COMMISSION IMPLEMENTING DECISION (EU) 2022/102

of 25 January 2022

laying down forms for refusal, annulment or revocation of a travel authorisation

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2018/1240 of the European Parliament and of the Council of 12 September 2018 establishing a European Travel Information and Authorisation System (ETIAS) and amending Regulations (EU) No 1077/2011, (EU) No 515/2014, (EU) 2016/399, (EU) 2016/1624 and (EU) 2017/2226 (1), and in particular Article 38(3) thereof,

Whereas:

(1) Regulation (EU) 2018/1240 established the European Travel Information and Authorisation System (ETIAS) for third-country nationals exempt from the requirement to be in possession of a visa when crossing the external borders. It laid down the conditions and procedures for issuing or refusing a travel authorisation.

(2) Where an application for a travel authorisation is refused, annulled or revoked following manual processing by an ETIAS National Unit, the applicant should be immediately notified of that decision. For that purpose, ETIAS National Units should use forms containing the minimum information set out in Article 38(2) of the Regulation (EU) 2018/1240. The forms should also cover cases where the applicants themselves decide to revoke the authorisation (self-revocation).

(3) Given that Regulation (EU) 2018/1240 builds upon the Schengen acquis, in accordance with Article 4 of Protocol No 22 on the position of Denmark, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, Denmark notified the implementation of Regulation (EU) 2018/1240 in its national law. Denmark is therefore bound by this Decision.

(4) This Decision constitutes a development of the provisions of the Schengen acquis in which Ireland does not take part (2). Ireland is therefore not taking part in the adoption of this Decision and is not bound by it or subject to its application.

(5) This Decision constitutes a development of the provisions of the Schengen acquis within the meaning of the Agreement concluded by the Council of the European Union and the Republic of Iceland and the Kingdom of Norway concerning the association of those two States with the implementation, application and development of the Schengen acquis (3), which fall within the area referred to in Article 1, point A of Council Decision 1999/437/EC (4).

(6) This Decision constitutes a development of the provisions of the Schengen acquis within the meaning of the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation’s association with the implementation, application and development of the Schengen acquis (5), which fall within the area referred to in Article 1, point A of Council Decision 1999/437/EC, read in conjunction with Article 3 of Council Decision 2008/146/EC (6).

(7) This Decision constitutes a development of the provisions of the Schengen acquis within the meaning of the Protocol between the European Union, the European Community, the Swiss Confederation and the Principality of Liechtenstein on the accession of the Principality of Liechtenstein to the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation’s association with the implementation, application and development of the Schengen acquis (7) , which fall within the area referred to in Article 1, point A of Council Decision 1999/437/EC read in conjunction with Article 3 of Council Decision 2011/350/EU (8).

(8) As regards Cyprus, Bulgaria and Romania and Croatia, this Decision constitutes an act building upon, or otherwise relating to, the Schengen acquis within the meaning, respectively, of Article 3(1) of the 2003 Act of Accession, Article 4(1) of the 2005 Act of Accession and Article 4(1) of the 2011 Act of Accession.

(9) The European Data Protection Supervisor was consulted on 15 April 2021 and delivered an opinion on 25 May 2021.

(10) The measures provided for in this Decision are in accordance with the opinion of the Smart Borders Committee,

HAS ADOPTED THIS DECISION:

Article 1 Generation of forms following a decision to refuse, annul or revoke a travel authorisation 1. Forms for the purpose of notifying decisions to refuse, annul or revoke a travel authorisation or a travel authorisation with limited territorial validity (hereinafter ‘travel authorisation’) shall be generated automatically by means of the software referred to in Article 6(2)(m) of Regulation (EU) 2018/1240. The forms shall be based on the templates in the Annex I, II or III. 2. The software shall provide the possibility of generating: — a form with the possibility to select one of the official languages of the Member States; and — a form with the possibility to select English, French or German, or, where relevant in relation to the applicant in question, at the discretion of the Member State, another of the official languages of the European Union which shall be different from the language used in the form referred to in the first subparagraph. 3. The field forms of Annex I, II, III named ‘Statement of the relevant facts and additional reasoning underlying the decision’ shall be translated by the Member States and the costs shall be born by the general budget of the Union in accordance with Article 85(2) of Regulation (EU) 2018/1240. 4. The software shall enable the ETIAS National Unit of the Member State responsible to select a form according to the type of decision taken (refusal, annulment or revocation). 5. The software shall then present a subsequent list requiring the selection of at least one of the applicable grounds for the decision, as set out in the following provisions of Regulation (EU) 2018/1240: (a) for refusal, Article 37(1) and (2); (b) for annulment, Article 37(1) and (2), as referred to in Article 40(1); (c) for revocation, Article 37(1), as referred to in Article 41(1). The field in Annex I, II, III named ‘Statement of the relevant facts and additional reasoning underlying the decision’ shall be mandatory. Until that section is completed in the selected languages, the ETIAS Information System shall prevent the generation of the forms. 6. Where the decision to refuse, annul or revoke concerns a travel authorisation with limited territorial validity, the software shall present, in addition to the list of paragraph 5, the following list of grounds to be selected: (a) humanitarian grounds not fulfilled/no longer fulfilled in accordance with the national law of the Member State to which the third-country national concerned intends to travel; (b) reasons of national interest not fulfilled/no longer fulfilled; or (c) international obligations not fulfilled/no longer fulfilled. 7. Where the decision to refuse, annul or revoke a travel authorisation concern a person who declared to fall under the scope of Article 2(1), point (c) of Regulation (EU) 2018/1240, the list of options referred to in paragraph 5 shall not include grounds which are not applicable pursuant to Article 24 of Regulation (EU) 2018/1240 and Directive 2004/38/EC of the European Parliament and of the Council (9). 8. Once the ETIAS National Unit of the Member State responsible has completed the selections referred to in paragraphs 2 to 6 the software shall automatically generate the relevant draft forms. The forms shall contain the corresponding application number and be automatically pre-filled with the data referred to in the following provisions of Regulation (EU) 2018/1240: (a) as regards refusal, points (a) to (e) in Article 38(2); (b) as regards annulment or revocation, points (a) to (f) in Article 42. 9. Before the form is transmitted to the applicant, the software shall enable the ETIAS National Unit of the Member State responsible to confirm the selections made and the information in the forms. 10. Upon confirmation pursuant to paragraph 9, the software shall generate the forms in PDF format. 11. The generated forms shall be added to the application file and transmitted to the applicant via the email service referred to in point (f) in Article 6(2) of Regulation (EU) 2018/1240.

Article 2 Access and authentication for the purpose of self-revocation 1. Applicants shall be given the option to revoke a travel authorisation via the public website and the app for mobile devices referred to in Article 16 of Regulation (EU) 2018/1240. 2. Upon selection of the option to revoke a travel authorisation, the applicant shall be presented with a request to authenticate using a two-factor authentication. 3. The applicant shall first enter the following data: (a) the application number; (b) the travel document number; (c) the email address used in the application for a travel authorisation. The applicant shall be asked to confirm that they have access to the email address referred to in the first subparagraph, point (c), by ticking a box. Should they no longer have access to that address, they shall be asked to enter a new email address for receiving a unique code and confirmation of revocation. 4. Where the data submitted pursuant to paragraph 3 correspond to a valid travel authorisation, the first authentication shall consist of the submission by the applicant of the following data: (a) the country of issue of the travel document (to be selected from a list); (b) the dates of issue and of expiry of the travel document; (c) the first names of both parents, as entered in the application for a travel authorisation. 5. The second authentication shall consist of a unique code to be entered into the revocation web page or mobile app. The unique code shall be generated automatically and sent to the applicant through the email service referred to in Article 6(2), point (f), of Regulation (EU) 2018/1240, upon submission of the data referred to in paragraphs 3 and 4. The recipient email address shall be that to which the applicant has access, as confirmed pursuant to paragraph 3. 6. Where the data submitted pursuant to paragraph 3, with the exception of the email address referred to in point (c) in that paragraph, correspond to the data in the application form, an email shall be sent to the email address on the application form signalling an attempt to revoke the authorisation via the website or the mobile app. That email shall allow the applicant to indicate, by a given deadline, that they are not at the origin of the request for revocation. It shall also inform the applicant how to contact the ETIAS Central Unit if necessary. The ETIAS Central Unit shall keep records of all follow-up action. 7. Once the applicant enters the unique code, referred to in paragraph 5, on the revocation web page or mobile app to confirm authentication, the website or the app shall display information on the 5-year data retention period for application files relating to revoked travel authorisations, as referred to in Article 54(1), point (b), of Regulation (EU) 2018/1240. 8. The applicant shall be required to confirm having read and agreed with the information referred in paragraph 7 and confirm the revocation of the travel authorisation in order to finalise the revocation request. 9. Unique codes generated pursuant to paragraph 5 shall expire after a reasonably short period of time. The sending of a new code shall invalidate previous codes. Codes shall be usable only once. 10. Where the revocation request is introduced with an email address that differs from that used in the application form, the finalised request shall not be sent to the ETIAS National Unit for processing before the deadline referred to in the second subparagraph in paragraph 6. In all other cases, it shall be sent to the National Unit without undue delay.

Article 3 Confirmation of self-revocation by an ETIAS National Unit 1. After the applicant has confirmed the revocation request pursuant to Article 2(8) and, where applicable, the deadline referred to in Article 2(6) has passed, the ETIAS Central System shall send notification of the request to: (a) the ETIAS National Unit of the Member State responsible for issuing the travel authorisation; or (b) where the authorisation was issued by the ETIAS Central System, the ETIAS National Unit of the Member State of first intended stay. 2. The notification referred to in paragraph 1 shall include: (a) an indication that the authorisation holder has submitted a revocation request; (b) the date on which the request was confirmed; (c) the pre-filled information referred to in Article 43(1), point (a) and (b), of Regulation (EU) 2018/1240. 3. The ETIAS National Unit shall confirm the revocation and the addition of the information referred to in point (c) in paragraph 2. That information shall then be added to the application file. 4. If the applicant is present on the territory of a Member State when the request is introduced, the revocation shall become effective once the applicant has exited the territory and from the moment the corresponding entry/exit record has been created in the entry/exit system (EES) in accordance with Articles 16(3) and 17(2) of Regulation (EU) 2017/2226 (10). In all other cases, the revocation shall become effective upon confirmation by the ETIAS National Unit pursuant to paragraph 3 of this Article.

Article 4 Generation of self-revocation form 1. Following confirmation by the ETIAS National Unit pursuant to Article 3(3), a form for self-revocation based on Annex IV, shall be generated automatically by means of the software referred to in Article 6(2)(m) of Regulation (EU) 2018/1240. 2. The generated form shall be added to the application file and transmitted to the applicant in PDF format via the email service referred to in point (f) in Article 6(2) of Regulation (EU) 2018/1240. The email message shall include: (a) a reminder of the 5-year data retention period applicable to revoked travel authorisations; (b) a reminder that, where the self-revocation is finalised when the applicant is present on the territory of a Member State, it shall become effective once the applicant has exited the territory and from the moment the corresponding entry/exit record has been created in the EES, in accordance with Article 41(8) of Regulation (EU) 2018/1240. 3. Where, pursuant to Article 2(3), the applicant has entered a different email address from that used for the application, the form shall be sent to both the former and the new email address.

Article 5 Communication of public website and mobile app with the ETIAS Central System 1. For the purposes of Article 2: (a) the public website or the app for mobile devices shall inform the ETIAS Central System of the self-revocation request via the secure web service referred to in point (l) in Article 6(2) of Regulation (EU) 2018/1240; and (b) the ETIAS Central System shall verify whether the data submitted correspond to a valid travel authorisation. 2. Following the applicant’s confirmation of the self-revocation, pursuant to Article 2(8): (a) the website or the app shall inform the ETIAS Central System and, where applicable, the ETIAS National Unit that has issued the travel authorisation; and (b) where the applicant is not present on the territory of a Member State, the ETIAS Central System shall revoke the authorisation. Otherwise, the revocation shall be processed when the applicant exits the territory and the corresponding entry/exit record is created.

Article 6 Message format, standards and protocols The message format and the protocols to be implemented shall be documented in the technical specifications referred to in Article 73(3) of Regulation (EU) 2018/1240.

Article 7 Specific security considerations 1. The number of attempts that may be made to revoke a travel authorisation with the same travel document, application number or unique code shall be subject to limitation. In addition, measures shall be taken to protect the public website against non-human access. 2. The revocation process shall include measures whereby it times out after an appropriately defined period of inactivity. 3. Additional details concerning the confidentiality, integrity and availability of processed data shall be covered by the technical specifications referred to in Article 73(3) of Regulation (EU) 2018/1240.

Article 8 Activity logs 1. A log shall be kept of the applicant’s activity. It shall contain: (a) the applicant’s authentication data, including an indication as to whether or not authentication was successful; (b) dates and times of access by the applicant; (c) the confirmation of the self-revocation. 2. A log shall also be kept of the activity of the ETIAS National Unit confirming the self-revocation. It shall contain: (a) identification of the ETIAS National Unit in question; (b) dates and times of access by the ETIAS National Unit; (c) the confirmation of the insertion of pre-filled data referred to in Article 3(2)(c). 3. The logs referred to in paragraphs 1 and 2 shall be kept in the ETIAS Information System in accordance with Article 69 of Regulation (EU) 2018/1240. They shall be stored for no longer than 1 year after the end of the retention period for the application file, unless they are required for monitoring procedures that have already begun. After that period or after completion of such procedures, they shall be automatically erased. The logs may be used only for the purposes of Article 69(4) of Regulation (EU) 2018/1240.

Article 9 Entry into force This Decision shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

Done at Brussels, 25 January 2022. For the Commission The President Ursula VON DER LEYEN

(1) OJ L 236, 19.9.2018, p. 1.

(2) Council Decision 2002/192/EC of 28 February 2002 concerning Ireland’s request to take part in some of the provisions of the Schengen acquis (OJ L 64, 7.3.2002, p. 20).

(3) OJ L 176, 10.7.1999, p. 36.

(4) Council Decision 1999/437/EC of 17 May 1999 on certain arrangements for the application of the Agreement concluded by the Council of the European Union and the Republic of Iceland and the Kingdom of Norway concerning the association of those two States with the implementation, application and development of the Schengen acquis (OJ L 176, 10.7.1999, p. 31).

(5) OJ L 53, 27.2.2008, p. 52.

(6) Council Decision 2008/146/EC of 28 January 2008 on the conclusion, on behalf of the European Community, of the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation’s association with the implementation, application and development of the Schengen acquis (OJ L 53, 27.2.2008, p. 1).

(7) OJ L 160, 18.6.2011, p. 21.

(8) Council Decision 2011/350/EU of 7 March 2011 on the conclusion, on behalf of the European Union, of the Protocol between the European Union, the European Community, the Swiss Confederation and the Principality of Liechtenstein on the accession of the Principality of Liechtenstein to the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation’s association with the implementation, application and development of the Schengen acquis, relating to the abolition of checks at internal borders and movement of persons (OJ L 160, 18.6.2011, p. 19).

(9) Directive 2004/38/EC of the European Parliament and of the Council of 29 April 2004 on the right of citizens of the Union and their family members to move and reside freely within the territory of the Member States amending Regulation (EEC) No 1612/68 and repealing Directives 64/221/EEC, 68/360/EEC, 72/194/EEC, 73/148/EEC, 75/34/EEC, 75/35/EEC, 90/364/EEC, 90/365/EEC and 93/96/EEC (OJ L 158, 30.4.2004, p. 77).

(10) Regulation (EU) 2017/2226 of the European Parliament and of the Council of 30 November 2017 establishing an Entry/Exit System (EES) to register entry and exit data and refusal of entry data of third-country nationals crossing the external borders of the Member States and determining the conditions for access to the EES for law enforcement purposes, and amending the Convention implementing the Schengen Agreement and Regulations (EC) No 767/2008 and (EU) No 1077/2011 (OJ L 327, 9.12.2017, p. 20).