ETIAS should contribute to the facilitation of border checks by reducing the number of refusals of entry at the external borders and by providing border guards with certain additional information related to flags.

(12) ETIAS should also support the objectives of the Schengen Information System (SIS) related to alerts on third-country nationals subject to a refusal of entry and stay, on persons wanted for arrest for surrender purposes or extradition purposes, on missing persons, on persons sought to assist with a judicial procedure and on persons for discreet checks or specific checks. For this purpose, ETIAS should compare relevant data from application files against relevant alerts in SIS. Where the comparison reveals a correspondence between personal data in the application file and alerts on third-country nationals subject to a refusal of entry and stay or on persons wanted for arrest for surrender purposes or extradition purposes, the application file should be processed manually by the ETIAS National Unit of the Member State responsible. The assessment performed by the ETIAS National Unit should lead to a decision whether to issue a travel authorisation or not. Where the comparison reveals a correspondence between personal data in the application file and alerts on missing persons, on persons sought to assist with a judicial procedure and on persons for discreet checks or specific checks, this information should be transferred to the SIRENE bureau and should be dealt with in accordance with the relevant legislation relating to SIS.

(13) The conditions for issuing a travel authorisation should be coherent with the specific objectives associated with the different types of alerts recorded in SIS. In particular, the fact that applicants would be subject to an alert on persons wanted for arrest for surrender purposes or extradition purposes or to an alert on persons for discreet checks or specific checks should not prevent them from being issued with a travel authorisation with a view to Member States taking appropriate action in accordance with Council Decision 2007/533/JHA (6).

(14) ETIAS should consist of a large-scale information system, the ETIAS Information System, the ETIAS Central Unit and the ETIAS National Units.

(15) The ETIAS Central Unit should be part of the European Border and Coast Guard Agency. The ETIAS Central Unit should be responsible for verifying, in cases where the automated application process has reported a hit, whether the applicant’s personal data correspond to the personal data of the person having triggered that hit. Where a hit is confirmed or where doubts remain, the ETIAS Central Unit should initiate the manual processing of the application. It should ensure that the data it enters in the applications files are up to date and define, establish, assess ex ante, implement, evaluate ex post, revise and delete the specific risk indicators, ensuring that the verifications that are performed and their results are recorded in the application files. It should also carry out regular audits of the processing of applications and of the implementation of the ETIAS screening rules, including by regularly assessing their impact on fundamental rights, in particular with regard to privacy and personal data protection. It should furthermore be responsible for fulfilling a number of support tasks such as ensuring the necessary notifications are sent and providing information and support. It should be operational 24 hours a day, 7 days a week.

(16) Each Member State should establish an ETIAS National Unit responsible for examining applications and deciding whether to issue or refuse, annul or revoke travel authorisations. The ETIAS National Units should cooperate with each other and with the European Union Agency for Law Enforcement Cooperation (Europol) for the purpose of assessing applications. The ETIAS National Units should be provided with adequate resources to fulfil their tasks in accordance with the deadlines set out in this Regulation. In order to facilitate the decision-making process and the exchange of information between Member States and to reduce translation costs and response times, it is preferable that all ETIAS National Units communicate in a single language.

(17) To meet its objectives, ETIAS should provide an online application form that the applicant should fill in with declarations relating to his or her identity, travel document, residence information, contact details, level of education and job group, any status he or she holds of family member to Union citizens or third-country nationals enjoying the right of free movement and not holding a residence card pursuant to Directive 2004/38/EC or a residence permit pursuant to Regulation (EC) No 1030/2002, where the applicant is minor, details of the person responsible for him or her, and answers to a set of background questions.

(18) ETIAS should accept applications introduced on behalf of the applicant for travellers who are themselves not in a position to create an application, for whatever reason. In such cases, the application should be submitted by a third party authorised by the traveller or legally responsible for him or her, provided this person’s identity is included in the application form. It should be possible for travellers to authorise commercial intermediaries to create and submit an application on their behalf. The ETIAS Central Unit should act upon any reports of abuses by commercial intermediaries appropriately.

(19) Parameters for ensuring the completeness of an application and the coherence of the data submitted should be established to verify the admissibility of applications for a travel authorisation. For instance, such verification should preclude the use of travel documents which will expire in less than three months, have expired or were issued more than 10 years previously. The verification should be undertaken before the applicant is invited to pay the fee.

(20) In order to finalise the application, applicants should be required to pay a travel authorisation fee. The payment should be managed by a bank or a financial intermediary. The data required for securing the electronic payment should only be provided to the bank or financial intermediary operating the financial transaction and not form part of data stored in ETIAS.

(21) Most of the travel authorisations should be issued within minutes, though a reduced number could require longer, especially in exceptional cases. In such exceptional cases, it may be necessary to request additional information or documentation from the applicant, to process that additional information or documentation and, following examination of the information or documentation provided by the applicant, to invite him or her to an interview. Interviews should only be conducted in exceptional circumstances, as a last resort and when serious doubts remain regarding the information or documentation provided by the applicant. The exceptional nature of interviews should lead to less than 0,1 % of applicants being invited to an interview. The number of applicants invited to an interview should be subject to regular review by the Commission.

(22) The personal data provided by the applicant should be processed by ETIAS for the sole purposes of assessing whether the entry of the applicant into the Union could pose a security, illegal immigration or high epidemic risk in the Union.

(23) The assessment of such risks cannot be carried out without processing the personal data to be provided in a travel authorisation application. The personal data in the applications should be compared with the data present in a record, file or alert registered in an EU information system or database (the ETIAS Central System, SIS, the Visa Information System (VIS), the Entry/Exit System (EES) or Eurodac), in Europol data or in the Interpol databases (the Interpol Stolen and Lost Travel Document database (SLTD) or the Interpol Travel Documents Associated with Notices database (TDAWN)). The personal data in the applications should also be compared against the ETIAS watchlist and against specific risk indicators. The categories of personal data that should be used for comparison should be limited to the categories of data present in those EU information systems that are consulted, in Europol data, in Interpol databases, in the ETIAS watchlist or in the specific risk indicators.

(24) The comparison should take place by automated means. Whenever such comparison reveals that a correspondence (a ‘hit’) exists between any of the personal data or combination thereof in the application and the specific risk indicators or the personal data either in a record, file or alert in the above information systems or in the ETIAS watchlist, the application should be processed manually by the ETIAS National Unit of the Member State responsible. The assessment performed by the ETIAS National Unit should lead to the decision to issue the travel authorisation or not to do so.

(25) It is expected that the vast majority of applications will obtain a positive answer by automated means. No refusal, annulment or revocation of a travel authorisation should be based only on the automated processing of personal data in the applications. For this reason, the applications generating a hit should be processed manually by an ETIAS National Unit.

(26) Applicants who have been refused a travel authorisation should have the right to appeal. Appeals should be conducted in the Member State that has taken the decision on the application and in accordance with the national law of that Member State.

(27) The ETIAS screening rules should be used to analyse an application file by enabling a comparison between the data recorded in it and specific risk indicators corresponding to previously identified security, illegal immigration or high epidemic risks. The criteria used for defining the specific risk indicators should in no circumstances be based solely on a person’s sex or age. They should also in no circumstances be based on information revealing a person’s colour, race, ethnic or social origin, genetic features, language, political or any other opinion, religion or philosophical belief, trade union membership, membership of a national minority, property, birth, disability, or sexual orientation. The specific risk indicators should be defined, established, assessed ex ante, implemented, evaluated ex post, revised and deleted by the ETIAS Central Unit following consultation of an ETIAS screening board composed of representatives of the ETIAS National Units and the agencies involved. To help ensure the respect of fundamental rights in the implementation of the ETIAS screening rules and specific risk indicators, an ETIAS Fundamental Rights Guidance Board should be established. The secretariat for its meetings should be provided by the Fundamental Rights Officer of the European Border and Coast Guard Agency.

(28) An ETIAS watchlist should be established for the purposes of identifying connections between data in an application file and information related to persons who are suspected of having committed or having taken part in a terrorist offence or other serious criminal offence or regarding whom there are factual indications or reasonable grounds, based on an overall assessment of a person, to believe that they will commit a terrorist offence or other serious criminal offences. The ETIAS watchlist should form part of the ETIAS Central System. Data should be entered into the ETIAS watchlist by Europol, without prejudice to the relevant provisions on international cooperation in Regulation (EU) 2016/794 of the European Parliament and of the Council (7), and by Member States. Before entering data into the ETIAS watchlist, it should be determined that the data are adequate, accurate and important enough to be included in the ETIAS watchlist and that their entry would not lead to a disproportionate number of applications being processed manually. The data should be regularly reviewed and verified to ensure their continued accuracy.

(29) The continuous emergence of new forms of security threats, new patterns of illegal immigration and high epidemic risks requires effective responses using modern means. Since these means often involve the processing of significant amounts of personal data, appropriate safeguards should be introduced to keep the interference with the right to protection of private life and to the right of protection of personal data limited to what is necessary in a democratic society.

(30) Personal data in ETIAS should therefore be kept secure. Access to them should be limited to strictly authorised personnel. In no circumstances should access be used to reach decisions based on any form of discrimination. The personal data stored should be kept securely in the facilities of the European Agency for the operational management of large-scale information systems in the area of freedom, security and justice (eu-LISA) in the Union.

(31) Issued travel authorisations should be annulled or revoked as soon as it becomes evident that the conditions for issuing them were not or are no longer met. In particular, where a new alert for refusal of entry and stay or an alert reporting a travel document as lost, stolen, misappropriated or invalidated is entered in SIS, SIS should inform ETIAS. ETIAS should then verify whether this new alert corresponds to a valid travel authorisation. Where a new refusal of entry and stay alert has been issued, the ETIAS National Unit of the Member State responsible should revoke the travel authorisation. Where the travel authorisation is linked to a travel document reported as lost, stolen, misappropriated or invalidated in SIS, or reported as lost, stolen or invalidated in SLTD, the ETIAS National Unit of the Member State responsible should manually process the application file. Following a similar approach, new data entered into the ETIAS watchlist should be compared with the application files stored in ETIAS in order to verify whether those new data correspond to a valid travel authorisation. In such cases, the ETIAS National Unit of the Member State that entered the new data, or the Member State of first intended stay in the case of data entered by Europol, should assess the hit and, where necessary, revoke the travel authorisation. It should also be possible to revoke a travel authorisation at the request of the applicant.

(32) When, in exceptional circumstances, a Member State considers it necessary to allow a third-country national to travel to its territory on humanitarian grounds, for reasons of national interest or because of international obligations, it should have the possibility to issue a travel authorisation valid only for a limited territory and period.

(33) Prior to boarding, air and sea carriers and international carriers transporting groups overland by coach should have the obligation to verify that travellers are in possession of a valid travel authorisation. The ETIAS file itself should not be accessible to carriers. Carriers should have secure access to the ETIAS Information System to allow them to consult it using travel document data.

(34) The technical specifications for accessing the ETIAS Information System through the carrier gateway should limit the impact on passenger travel and carriers to the extent possible. For this purpose, integration with the EES should be considered.

(35) With a view to limiting the impact of the obligations set out in this Regulation on international carriers transporting groups overland by coach, user-friendly mobile solutions should be made available.

(36) Within two years following the start of operations of ETIAS, the appropriateness, compatibility and coherence of provisions referred to in Article 26 of the Convention implementing the Schengen Agreement of 14 June 1985 between the Governments of the States of the Benelux Economic Union, the Federal Republic of Germany and the French Republic on the gradual abolition of checks at their common borders (8) for the purposes of the ETIAS provisions for overland transport by coaches should be assessed by the Commission. The recent evolution of overland transport by coaches should be taken into account. The need for amending provisions concerning overland transport by coaches referred to in Article 26 of that Convention or this Regulation should be considered.

(37) In order to ensure compliance with the revised conditions for entry, border guards should check whether travellers are in possession of a valid travel authorisation. Therefore, during the standard border check process, border guards should read travel document data electronically. This operation should trigger a query in different databases as provided under the Regulation (EU) 2016/399 of the European Parliament and of the Council (9) (Schengen Borders Code), including a query in ETIAS which should provide the up-to-date travel authorisation status. If there is no valid travel authorisation, the border guard should refuse entry and should complete the border check process accordingly. If there is a valid travel authorisation, the decision to authorise or refuse entry should be taken by the border guard. Certain data in the ETIAS file should be accessible to border guards to assist them in carrying out their tasks.

(38) Where the ETIAS National Unit of the Member State responsible considers that some aspects of the application for a travel authorisation deserve further examination by the border authorities, it should be able to attach a flag to the travel authorisation it issues, recommending a second line check at the border crossing point. It should also be possible for such a flag to be attached at the request of a consulted Member State. Where the ETIAS National Unit of the Member State responsible considers that a specific hit triggered during the processing of the application constitutes a false hit or where the manual processing shows that there were no grounds for refusing a travel authorisation, it should be able to attach a flag to the travel authorisation it issues to facilitate border checks by providing border authorities with information related to the verifications that have been carried out and to limit the negative consequences of false hits on travellers. Operational instructions for border authorities for handling travel authorisations should be provided in a practical handbook.

(39) Since the possession of a valid travel authorisation is a condition of entry and stay for certain categories of third-country national, the immigration authorities of the Member States should be able to consult the ETIAS Central System when a prior search has been conducted in the EES and this search indicates that the EES does not contain an entry record corresponding to the presence of the third-country national on the territory of the Member States. Immigration authorities of the Member States should have access to certain information stored in the ETIAS Central System, in particular for the purpose of returns.

(40) In the fight against terrorist offences and other serious criminal offences and given the globalisation of criminal networks, it is imperative that designated authorities responsible for the prevention, detection or investigation of terrorist offences and other serious criminal offences (‘designated authorities’) have the necessary information to perform their tasks effectively. Access to data contained in the VIS for such purposes has already proven effective in helping investigators to make substantial progress in cases related to trafficking in human beings, terrorism or drug trafficking. VIS does not contain data on visa-exempt third-country nationals.

(41) Access to the information contained in ETIAS is necessary to prevent, detect and investigate terrorist offences as referred to in Directive (EU) 2017/541 of the European Parliament and of the Council (10) or other serious criminal offences as referred to in Council Framework Decision 2002/584/JHA (11). In a specific investigation and in order to establish evidence and information related to a person suspected of having committed a serious crime or to a victim of a serious crime, designated authorities may need access to the data generated by ETIAS. The data stored in ETIAS may also be necessary to identify the perpetrator of a terrorist offence or other serious criminal offences, especially when urgent action is needed. Access to ETIAS for the purpose of preventing, detecting or investigating terrorist offences or other serious criminal offences constitutes an interference with the fundamental rights to respect for the private life of individuals and to the protection of personal data of those persons whose personal data are processed in ETIAS. Therefore, the data in ETIAS should be retained and made available to the designated authorities of the Member States and to Europol only subject to the strict conditions set out in this Regulation. This will ensure that the processing of data stored in ETIAS is limited to what is strictly necessary for the prevention, detection and investigation of terrorist offences and other serious criminal offences in accordance with requirements laid down in the jurisprudence of the Court, in particular in the Digital Rights Ireland case (12).

(42) In particular, access to data stored in ETIAS for the purpose of preventing, detecting or investigating terrorist offences or other serious criminal offences should only be granted following a reasoned request by the operating unit of a designated authority explaining its necessity. In cases of urgency, where there is a need to prevent an imminent danger to the life of a person associated with a terrorist offence or another serious criminal offence, the verification of whether the conditions were fulfilled should take place after access to such data has been granted to the designated competent authorities. This ex post verification should take place without undue delay and in any event no later than seven working days after the processing of the request.

(43) It is therefore necessary to designate the authorities of the Member States that are authorised to request such access for the specific purposes for the prevention, detection or investigation of terrorist offences or of other serious criminal offences.

(44) The central access point(s) should act independently of the designated authorities and should verify that the conditions to request access to the ETIAS Central System are fulfilled in the concrete case at hand.

(45) Europol is the hub for information exchange in the Union. It plays a key role in cooperation between Member States’ authorities responsible for cross-border criminal investigations by supporting the Union-wide prevention, analysis and investigation of crime. Consequently, Europol should also have access to the ETIAS Central System within the framework of its tasks and in accordance with Regulation (EU) 2016/794 in specific cases where this is necessary for Europol to support and strengthen action by Member States to prevent, detect or investigate terrorist offences or other serious criminal offences.

(46) To exclude systematic searches, the processing of data stored in the ETIAS Central System should take place only in specific cases and only when it is necessary for the purposes of preventing, detecting or investigating terrorist offences or other serious criminal offences. The designated authorities and Europol should only request access to ETIAS when they have reasonable grounds to believe that such access will provide information that will assist them in preventing, detecting or investigating a terrorist offence or other serious criminal offence.

(47) The personal data recorded in ETIAS should be kept for no longer than is necessary for the purposes for which the data are processed. In order for ETIAS to function, it is necessary to keep the data related to applicants for the validity period of the travel authorisation. After the validity period has expired, the data should only be stored with the explicit consent of the applicant and only for the purpose of facilitating a new ETIAS application. A decision to refuse, annul or revoke a travel authorisation could indicate a security, illegal immigration or high epidemic risk posed by the applicant. Where such a decision has been issued, the data should therefore be kept for five years from the date of that decision, in order for ETIAS to be able to take into account accurately the higher risk possibly posed by the applicant concerned. If the data giving rise to this decision are deleted earlier, the application file should be deleted within seven days. After the expiry of such period, the personal data should be deleted.

(48) Personal data stored in the ETIAS Central System should not be made available to any third country, international organisation or private party. As an exception to that rule, however, it should be possible to transfer such personal data to a third country where the transfer is subject to strict conditions and necessary in the individual case for the purposes of return. In the absence of an adequacy decision by means of implementing act pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council (13) or of appropriate safeguards to which transfers are subject pursuant to that Regulation, it should exceptionally be possible to transfer data stored in ETIAS to a third country for the purposes of return, but only where the transfer is necessary for important reasons of public interest as referred to in that Regulation.

(49) It should also be possible to transfer personal data obtained by Member States pursuant to this Regulation to a third country in an exceptional case of urgency, where there is an imminent danger associated with a terrorist offence or where there is an imminent danger to the life of a person associated with a serious criminal offence. An imminent danger to the life of a person should be understood as covering a danger arising from a serious criminal offence committed against that person such as grievous bodily injury, illicit trade in human organs and tissue, kidnapping, illegal restraint and hostage-taking, sexual exploitation of children and child pornography, and rape.

(50) In order to ensure public awareness of ETIAS, particularly among third-country nationals subject to the travel authorisation requirement, information concerning ETIAS, including the relevant Union legislation, and the procedure for the application for a travel authorisation should be made available to the general public through a public website and an application for mobile devices to be used for applying to ETIAS. This information should also be disseminated through a common leaflet and by any other appropriate means. In addition, applicants for a travel authorisation should receive an email notification with information related to their application. That email notification should include weblinks to applicable Union and national legislation.

(51) Precise rules should be laid down as regards the responsibilities of eu-LISA for the design, development and technical management of the ETIAS Information System. Rules should also be laid down governing the responsibilities of the European Border and Coast Guard Agency, the responsibilities of the Member States and the responsibilities of Europol as regards ETIAS. eu-LISA should pay particular attention to the risk of cost increases and ensure sufficient monitoring of contractors.

(52) Regulation (EC) No 45/2001 of the European Parliament and of the Council (14) applies to the activities of eu-LISA and the European Border and Coast Guard Agency when carrying out the tasks entrusted to them in this Regulation.

(53) Regulation (EU) 2016/679 applies to the processing of personal data by the Member States in application of this Regulation.

(54) Where the processing of personal data by Member States for the purpose of assessing applications is carried out by the competent authorities for the purposes of the prevention, detection or investigation of terrorist offences or of other serious criminal offences, Directive (EU) 2016/680 of the European Parliament and of the Council (15) applies.

(55) Directive (EU) 2016/680 applies to the processing of personal data by the designated authorities of the Member States for the purposes of the prevention, detection or investigation of terrorist offences or of other serious criminal offences pursuant to this Regulation.

(56) The independent supervisory authorities established in accordance with Regulation (EU) 2016/679 should monitor the lawfulness of the processing of personal data by Member States, whilst the European Data Protection Supervisor established by Regulation (EC) No 45/2001 should monitor the activities of the Union institutions and bodies in relation to the processing of personal data. The European Data Protection Supervisor and the supervisory authorities should cooperate with each other in monitoring ETIAS.

(57) Strict access rules to the ETIAS Central System and the necessary safeguards should be established. It is also necessary to provide for individuals’ rights of access, rectification, restriction, completion, erasure and redress in relation to personal data, in particular the right to a judicial remedy and the supervision of processing operations by public independent authorities.

(58) In order to assess the security, illegal immigration or high epidemic risks which could be posed by a traveller, interoperability between the ETIAS Information System and other EU information systems should be established. Interoperability should be established in full compliance with the Union acquis concerning fundamental rights. If a centralised system for the identification of Member States holding conviction information on third-country nationals and stateless persons is established at Union level, ETIAS should be able to query it.

(59) This Regulation should contain clear provisions on liability and the right to compensation for the unlawful processing of personal data and for any other act incompatible with this Regulation. Such provisions should be without prejudice to the right to compensation from, and liability of the controller or processor under Regulation (EU) 2016/679, Directive (EU) 2016/680 and Regulation (EC) No 45/2001. eu-LISA should be responsible for any damage it causes in its capacity as a data processor where it has not complied with the obligations specifically imposed on it by this Regulation, or where it has acted outside or contrary to lawful instructions of the Member State which is the data controller.

(60) The effective monitoring of the application of this Regulation requires evaluation at regular intervals. Member States should lay down rules on the penalties applicable to infringements of this Regulation and ensure that they are implemented.

(61) In order to establish the technical measures needed for the application of this Regulation, the power to adopt acts in accordance with Article 290 TFEU should be delegated to the Commission: — to define the requirements of the secure account service, — to lay down the predetermined list of job groups used in the application form, — to specify the content and format of questions to applicants relating to convictions for criminal offences, stays in war or conflict zones and decisions to leave the territory or return decisions, — to specify the content and format of additional questions to applicants who reply affirmatively to one of the questions relating to convictions for criminal offences, stays in war or conflict zones and decisions to leave the territory or return decisions, and to set out a predetermined list of answers, — to lay down the payment methods and process for collecting the travel authorisation fee and any changes to the amount of that fee to reflect any increase in the costs of ETIAS, — to lay down the content and format of a predetermined list of options for applicants requested to provide additional information or documentation, — to further define the verification tool, — to further define the security, illegal immigration or high epidemic risks to be used to establish the specific risk indicators, — to define the type of additional information related to flags that may be added in the ETIAS application file, its formats, language and the reasons for the flags, — to establish adequate safeguards by providing rules and procedures to avoid conflicts with alerts in other information systems and to define the conditions, the criteria and the duration of the flagging, — to further define the tool to be used by applicants to give and withdraw their consent, — to extend the duration of the transitional period during which no travel authorisation is required and the duration of the grace period during which border guards will allow third-country nationals requiring a travel authorisation but not in possession of one exceptionally to enter subject to certain conditions, — to define the financial support for Member States for expenses they incur to customise and automate border checks when implementing ETIAS.

(62) It is of particular importance that the Commission carry out appropriate consultations during its preparatory work, including at expert level, and that those consultations be conducted in accordance with the principles laid down in the Interinstitutional Agreement of 13 April 2016 on Better Law-Making (16). In particular, to ensure equal participation in the preparation of delegated acts, the European Parliament and the Council receive all documents at the same time as Member States’ experts, and their experts systematically have access to meetings of Commission expert groups dealing with the preparation of delegated acts.

(63) In order to ensure uniform conditions for the implementation of this Regulation, implementing powers should be conferred on the Commission to adopt detailed rules on: — a form allowing the reporting of abuses by commercial intermediaries authorised by applicants to submit applications on their behalf, — the conditions for operation of the public website and the app for mobile devices, and detailed rules on data protection and security applicable to the public website and the app for mobile devices, — the requirements governing the format of the personal data to be inserted in the application form and the parameters and verifications to be implemented for ensuring the completeness of the application and the coherence of these data, — the requirements, testing and operation of the means of audio and video communication relied on for applicant interviews, and detailed rules on data protection, security and confidentiality applicable to such communication, — the security, illegal immigration and high epidemic risks on which specific risk indicators are to be based, — the technical specifications of the ETIAS watchlist and of the assessment tool to be used to assess the potential impact of entering data into the ETIAS watchlist on the proportion of applications that are manually processed, — a form for refusal, annulment or revocation of a travel authorisation, — the conditions for ensuring secure access to the ETIAS Information System by carriers, and the data protection and security rules applicable to this access, — an authentication scheme for access to the ETIAS Information System for duly authorised members of carrier staff, — the fall-back procedures to be followed in the case of a technical impossibility for carriers to query the ETIAS Information System, — model contingency plans in the case of a technical impossibility for border authorities to consult the ETIAS Central System or in case of a failure of ETIAS, — a model security plan and a model business continuity and disaster recovery plan concerning the security of processing of personal data, — access to the data in the ETIAS Information System, — amendment, erasure and advance erasure of data, — the keeping of logs and access to them, — performance requirements, — specifications for technical solutions to connect central access points to the ETIAS Central System, — a mechanism, procedures and interpretations of data quality compliance for the data contained in the ETIAS Central System, — common leaflets to inform travellers of the requirement to be in possession of a valid travel authorisation, — the operation of a central repository containing data solely for the purpose of reporting and statistics, and the data protection and security rules applicable to the repository, and — the specifications of a technical solution for the purpose of facilitating the collection of statistical data necessary to report on the effectiveness of access to data stored in the ETIAS Central System for law enforcement purposes. Those powers should be exercised in accordance with Regulation (EU) No 182/2011 of the European Parliament and of the Council (17).

(64) Since the objectives of this Regulation, namely, the establishment of a European Travel Information and Authorisation System and the creation of common obligations, conditions and procedures for use of the data stored in it cannot be sufficiently achieved by the Member States but can rather, by reason of the scale and effects of the action, be better achieved at Union level, the Union may adopt measures in accordance with the principle of subsidiarity as set out in Article 5 of the Treaty on European Union. In accordance with the principle of proportionality, as set out in that Article, this Regulation does not go beyond what is necessary in order to achieve those objectives.

(65) The operational and maintenance costs of the ETIAS Information System, of the ETIAS Central Unit and of the ETIAS National Units should be covered entirely by the revenues generated by the travel authorisation fees. The fee should therefore be adjusted as necessary in light of the costs incurred.

(66) The revenue generated by the payment of travel authorisation fees should be assigned to cover the recurring operational and maintenance costs of the ETIAS Information System, of the ETIAS Central Unit and of the ETIAS National Units. In view of the specific character of the system, it is appropriate to treat the revenue as internal assigned revenue. Any revenue remaining after covering these costs should be assigned to the Union budget.

(67) This Regulation is without prejudice to the application of Directive 2004/38/EC.

(68) This Regulation respects fundamental rights and observes the principles recognised by the Charter of Fundamental Rights of the European Union.

(69) In accordance with Articles 1 and 2 of Protocol No 22 on the position of Denmark, annexed to the TEU and to the TFEU, Denmark is not taking part in the adoption of this Regulation and is not bound by it or subject to its application. Given that this Regulation builds upon the Schengen acquis, Denmark shall, in accordance with Article 4 of that Protocol, decide within a period of six months after the Council has decided on this Regulation whether it will implement it in its national law.

(70) This Regulation constitutes a development of the provisions of the Schengen acquis in which the United Kingdom does not take part, in accordance with Council Decision 2000/365/EC (18); the United Kingdom is therefore not taking part in the adoption of this Regulation and is not bound by it or subject to its application.

(71) This Regulation constitutes a development of the provisions of the Schengen acquis in which Ireland does not take part, in accordance with Council Decision 2002/192/EC (19); Ireland is therefore not taking part in the adoption of this Regulation and is not bound by it or subject to its application.

(72) As regards Iceland and Norway, this Regulation constitutes a development of the provisions of the Schengen acquis within the meaning of the Agreement concluded by the Council of the European Union and the Republic of Iceland and the Kingdom of Norway concerning the latters’ association with the implementation, application and development of the Schengen acquis (20) which fall within the area referred to in Article 1, point A of Council Decision 1999/437/EC (21).

(73) As regards Switzerland, this Regulation constitutes a development of the provisions of the Schengen acquis within the meaning of the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation’s association with the implementation, application and development of the Schengen acquis (22) which fall within the area referred to in Article 1, point A of Decision 1999/437/EC read in conjunction with Article 3 of Council Decision 2008/146/EC (23) and with Article 3 of Council Decision 2008/149/JHA (24).

(74) As regards Liechtenstein, this Regulation constitutes a development of the provisions of the Schengen acquis within the meaning of the Protocol between the European Union, the European Community, the Swiss Confederation and the Principality of Liechtenstein on the accession of the Principality of Liechtenstein to the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation’s association with the implementation, application and development of the Schengen acquis (25) which fall within the area referred to in Article 1, point A of Decision 1999/437/EC read in conjunction with Article 3 of Council Decision 2011/350/EU (26) and with Article 3 of Council Decision 2011/349/EU (27).

(75) In order to determine the modalities relating to the financial contribution of third countries associated with the implementation, application and development of the Schengen acquis, further arrangements should be concluded between the Union and those countries under the relevant provisions of their association agreements. Such arrangements should constitute international agreements within the meaning of Article 218 TFEU.

(76) In order to integrate this Regulation into the existing legal framework and to reflect the necessary operational changes for eu-LISA and the European Border and Coast Guard Agency, Regulations (EU) No 1077/2011 (28), (EU) No 515/2014 (29), (EU) 2016/399, (EU) 2016/1624 (30) and (EU) 2017/2226 (31) of the European Parliament and of the Council should be amended.

(77) The European Data Protection Supervisor was consulted in accordance with Article 28(2) of Regulation (EC) No 45/2001 and delivered an opinion on 6 March 2017 (32),

HAVE ADOPTED THIS REGULATION:

CHAPTER I

GENERAL PROVISIONS

Article 1 Subject matter 1. This Regulation establishes a ‘European Travel Information and Authorisation System’ (ETIAS) for third-country nationals exempt from the requirement to be in possession of a visa when crossing the external borders (‘the visa requirement’) enabling consideration of whether the presence of those third-country nationals in the territory of the Member States would pose a security, illegal immigration or high epidemic risk. For this purpose, a travel authorisation and the conditions and procedures to issue or refuse it are introduced. 2. This Regulation lays down the conditions under which Member States’ designated authorities and Europol may consult data stored in the ETIAS Central System for the purposes of the prevention, detection and investigation of terrorist offences or of other serious criminal offences falling under their competence.

Article 2 Scope 1. This Regulation applies to the following categories of third-country nationals: (a) nationals of third countries listed in Annex II to Council Regulation (EC) No 539/2001 (33) who are exempt from the visa requirement for intended stays in the territory of the Member States of a duration of no more than 90 days in any 180-day period; (b) persons who, pursuant to Article 4(2) of Regulation (EC) No 539/2001, are exempt from the visa requirement for intended stays in the territory of the Member States of a duration of no more than 90 days in any 180-day period; (c) third-country nationals who are exempt from the visa requirement and who fulfil the following conditions: (i) they are family members of a Union citizen to whom Directive 2004/38/EC applies or of a national of a third country enjoying the right of free movement equivalent to that of Union citizens under an agreement between the Union and its Member States on the one hand and a third country on the other; and (ii) they do not hold a residence card pursuant to Directive 2004/38/EC or a residence permit pursuant to Regulation (EC) No 1030/2002. 2. This Regulation does not apply to: (a) refugees or stateless persons or other persons who do not hold the nationality of any country who reside in a Member State and who are holders of a travel document issued by that Member State; (b) third-country nationals who are family members of a Union citizen to whom Directive 2004/38/EC applies and who hold a residence card pursuant to that Directive; (c) third-country nationals who are family members of a third-country national enjoying a right of free movement equivalent to that of Union citizens, under an agreement between the Union and its Member States on the one hand and a third country on the other, and who hold a residence card pursuant to Directive 2004/38/EC or a residence permit pursuant to Regulation (EC) No 1030/2002; (d) holders of residence permits referred to in point 16 of Article 2 of Regulation (EU) 2016/399; (e) holders of uniform visas; (f) holders of national long-stay visas; (g) nationals of Andorra, Monaco and San Marino and holders of a passport issued by the Vatican City State or the Holy See; (h) nationals of third countries who are holders of a local border traffic permit issued by the Member States pursuant to Regulation (EC) No 1931/2006 of the European Parliament and of the Council (34) when such holders exercise their right within the context of the Local Border Traffic regime; (i) persons or categories of persons referred to in points (a) to (f) of Article 4(1) of Regulation (EC) No 539/2001; (j) third-country nationals holding diplomatic or service passports who have been exempted from the visa requirement pursuant to an international agreement concluded by the Union and a third country; (k) persons who are subject to a visa requirement pursuant to Article 4(3) of Regulation (EC) No 539/2001; (l) third-country nationals exercising their right to mobility in accordance with Directive 2014/66/EU (35) or (EU) 2016/801 (36) of the European Parliament and of the Council.

Article 3 Definitions 1. For the purposes of this Regulation, the following definitions apply: (1) ‘external borders’ means the external borders as defined in point 2 of Article 2 of Regulation (EU) 2016/399; (2) ‘law enforcement’ means the prevention, detection or investigation of terrorist offences or other serious criminal offences; (3) ‘second line check’ means a second line check as defined in point 13 of Article 2 of Regulation (EU) 2016/399; (4) ‘border authority’ means the border guard assigned in accordance with national law to carry out border checks as defined in point 11 of Article 2 of Regulation (EU) 2016/399; (5) ‘travel authorisation’ means a decision issued in accordance with this Regulation which is required for third-country nationals referred to in Article 2(1) of this Regulation to fulfil the entry condition laid down in point (b) of Article 6(1) of Regulation (EU) 2016/399 and which indicates: (a) that no factual indications or reasonable grounds based on factual indications have been identified to consider that the presence of the person on the territory of the Member States poses or will pose a security, illegal immigration or high epidemic risk; (b) that no factual indications or reasonable grounds based on factual indications have been identified to consider that the presence of the person on the territory of the Member States poses or will pose a security, illegal immigration or high epidemic risk, although doubt remains concerning the existence of sufficient reasons to refuse the travel authorisation, in accordance with Article 36(2); (c) where factual indications have been identified to consider that the presence of the person on the territory of the Member States poses or will pose a security, illegal immigration or high epidemic risk, that the territorial validity of the authorisation has been limited in accordance with Article 44; or (d) where factual indications have been identified to consider that the presence of the person on the territory of the Member States poses or will pose a security risk, that the traveller is the subject of an alert in SIS on persons for discreet checks or specific checks or of an alert in SIS on persons wanted for arrest for surrender purposes on the basis of an European Arrest Warrant or wanted for arrest for extradition purposes, in support of the objectives of SIS referred to in point (e) of Article 4; (6) ‘security risk’ means the risk of a threat to public policy, internal security or international relations for any of the Member States; (7) ‘illegal immigration risk’ means the risk of a third-country national not fulfilling the conditions of entry and stay as set out in Article 6 of Regulation (EU) 2016/399; (8) ‘high epidemic risk’ means any disease with epidemic potential as defined by the International Health Regulations of the World Health Organization (WHO) or the European Centre for Disease Prevention and Control (ECDC) and other infectious diseases or contagious parasitic diseases if they are the subject of protection provisions applying to nationals of the Member States; (9) ‘applicant’ means any third-country national referred to in Article 2 who has submitted an application for a travel authorisation; (10) ‘travel document’ means a passport or other equivalent document entitling the holder to cross the external borders and to which a visa may be affixed; (11) ‘short stay’ means stays in the territory of the Member States within the meaning of Article 6(1) of Regulation (EU) 2016/399; (12) ‘overstayer’ means a third-country national who does not fulfil, or no longer fulfils the conditions relating to the duration of a short stay on the territory of the Member States; (13) ‘app for mobile devices’ means a software application designed to run on mobile devices such as smartphones and tablet computers; (14) ‘hit’ means the existence of a correspondence established by comparing the personal data recorded in an application file of the ETIAS Central System with the specific risk indicators referred to in Article 33 or with the personal data present in a record, file or alert registered in the ETIAS Central System, in another EU information system or database listed in Article 20(2) (‘EU information systems’), in Europol data or in an Interpol database queried by the ETIAS Central System; (15) ‘terrorist offence’ means an offence which corresponds or is equivalent to one of the offences referred to in Directive (EU) 2017/541; (16) ‘serious criminal offence’ means an offence which corresponds or is equivalent to one of the offences referred to in Article 2(2) of Framework Decision 2002/584/JHA, if it is punishable under national law by a custodial sentence or a detention order for a maximum period of at least three years; (17) ‘Europol data’ means personal data processed by Europol for the purpose referred to in point (a) of Article 18(2) of Regulation (EU) 2016/794; (18) ‘electronically signed’ means the confirmation of agreement through the ticking of an appropriate box in the application form or the request for consent; (19) ‘minor’ means a third-country national or a stateless person below the age of 18 years; (20) ‘consulate’ means a Member State’s diplomatic mission or a Member State’s consular post as defined by the Vienna Convention on Consular Relations of 24 April 1963; (21) ‘designated authority’ means an authority designated by a Member State pursuant to Article 50 as responsible for the prevention, detection or investigation of terrorist offences or of other serious criminal offences; (22) ‘immigration authority’ means the competent authority responsible, in accordance with national law, for one or more of the following: (a) checking within the territory of the Member States whether the conditions for entry to, or stay on, the territory of the Member States are fulfilled; (b) examining the conditions for, and taking decisions related to, the residence of third-country nationals on the territory of the Member States insofar as that authority does not constitute a ‘determining authority’ as defined in point (f) of Article 2 of Directive 2013/32/EU of the European Parliament and of the Council (37), and, where relevant, providing advice in accordance with Council Regulation (EC) No 377/2004 (38); (c) the return of third-country nationals to a third country of origin or transit. 2. The terms defined in Article 2 of Regulation (EC) No 45/2001 shall have the same meaning in this Regulation insofar as personal data are processed by the European Border and Coast Guard Agency and eu-LISA. 3. The terms defined in Article 4 of Regulation (EU) 2016/679 shall have the same meaning in this Regulation insofar as personal data are processed by the authorities of Member States for the purposes laid down in points (a) to (e) of Article 4 of this Regulation. 4. The terms defined in Article 3 of Directive (EU) 2016/680 shall have the same meaning in this Regulation insofar as personal data are processed by the authorities of the Member States for the purposes laid down in point (f) of Article 4 of this Regulation.

Article 4 Objectives of ETIAS By supporting the competent authorities of the Member States, ETIAS shall: (a) contribute to a high level of security by providing for a thorough security risk assessment of applicants, prior to their arrival at external border crossing points, in order to determine whether there are factual indications or reasonable grounds based on factual indications to conclude that the presence of the person on the territory of the Member States poses a security risk; (b) contribute to the prevention of illegal immigration by providing for an illegal immigration risk assessment of applicants prior to their arrival at external border crossing points; (c) contribute to the protection of public health by providing for an assessment of whether the applicant poses a high epidemic risk within the meaning of point 8 of Article 3(1) prior to his or her arrival at external border crossing points; (d) enhance the effectiveness of border checks; (e) support the objectives of SIS related to alerts on third-country nationals subject to a refusal of entry and stay, alerts on persons wanted for arrest for surrender purposes or extradition purposes, alerts on missing persons, alerts on persons sought to assist with a judicial procedure and alerts on persons for discreet checks or specific checks; (f) contribute to the prevention, detection and investigation of terrorist offences or of other serious criminal offences.

Article 5 General structure of ETIAS ETIAS consists of: (a) the ETIAS Information System as referred to in Article 6; (b) the ETIAS Central Unit as referred to in Article 7; (c) the ETIAS National Units as referred to in Article 8.

Article 6 Establishment and technical architecture of the ETIAS Information System 1. The European Agency for the operational management of large-scale IT systems in the area of freedom, security and justice (‘eu-LISA’) shall develop the ETIAS Information System and ensure its technical management. 2. The ETIAS Information System shall be composed of: (a) the ETIAS Central System, including the ETIAS watchlist referred to in Article 34; (b) a national uniform interface (NUI) in each Member State based on common technical specifications and identical for all Member States enabling the ETIAS Central System to connect to the national border infrastructures and to the central access points in Member States referred to in Article 50(2) in a secure manner; (c) a communication infrastructure between the ETIAS Central System and the NUIs which shall be secure and encrypted; (d) a secure communication infrastructure between the ETIAS Central System and the information systems referred to in Article 11; (e) a public website and an app for mobile devices; (f) an email service; (g) a secure account service enabling applicants to provide any additional information or documentation required; (h) a verification tool for applicants; (i) a tool enabling applicants to give or withdraw their consent for an additional retention period of their application file; (j) a tool enabling Europol and Member States to assess the potential impact of entering new data into the ETIAS watchlist on the proportion of applications that are manually processed; (k) a carrier gateway; (l) a secure web service enabling the ETIAS Central System to communicate with the public website, the app for mobile devices, the email service, the secured account service, the carrier gateway, the verification tool for applicants, the consent tool for applicants, the payment intermediary and the Interpol databases; (m) software enabling the ETIAS Central Unit and the ETIAS National Units to process applications and to manage consultations with other ETIAS National Units as referred to in Article 28 and with Europol as referred to in Article 29; (n) a central repository of data for the purposes of reporting and statistics. 3. The ETIAS Central System, the NUIs, the web service, the carrier gateway and the communication infrastructure of ETIAS shall to the extent technically possible share and re-use the hardware and software components of the EES Central System, of the EES National Uniform Interfaces, of the EES web service and of the EES Communication Infrastructure referred to in Regulation (EU) 2017/2226. 4. The Commission shall adopt delegated acts in accordance with Article 89 in order to define the requirements of the secure account service referred to in point (g) of paragraph 2 of this Article.

Article 7 ETIAS Central Unit 1. An ETIAS Central Unit is hereby established within the European Border and Coast Guard Agency. 2. The ETIAS Central Unit shall be operational 24 hours a day, 7 days a week. It shall have the following responsibilities: (a) in cases where the automated application process has reported a hit, verifying in accordance with Article 22 whether the applicant’s personal data correspond to the personal data of the person having triggered that hit in the ETIAS Central System, including the ETIAS watchlist referred to in Article 34, any of the EU information systems that are consulted, Europol data, any of the Interpol databases referred to in Article 12, or the specific risk indicators referred to in Article 33, and where a correspondence is confirmed or where doubts remain, launching the manual processing of the application as referred to in Article 26; (b) ensuring that the data it enters in the applications files are up to date in accordance with the relevant provisions of Articles 55 and 64; (c) defining, establishing, assessing ex ante, implementing, evaluating ex post, revising and deleting the specific risk indicators as referred to in Article 33 after consultation of the ETIAS Screening Board; (d) ensuring that the verifications performed in accordance with Article 22 and the corresponding results are recorded in the application files; (e) carrying out regular audits of the processing of applications and of the implementation of Article 33, including by regularly assessing their impact on fundamental rights, in particular with regard to privacy and personal data protection; (f) indicating, where necessary, the Member State responsible for the manual processing of applications as referred to in Article 25(2); (g) in cases of technical problems or unforeseen circumstances, facilitating where necessary the consultations between Member States referred to in Article 28 and between the Member State responsible and Europol referred to in Article 29; (h) notifying carriers in cases of a failure of the ETIAS Information System as referred to in Article 46(1); (i) notifying the ETIAS National Units of the Member States of a failure of the ETIAS Information System as referred to in Article 48(1); (j) processing requests for consultation of data in the ETIAS Central System by Europol as referred to in Article 53; (k) providing the general public with all relevant information in relation to the application for a travel authorisation as referred to in Article 71; (l) cooperating with the Commission as regards the information campaign referred to in Article 72; (m) providing support in writing to travellers who have encountered problems when filling in the application form and have requested assistance through a standard contact form; maintaining a list of frequent questions and answers available online; (n) ensuring follow-up and regularly reporting to the Commission on reported abuses by commercial intermediaries as referred to in Article 15(5). 3. The ETIAS Central Unit shall publish an annual activity report. That report shall include: (a) statistics on: (i) the number of travel authorisations issued automatically by the ETIAS Central System; (ii) the number of applications verified by the ETIAS Central Unit; (iii) the number of applications processed manually per Member State; (iv) the number of applications that were refused by third country and the grounds for the refusal; (v) the extent to which the deadlines referred to in Article 22(6) and Articles 27, 30 and 32 have been met. (b) general information on the functioning of the ETIAS Central Unit, its activities as set out in this Article and information on current trends and challenges affecting the conduct of its tasks. The annual activity report shall be transmitted to the European Parliament, the Council and the Commission by 31 March of the following year.

Article 8 ETIAS National Units 1. Each Member State shall designate a competent authority as the ETIAS National Unit. 2. The ETIAS National Units shall be responsible for: (a) examining and deciding on applications for travel authorisation where the automated application process has reported a hit and the manual processing of the application has been initiated by the ETIAS Central Unit; (b) ensuring that the tasks performed under point (a) and the corresponding results are recorded in the application files; (c) ensuring that the data they enter in the application files are up to date in accordance with the relevant provisions of Articles 55 and 64; (d) deciding to issue travel authorisations with limited territorial validity as referred to in Article 44; (e) ensuring coordination with other ETIAS National Units and Europol concerning the consultation requests referred to in Articles 28 and 29; (f) providing applicants with information regarding the procedure to be followed in the event of an appeal under Article 37(3); (g) annulling and revoking a travel authorisation as referred to in Articles 40 and 41. 3. Member States shall provide the ETIAS National Units with adequate resources for them to fulfil their tasks in accordance with the deadlines set out in this Regulation.

Article 9 ETIAS Screening Board 1. An ETIAS Screening Board with an advisory function is hereby established within the European Border and Coast Guard Agency. It shall be composed of a representative of each ETIAS National Unit, of the European Border and Coast Guard Agency and of Europol. 2. The ETIAS Screening Board shall be consulted: (a) by the ETIAS Central Unit on the definition, establishment, assessment ex ante, implementation, evaluation ex post, revision and deletion of the specific risk indicators referred to in Article 33; (b) by Member States on the implementation of the ETIAS watchlist referred to in Article 34; (c) by Europol on the implementation of the ETIAS watchlist referred to in Article 34. 3. The ETIAS Screening Board shall issue opinions, guidelines, recommendations and best practices for the purposes referred to in paragraph 2. When issuing recommendations, the ETIAS Screening Board shall take into consideration the recommendations issued by the ETIAS Fundamental Rights Guidance Board. 4. The ETIAS Screening Board shall meet whenever necessary, and at least twice a year. The costs and servicing of its meetings shall be borne by the European Border and Coast Guard Agency. 5. The ETIAS Screening Board may consult the ETIAS Fundamental Rights Guidance Board on specific issues related to fundamental rights, in particular with regard to privacy, personal data protection and non-discrimination. 6. The ETIAS Screening Board shall adopt rules of procedure at its first meeting by a simple majority of its members.

Article 10 ETIAS Fundamental Rights Guidance Board 1. An independent ETIAS Fundamental Rights Guidance Board with an advisory and appraisal function is hereby established. Without prejudice to their respective competences and independence, it shall be composed of the Fundamental Rights Officer of the European Border and Coast Guard Agency, a representative of the consultative forum on fundamental rights of the European Border and Coast Guard Agency, a representative of the European Data Protection Supervisor, a representative of the European Data Protection Board established by Regulation (EU) 2016/679 and a representative of the European Union Agency for Fundamental Rights. 2. The ETIAS Fundamental Rights Guidance Board shall perform regular appraisals and issue recommendations to the ETIAS Screening Board on the impact on fundamental rights of the processing of applications and of the implementation of Article 33, in particular with regard to privacy, personal data protection and non-discrimination. The ETIAS Fundamental Rights Guidance Board shall also support the ETIAS Screening Board in the execution of its tasks when consulted by the latter on specific issues related to fundamental rights, in particular with regard to privacy, personal data protection and non-discrimination. The ETIAS Fundamental Rights Guidance Board shall have access to the audits referred to in point (e) of Article 7(2). 3. The ETIAS Fundamental Rights Guidance Board shall meet whenever necessary, and at least twice a year. The costs and servicing of its meetings shall be borne by the European Border and Coast Guard Agency. Its meetings shall take place in premises of the European Border and Coast Guard Agency. The secretariat of its meetings shall be provided by the European Border and Coast Guard Agency. The ETIAS Fundamental Rights Guidance Board shall adopt rules of procedure at its first meeting by a simple majority of its members. 4. One representative of the ETIAS Fundamental Rights Guidance Board shall be invited to attend the meetings of the ETIAS Screening Board in an advisory capacity. The members of the ETIAS Fundamental Rights Guidance Board shall have access to the information and files of the ETIAS Screening Board. 5. The ETIAS Fundamental Rights Guidance Board shall produce an annual report. The report shall be made publicly available.

Article 11 Interoperability with other EU information systems 1. Interoperability between the ETIAS Information System, other EU information systems and Europol data shall be established to enable the verification referred to in Article 20. 2. The amendments to the legal acts establishing the EU information systems that are necessary for establishing their interoperability with ETIAS as well as the addition of corresponding provisions in this Regulation shall be the subject of a separate legal instrument.

Article 12 Querying the Interpol databases The ETIAS Central System shall query the Interpol Stolen and Lost Travel Document database (SLTD) and the Interpol Travel Documents Associated with Notices database (TDAWN). Any queries and verification shall be performed in such a way that no information shall be revealed to the owner of the Interpol alert.

Article 13 Access to data stored in ETIAS 1. Access to the ETIAS Information System shall be reserved exclusively for duly authorised staff of the ETIAS Central Unit and of the ETIAS National Units. 2. Access by border authorities to the ETIAS Central System in accordance with Article 47 shall be limited to searching the ETIAS Central System to obtain the travel authorisation status of a traveller present at an external border crossing point and to the data referred to in points (a), (c) and (d) of Article 47(2). In addition, border authorities shall be informed automatically of the flags referred to in Article 36(2) and (3) and of the reasons for the flags. When exceptionally, according to a flag, a second line check is recommended at the border or additional verifications are needed for the purpose of a second line check, border authorities shall access the ETIAS Central System to obtain the additional information provided for in point (e) of Article 39(1) or point (f) of Article 44(6). 3. Access by carriers to the ETIAS Information System in accordance with Article 45 shall be limited to sending queries to the ETIAS Information System to obtain the travel authorisation status of a traveller. 4. Access by immigration authorities to the ETIAS Central System in accordance with Article 49 shall be limited to obtaining the travel authorisation status of a traveller present on the territory of the Member State, and to certain data as referred to in that Article. Access by immigration authorities to the ETIAS Central System in accordance with Article 65(3) shall be limited to the data referred to in that Article. 5. Each Member State shall designate the competent national authorities referred to in paragraphs 1, 2 and 4 of this Article and shall communicate a list of those authorities to eu-LISA without delay, in accordance with Article 87(2). That list shall specify for which purpose the duly authorised staff of each authority shall have access to the data in the ETIAS Information System in accordance with paragraphs 1, 2 and 4 of this Article.

Article 14 Non-discrimination and fundamental rights Processing of personal data within the ETIAS Information System by any user shall not result in discrimination against third-country nationals on the grounds of sex, race, colour, ethnic or social origin, genetic features, language, religion or belief, political or any other opinion, membership of a national minority, property, birth, disability, age or sexual orientation. It shall fully respect human dignity and integrity and fundamental rights, including the right to respect for one’s private life and to the protection of personal data. Particular attention shall be paid to children, the elderly and persons with a disability. The best interests of the child shall be a primary consideration.

CHAPTER II

APPLICATION

Article 15 Practical arrangements for submitting an application 1. Applicants shall submit an application by filling in the online application form via the dedicated public website or via the app for mobile devices sufficiently in advance of any intended travel, or, if they are already present on the territory of Member States, before the expiry of an existing travel authorisation they hold. 2. Holders of a travel authorisation may submit an application for a new travel authorisation from 120 days before the expiry of the travel authorisation. 120 days before the expiry of the travel authorisation, the ETIAS Central System shall automatically inform the holder of that travel authorisation via the email service of: (a) the expiry date of the travel authorisation; (b) the possibility to submit an application for a new travel authorisation; (c) the obligation to be in possession of a valid travel authorisation for the entire duration of a short stay on the territory of Member States. 3. All notifications to the applicant for the purpose of his or her application for a travel authorisation shall be sent to the email address provided by the applicant in the application form as referred to in point (g) of Article 17(2). 4. Applications may be submitted by the applicant or by a person or a commercial intermediary authorised by the applicant to submit the application on his or her behalf. 5. The Commission shall, by means of an implementing act, create a form allowing abuses by the commercial intermediaries referred to in paragraph 4 of this Article to be reported. This form shall be made accessible via the dedicated public website or via the app for mobile devices referred to in paragraph 1 of this Article. Such completed forms shall be sent to the ETIAS Central Unit which shall take appropriate action, including by regularly reporting to the Commission. That implementing act shall be adopted in accordance with the examination procedure referred to in Article 90(2).

Article 16 The public website and the app for mobile devices 1. The public website and the app for mobile devices shall enable third-country nationals subject to the travel authorisation requirement to submit a travel authorisation application, to provide the data required in the application form in accordance with Article 17 and to pay the travel authorisation fee. 2. The public website and the app for mobile devices shall make the application form widely available and easily accessible to applicants free of charge. Specific attention shall be paid to the accessibility of the public website and the app for mobile devices for persons with disabilities. 3. The public website and the app for mobile devices shall be available in all the official languages of the Member States. 4. Where the official language(s) of the countries listed in Annex II to Regulation (EC) No 539/2001 do not correspond to the languages referred to in paragraph 3, factsheets with explanatory information concerning ETIAS, the application procedure, the use of the public website and the app for mobile devices as well as a step-by-step guide to the application shall be made available by eu-LISA on the public website and on the app for mobile devices in at least one of the official languages of the countries referred to. Where any such country has more than one official language, such factsheets shall only be necessary if none of those languages correspond to the languages referred to in paragraph 3. 5. The public website and the app for mobile devices shall inform applicants of the languages which may be used when filling in the application form. 6. The public website and the app for mobile devices shall provide the applicant with an account service enabling applicants to provide additional information or documentation, where required. 7. The public website and the app for mobile devices shall inform applicants of their right to an appeal under this Regulation if a travel authorisation is refused, revoked or annulled. To this end, they shall contain information about the national law applicable, the competent authority, how to lodge an appeal, the time limit for lodging an appeal and information as to any assistance that may be provided by the national data protection authority. 8. The public website and the app for mobile devices shall enable applicants to indicate that the purpose of their intended stay relates to humanitarian grounds or international obligations. 9. The public website shall contain the information referred to in Article 71. 10. The Commission shall, by means of implementing acts, adopt detailed rules on the operation of the public website and the app for mobile devices, and detailed rules on data protection and security applicable to the public website and the app for mobile devices. Those detailed rules shall be based on information security risk management and on principles of data protection by design and by default. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 90(2).

Article 17 Application form and personal data of the applicant 1. Each applicant shall submit a completed application form including a declaration of the authenticity, completeness, correctness and reliability of the data submitted and a declaration of the veracity and reliability of the statements made. Each applicant shall also state that he or she has understood the conditions for entry referred to in Article 6 of Regulation (EU) 2016/399 and that he or she may be requested to provide the relevant supporting documents at each entry. Minors shall submit an application form electronically signed by a person exercising permanent or temporary parental authority or legal guardianship. 2. The applicant shall provide the following personal data in the application form: (a) surname (family name), first name(s) (given name(s)), surname at birth; date of birth, place of birth, country of birth, sex, current nationality, first name(s) of the parents of the applicant; (b) other names (alias(es), artistic name(s), usual name(s)), if any; (c) other nationalities, if any; (d) type, number and country of issue of the travel document; (e) the date of issue and the date of expiry of the validity of the travel document; (f) the applicant’s home address or, if not available, his or her city and country of residence; (g) email address and, if available, phone numbers; (h) education (primary, secondary, higher or none); (i) current occupation (job group); where the application is subject to the manual processing in accordance with the procedure laid down in Article 26, the Member State responsible may in accordance with Article 27 request that the applicant provide additional information concerning his or her exact job title and employer or, for students, the name of their educational establishment; (j) Member State of first intended stay, and optionally, the address of first intended stay; (k) for minors, surname and first name(s), home address, email address and, if available, phone number of the person exercising parental authority or of the applicant’s legal guardian; (l) where he or she claims the status of family member referred to in point (c) of Article 2(1): (i) his or her status of family member; (ii) the surname, first name(s), date of birth, place of birth, country of birth, current nationality, home address, email address and, if available, phone number of the family member with whom the applicant has family ties; (iii) his or her family ties with that family member in accordance with Article 2(2) of Directive 2004/38/EC; (m) in the case of applications filled in by a person other than the applicant, the surname, first name(s), name of firm, organisation if applicable, email address, mailing address and phone number if available of that person; relationship to the applicant and a signed representation declaration. 3. The applicant shall choose his or her current occupation (job group) from a predetermined list. The Commission shall adopt delegated acts in accordance with Article 89 to lay down this predetermined list. 4. In addition, the applicant shall provide answers to the following questions: (a) whether he or she has been convicted of any criminal offence listed in the Annex over the previous 10 years and in the case of terrorist offences, over the previous 20 years, and if so when and in which country; (b) whether he or she has stayed in a specific war or conflict zone over the previous 10 years and the reasons for the stay; (c) whether he or she has been the subject of any decision requiring him or her to leave the territory of a Member State or of any third countries listed in Annex II to Regulation (EC) No 539/2001 or whether he or she was subject to any return decision issued over the previous 10 years. 5. The Commission shall adopt delegated acts in accordance with Article 89 specifying the content and format of the questions referred to in paragraph 4 of this Article. The content and format of those questions shall enable applicants to give clear and precise answers. 6. Where the applicant answers affirmatively to any of the questions referred to in paragraph 4, he or she shall be required to provide answers to an additional set of predetermined questions on the application form by selecting from a predetermined list of answers. The Commission shall adopt delegated acts in accordance with Article 89 to lay down the content and format of those additional questions and the predetermined list of answers to those questions. 7. The data referred to in paragraphs 2 and 4 shall be introduced by the applicant in Latin alphabet characters. 8. On submission of the application form, the ETIAS Information System shall collect the IP address from which the application form was submitted. 9. The Commission shall, by means of implementing acts, define the requirements concerning the format of the personal data referred to in paragraphs 2 and 4 of this Article to be inserted in the application form as well as parameters and verifications to be implemented for ensuring the completeness of the application and the coherence of those data. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 90(2).

Article 18 Travel authorisation fee 1. A travel authorisation fee of EUR 7 shall be paid by the applicant for each application. 2. The travel authorisation fee shall be waived for applicants under 18 years or above 70 years of age at the time of the application. 3. The travel authorisation fee shall be charged in euros. 4. The Commission shall adopt delegated acts in accordance with Article 89 on the payment methods and process for the travel authorisation fee and on changes to the amount of that fee. Changes to the amount shall take into account any increase in the costs referred to in Article 85.

CHAPTER III

CREATION OF THE APPLICATION FILE AND EXAMINATION OF THE APPLICATION BY THE ETIAS CENTRAL SYSTEM

Article 19 Admissibility and creation of the application file 1. The ETIAS Information System shall automatically verify whether, following submission of an application: (a) all the fields of the application form are filled in and contain all the items referred to in Article 17(2) and (4); (b) the travel authorisation fee has been collected. 2. If the conditions in points (a) and (b) of paragraph 1 are met, the application shall be deemed admissible. The ETIAS Central System shall then automatically create an application file without delay and assign it an application number. 3. Upon creation of the application file, the ETIAS Central System shall record and store the following data: (a) the application number; (b) status information, indicating that a travel authorisation has been requested; (c) the personal data referred to in Article 17(2) and, where applicable, Article 17(4) and (6), including the three-letter code of the country issuing the travel document; (d) the data referred to in Article 17(8); (e) the date and the time the application form was submitted as well as a reference to the successful payment of the travel authorisation fee and the unique reference number of the payment. 4. Upon creation of the application file, the ETIAS Central System shall determine whether the applicant already has another application file in the ETIAS Central System by comparing the data referred to in point (a) of Article 17(2) with the personal data of the application files stored in the ETIAS Central System. In such a case, the ETIAS Central System shall link the new application file to any previous existing application file created for the same applicant. 5. Upon creation of the application file, the applicant shall immediately receive a notification via the email service explaining that, during the processing of the application, the applicant may be asked to provide additional information or documentation or, in exceptional circumstances, attend an interview. This notification shall include: (a) status information, acknowledging the submission of an application for travel authorisation; and (b) the application number. The notification shall enable the applicant to make use of the verification tool provided for in point (h) of Article 6(2).

Article 20 Automated processing 1. The application files shall be automatically processed by the ETIAS Central System to identify hit(s). The ETIAS Central System shall examine each application file individually. 2. The ETIAS Central System shall compare the relevant data referred to in points (a),(b), (c), (d), (f), (g), (j), (k) and (m) of Article 17(2) and in Article 17(8) to the data present in a record, file or alert registered in the ETIAS Central System, SIS, the EES, VIS, Eurodac, Europol data and Interpol SLTD and TDAWN databases. In particular, the ETIAS Central System shall verify: (a) whether the travel document used for the application corresponds to a travel document reported lost, stolen, misappropriated or invalidated in SIS; (b) whether the travel document used for the application corresponds to a travel document reported lost, stolen or invalidated in the SLTD; (c) whether the applicant is subject to a refusal of entry and stay alert entered in SIS; (d) whether the applicant is subject to an alert in respect of persons wanted for arrest for surrender purposes on the basis of a European Arrest Warrant or wanted for arrest for extradition purposes in SIS; (e) whether the applicant and the travel document correspond to a refused, revoked or annulled travel authorisation in the ETIAS Central System; (f) whether the data provided in the application concerning the travel document correspond to another application for travel authorisation associated with different identity data referred to in point (a) of Article 17(2) in the ETIAS Central System; (g) whether the applicant is currently reported as an overstayer or whether he or she has been reported as an overstayer in the past in the EES; (h) whether the applicant is recorded as having been refused entry in the EES; (i) whether the applicant has been subject to a decision to refuse, annul or revoke a short stay visa recorded in VIS; (j) whether the data provided in the application correspond to data recorded in Europol data; (k) whether the applicant is registered in Eurodac; (l) whether the travel document used for the application corresponds to a travel document recorded in a file in TDAWN; (m) in cases where the applicant is a minor, whether the applicant’s parental authority or legal guardian: (i) is subject to an alert in respect of persons wanted for arrest for surrender purposes on the basis of a European Arrest Warrant or wanted for arrest for extradition purposes in SIS; (ii) is subject to a refusal of entry and stay alert entered in SIS. 3. The ETIAS Central System shall verify whether the applicant has replied affirmatively to any of the questions listed in Article 17(4) and whether the applicant has not provided a home address but only his city and country of residence, as referred to in point (f) of Article 17(2). 4. The ETIAS Central System shall compare the relevant data referred to in points (a), (b), (c), (d), (f), (g), (j), (k) and (m) of Article 17(2) and in Article 17(8) to the data present in the ETIAS watchlist referred to in Article 34. 5. The ETIAS Central System shall compare the relevant data referred to in points (a), (c), (f), (h) and (i) of Article 17(2) to the specific risk indicators referred to in Article 33. 6. The ETIAS Central System shall add a reference to any hit obtained pursuant to paragraphs 2 to 5 to the application file. 7. Where the data recorded in the application file correspond to the data triggering a hit pursuant to paragraphs 2 and 4, the ETIAS Central System shall identify, where relevant, the Member State(s) that entered or supplied the data having triggered the hit and shall record this in the application file. 8. Following any hit pursuant to paragraph 2(j) and paragraph 4 and where no Member State had supplied the data having triggered the hit, the ETIAS Central System shall identify whether Europol entered the data and shall record this in the application file.

Article 21 Results of the automated processing 1. Where the automated processing laid down in Article 20(2) to (5) does not report any hit, the ETIAS Central System shall automatically issue a travel authorisation in accordance with Article 36 and shall notify the applicant in accordance with Article 38. 2. Where the automated processing laid down in Article 20(2) to (5) reports one or several hits, the application shall be processed in accordance with the procedure laid down in Article 22. 3. Where verification under Article 22 confirms that the data recorded in the application file correspond to the data triggering a hit during the automated processing pursuant to Article 20(2) to (5) or where doubts remain concerning the identity of the applicant following such verification, the application shall be processed in accordance with the procedure laid down in Article 26. 4. Where automated processing under Article 20(3) reports that the applicant has replied affirmatively to any of the questions listed in Article 17(4), and if there is no other hit, the application shall be sent to the ETIAS National Unit of the Member State responsible, for manual processing as set out in Article 26.

Article 22 Verification by the ETIAS Central Unit 1. Where the automated processing pursuant to Article 20(2) to (5) reports one or several hits the ETIAS Central System shall automatically consult the ETIAS Central Unit. 2. When consulted, the ETIAS Central Unit shall have access to the application file and any linked application files, as well as to all the hits triggered during automated processing pursuant to Article 20(2) to (5) and to the information identified by the ETIAS Central System under Article 20(7) and (8). 3. The ETIAS Central Unit shall verify whether the data recorded in the application file correspond to one or more of the following: (a) the specific risk indicators referred to in Article 33; (b) the data present in the ETIAS Central System, including the ETIAS watchlist referred to in Article 34; (c) the data present in one of the EU information systems that are consulted; (d) Europol data; (e) the data present in the Interpol SLTD or TDAWN databases. 4. Where the data do not correspond, and no other hit has been reported during automated processing pursuant to Article 20(2) to (5), the ETIAS Central Unit shall delete the false hit from the application file and the ETIAS Central System shall automatically issue a travel authorisation in accordance with Article 36. 5. Where the data correspond to those of the applicant or where doubts remain concerning the identity of the applicant, the application shall be processed manually in accordance with the procedure laid down in Article 26. 6. The ETIAS Central Unit shall complete the manual processing within a maximum of 12 hours from receipt of the application file.

Article 23 Support of the objectives of SIS 1. For the purposes of point (e) of Article 4, the ETIAS Central System shall compare the relevant data referred to in points (a), (b) and (d) of Article 17(2) to the data present in SIS in order to determine whether the applicant is the subject of one of the following alerts: (a) an alert on missing persons; (b) an alert on persons sought to assist with a judicial procedure; (c) an alert on persons for discreet checks or specific checks. 2. Where the comparison referred to in paragraph 1 reports one or several hits, the ETIAS Central System shall send an automated notification to the ETIAS Central Unit. The ETIAS Central Unit shall verify whether the applicant’s personal data correspond to the personal data contained in the alert having triggered that hit and if a correspondence is confirmed, the ETIAS Central System shall send an automated notification to the SIRENE Bureau of the Member State that entered the alert. The SIRENE Bureau concerned shall further verify whether the applicant’s personal data correspond to the personal data contained in the alert having triggered the hit and take any appropriate follow-up action. The ETIAS Central System shall also send an automated notification to the SIRENE Bureau of the Member State that entered the alert having triggered a hit against SIS during the automated processing referred to in Article 20 where, following verification by the ETIAS Central Unit as referred to in Article 22, that alert has led to manual processing of the application in accordance with Article 26. 3. The notification provided to the SIRENE Bureau of the Member State that entered the alert shall contain the following data: (a) surname(s), first name(s) and, if any, alias(es); (b) place and date of birth; (c) sex; (d) nationality and, if any, other nationalities; (e) Member State of first intended stay, and if available, the add