COMMISSION STAFF WORKING DOCUMENT

IMPACT ASSESSMENT

Accompanying the document

PROPOSAL FOR A REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

establishing an entry/exit system to register entry and exit data of third-country nationals crossing the external borders of the Member States of the European Union

1. ......... Procedural issues and consultations of interested parties. 4

1.1........ Background. 4

1.2........ Consultation of interested parties. 5

1.3........ Data gathering. 8

1.4........ Inter-service steering group. 9

1.5........ Impact Assessment Board. 9

2........... Problem definition. 9

2.1........ Why the creation of an EES is being examined. 9

2.1.1..... Border control aspects. 10

2.1.2..... Law enforcement aspects. 16

2.2........ Problem: how to design an EES?. 18

2.2.1..... The core features of an EES. 18

2.2.2..... Could these features be provided through existing systems?. 20

2.2.3..... Implementation issues. 21

2.3........ Baseline scenario – how would things evolve without new EU intervention?. 23

2.4........ Subsidiarity. 24

3........... Objectives of the Entry/Exit System.. 25

4........... Policy options. 26

4.1........ Policy option 1: Core system.. 26

4.2........ Policy option 2: Core system + biometric data. 27

4.3........ Policy option 3: Core system + law enforcement purposes. 27

4.4........ Policy option 4: Core system + biometrics + law enforcment purposes. 28

4.5........ Other issues linked to the four policy options. 28

4.5.1..... Transfer of data to third-country authorities. 28

4.5.2..... The retention period of the personal data in relation to each policy option. 29

4.5.3..... Technical implementation. 30

5........... Analysis of impacts. 31

5.1........ Policy option 1: Core system.. 31

5.2........ Policy option 2: Core system + biometric data. 33

5.3........ Policy option 3: Core system + law enforcement purposes. 35

5.4........ Policy option 4: Core system + biometrics + law enforcment purposes. 36

5.5........ Assessment of costs. 37

6........... Comparison of options and identification of the preferred policy option. 38

6.1........ Comparison of options. 38

6.2........ Technical implementation. 40

6.3........ Preferred option. 42

6.4........ Costs of the preferred option. 44

6.5........ Risks. 45

6.6........ European added value and proportionality. 46

6.7........ Legislative implications. 47

7........... Monitoring and evaluation. 47

1. Procedural issues and consultations of interested parties 1.1. Background

The present impact assessment report and the legislative proposal it accompanies[1] should be seen in the context of the progressive establishment of a European model of integrated management of the external borders. The legislative proposal is part of the "next generation of border checks" package which is a strategic initiative in the Commission's work programme for 2012[2]. This package responds to two major and interconnected challenges: how to efficiently monitor travel flows and movements of third-country nationals across the external border for the Schengen area as a whole, and how to ensure that border crossings are fast and simple for the growing number of regular travellers that constitute the vast majority of border crossers, i.e. those fulfilling all entry conditions. This report addresses the first challenge: a separate report[3] and legislative proposal address the second one. The two reports and proposals are not dependent on each other as regards their implementation but the setting up of an entry/exit system is a condition for providing fully automated border crossings for certain groups of third-country nationals, as further analysed in the second report; hence the entry/exit system strongly influences to which extent a Registered Traveller Programme can meet its objectives of facilitating travel flows.

In its Communication of 13 February 2008 preparing the next steps in border management in the European Union[4] the Commission suggested the establishment of an entry/exit system (EES). Such a system would entail the registration of the personal data together with the dates of entry and exit of each third-country national admitted for a short stay when they cross the external borders. The 2008 Communication was accompanied by an impact assessment report[5].

The proposals were subsequently endorsed in the Stockholm Programme[6] agreed by the European Council in December 2009, which reaffirmed the potential for an entry/exit system allowing Member States to share data effectively while safeguarding data protection. The proposal to set up an EES was therefore also included in the Action Plan Implementing the Stockholm Programme[7].

A Commission Communication in July 2010 on information management in the area of freedom, security and justice presented an overview of the EU-level measures in place or planned that regulate the collection, storage or cross-border exchange of personal information for the purpose of law enforcement or migration management[8]. It set out the conditions the Commission will apply in future when assessing any new system in this area including the approach of ‘privacy by design’.[9] It also drew the lessons of the development of other major systems in this area such as VIS and SIS II and concluded that 'as a possible safeguard against cost overruns and delays resulting from changing requirements, any new information system in the area of freedom, security and justice, particularly if it involves a large-scale IT system, will not be developed before the underlying legal instruments setting out its purpose, scope, functions and technical details have been definitively adopted.' It emphasised too that particular attention must be paid to the initial design of governance structures and pointed to the role that the new IT agency[10] could have in providing technical advice.

Strengthening security through border management is one of the five strategic objectives of the Internal Security Strategy[11] and includes the enhanced use of new technology for border checks, citing an entry-exit system.

The Visa Information System (VIS), which manages the exchange of short-stay visa data between the Schengen and Schengen Associated States, started operations on 11 of October 2011 at the consulates in North Africa, the Near East and the Gulf Region and 20 days after go-live of the VIS also at the border crossing points (verification of visas against the VIS).

The Conclusions of the European Council of 23 and 24 June 2011 called for work on "smart borders" to be moved forward rapidly. In response, the Commission adopted on 25 October 2011 a new Communication on the various options and the way ahead.[12] It concluded that the implementation of an EES would provide the Union with accurate data on travel flows in and out of the Schengen area at all parts of its external borders and on overstayers.

Against this background, the present impact assessment examines different implementation options in order to find the best possible way to implement the entry/exit system. However, the impacts of the whole EES are analysed based on the specific options.

The present report constitutes both the ex-ante evaluation required for programmes or activities occasioning expenditure from the EU Budget, and the impact assessment that will accompany the legislative proposal for the EES.[13]

1.2. Consultation of interested parties

The Commission considered that before proposing any new initiative, an in-depth technical assessment and debate with all relevant stakeholders on the future architecture of the EES was necessary.

Based on the discussions with and positions received from different stakeholders on 2008 impact assessment and communication, the Commission identified the following interest groups as the most relevant stakeholders for consultation: Member States, the European Parliament, the European Data Protection Supervisor (EDPS), civil society and the private sector. Third-country nationals travelling to the EU are not as such represented in any given interest group in an organised way and it is therefore by definition difficult to obtain their views. The consultation was carried out in several ways:

· publishing the 2008 Impact Assessment and Communication;

· presenting a comprehensive technical assessment and compilation of Member States' responses (three meetings with the Committee on Immigration and Asylum and two meetings with two different working groups of the European Security and Research Innovation Forum (ESRIF));

· distributing questionnaires to Member States;

· organising seminars and meetings including specific expert meetings and stimulating debate with discussion papers;

· meeting stakeholders bilaterally;

· publishing the 2011 Communication;

· giving presentations on the EES at different fora.

Member States

The entry/exit system has been under discussion at meetings with Member States' experts since 2008. Discussions with Member States were held in the Council on the basis of two questionnaires prepared by the French and Czech Presidencies. According to the replies submitted by Member States there is a consensus on the added value of the system and on the purpose of storing the information, namely to detect overstayers and to calculate the length of stay.

Further consultations with Member States both at expert and ministerial level took place in 2011 and early 2012.

In preparation for the conference on Innovation Border Management organised by the Danish presidency and the Netherlands on 2 and 3 February 2012 in Copenhagen, Member States replied to the Presidency's questionnaire on the RTP and the EES[14]. According to these replies, a majority of Member States support the establishment of the EES but most of them did not indicate their implementation preferences.

The summary of the conference prepared by the Presidency[15] concluded that the EES would bring significant benefits for the border check procedure and the management of migration and migration policy as such. However, it was considered that answers still need to be found to some technical and political questions such as the storage of the data, the use of biometric data from the start, access for law enforcement authorities, the abolition of the obligation to stamp the passports and last but not least the full respect of privacy of the traveller including data protection. In particular, the summary points out that "the definition and purpose of the EES must be clear from the start as these set out the terms for data protection."

European Parliament

In its resolution on the February 2008 Communication, the European Parliament, while accepting that the proposed system might help to deter third country nationals from overstaying, underlined that the correct functioning of the entry/exit system will depend both materially and operationally on the success of the VIS and SIS II.

The European Parliament (EP) did not submit its opinion on the 2011 communication[16].

At the high level conference on Innovation Border on 2 and 3 February 2012 in Copenhagen, Members of the European Parliament expressed the view that the SIS II and the other IT tools currently under development should be in place and evaluated before work on the EES can start.

European Data Protection Supervisor

In his opinion of 7 July 2011 on the Communication of the Commission on Migration the European Data Protection Supervisor (EDPS) stressed the need to assess first the possible better use of existing systems and to prove the necessity and proportionality of an EES in particular. The EDPS was also consulted informally on the 2011 Communication on smart borders before its adoption. He stressed in particular the need to obtain evaluation results of existing systems – notably the VIS – and that the use of biometrics should be contingent on conclusive proof that the use of alphanumeric data only is not effective. He also questioned the evidence available for assessing the problem of irregular migration and overstays, that the main purpose of the system must be set out clearly and exhaustively, that the retention period must be the shortest possible and only what is necessary in relation to the main purpose, and to carefully assess whether and to what extent access should be granted for law enforcement authorities. The EDPS provided comments on a draft of this impact assessment as well on a draft of the legislative proposal by letter of 10 August 2012. While welcoming the attention paid to data protection he considered that access for law enforcement purposes should not be granted and that biometric data should not be collected. As to specific comments he highlighted among other things the need to clearly define the purpose and the benefits of an entry/exit system.

Article 29 Data Protection Working Party

The Working Party addressed a letter to Commissioner Malmström on 12 June 2012 reacting to the 2011 Communication. It expressed doubts on the necessity of an EES and stressed that the reasoning needed to be appropriately explained, addressing comprehensively its impact on all fundamental rights. The Working Party considered that in any case the system should initially operate without biometric data, that the necessity of access for law enforcement purposes would need to be established separately, and that the retention period should be assessed against the main purpose of the system, ie detecting and preventing overstay.

Civil society and the private sector

Civil society (academia, think tanks and NGOs) and the private sector participated actively in the debate and organised several relevant conferences. Civil society provided input in various conferences and academic papers published on the subject. Most were critical of the setting up of an EES, considered that the added value was not proven and that it would not be proportionate to collect such amounts of personal data in relation to the aims pursued. At the conference in Copenhagen a representative of IATA expressed support for an EES provided the system does not have negative impacts on travel flows or lead to additional costs or burdens for airlines or airports.

The present report takes into account the questions and challenges raised by the stakeholders. Further details of the results of the consultations have been integrated in the description of the options and in the assessment of impacts. By presenting two communications opening for input for all stakeholders during a period of four years, the Commission has done its utmost in seeking the views of all stakeholders concerned.

1.3. Data gathering

Data-gathering and consultations with relevant authorities in the Member States and other stakeholders were undertaken by the Commission with the support of FRONTEX.

The following types of data were of principal interest:

· Information on current and future size of travel flows at the external border, distinguishing between types of borders (air/land/sea) and groups of travellers (EU citizens and visa exempt/required third country nationals);

· Time currently needed for border checks;

· Number of irregularly staying third-country nationals within the Schengen area, broken down by Member State, nationality, and causes for the irregular stay (irregular border crossing or overstay).

Data was collected through questionnaires[17] as well as case studies, pilot projects and literature reviews and was used in particular for describing the context, defining problems, specifying the most important implementation options and finally analysing the impacts. Comparable data were gathered on entries and exits and also on the time needed to carry out border checks on different categories of travellers at different types of external borders. However, shortcomings in the availability and/or comparability of existing statistical data and the fact that many aspects (customs check, security check, infrastructure, etc.) affect the time needed for border crossings has made comparison and analysis difficult. With regard to numbers and forecasts of traffic of passengers it is important to note a wide disparity in the information available according to the different means of transport. If the information on air transport is reliable due to the particular challenges for this sector, it is much more reduced in relation to other modes of transport and it is obviously lacking in the case of people travelling by their own means of private transport. Most importantly the data collection showed that Member States were not able to provide data or any reliable estimates on the number of overstayers on their territory, and as a consequence neither on nationalities or reasons for irregular stays. Estimates of such data could only be found via one research project[18], aggregated for the Union as a whole.

1.4. Inter-service steering group

An inter-service steering group was set up on 29 September 2009 involving the Legal Service (SJ), the Secretariat-General (SG), DG Taxation and Customs Union (TAXUD), DG Enterprise and Industry (ENTR) and DG External Relations (RELEX). The group met on 2 October 2009 and, joined by DG Justice, Fundamental Rights and Citizenship (JUST), on 2 December 2010, on 16 February 2011 and on 31 January 2012. The last meeting was also attended by representatives of DG Mobility and Transport (MOVE) and of the Joint Research Centre (JRC). Communication between the members of the group was also conducted via e-mail and telephone.

1.5. Impact Assessment Board

The Impact Assessment Board (IAB) reviewed the draft impact assessment and delivered its opinions on 14 March 2012 and (on a revised version) on 8 June 2012. The recommendations for improvement were accommodated in the revised version of the report. In particular, the following changes were made: further information is provided on the consultation of interested parties; the overall intervention logic has been reviewed and streamlined; the problem definition has been further developed and made more detailed, both in relation to the overall problem of irregular migration and in relation to specific implementation problems; the baseline scenario has been extended to better describe how it would involve without further EU action; the options have been restructured and simplified; the assessment of the options have been refined and done in a more logical manner showing which options are linked and which are not; the explanation of the method used for calculating the costs was expanded; the analysis and description of the preferred option have been revised and linked more directly to data that will become available in the future.

2. Problem definition 2.1. Why the creation of an EES is being examined

The 2008 impact assessment identified and examined irregular immigration, including the lack of data for identifying overstayers, and terrorism and serious crime as the main problems to be addressed through the creation of an EES. As explained in the 2011 communication:

'An EES would allow the accurate and reliable calculation of authorised stay as well as the verification of the individual travel history for both visa holders and visa exempted travellers as an essential part of first line risk-assessment. It would do so by replacing the current system of stamping passports with an electronic registry of the dates and places of third country national admitted for short stays. While the main purpose of the system would be to monitor respect of the authorised stay of third country nationals, the system would also contribute to optimising border check procedures and enhance the security at the moment of the crossing of the external borders. '[19]

The 2008 impact assessment assessed a wide range of policy options and identified the setting up of an entry/exit system as the preferred option. This impact assessment looks again at the overall problem definition as relevant for that conclusion in the light of developments since 2008 with regard to border control aspects, irregular migration, and technological developments, at European as well as national level. In particular, the following sections address difficulties related to monitoring the authorised stay of third country nationals, delays in border checks, the lack of information on irregular immigration, and use of entry/exit systems at national level in the Member States as well as in third countries. Based on the overall problem definition it then looks in more detail at the more specific problems related to how such a system should be designed.

2.1.1. Border control aspects 2.1.1.1. The difficulties of monitoring the authorised stay of third country nationals at the external border

According to the Schengen Borders Code, EU citizens and other persons enjoying the Union right of free movement (e.g. family members of EU citizens) crossing the external border shall be subject to a minimum check, both at entry and exit, consisting of the verification of the travel document in order to establish the identity of the person. Third-country nationals, however, must be subject, at entry, to a thorough check which, in addition to a travel document check, implies a check of their purpose of stay, possession of sufficient means of subsistence, as well as a search in the Schengen Information System (SIS) and in national databases.

Third-country nationals who do not have a residence permit or long-stay visa issued by a Member State are admitted for a short stay of maximum three months per six month period. This applies both for those who are subject to the visa obligation and those that are not. There are no provisions however in the Schengen Borders Code on the recording of travellers' movements into and out of the Schengen area. Currently, stamping the travel document is the sole method to indicate the dates of entry and exit which can be used by border guards and immigration authorities to calculate the duration of the stay of a third-country national, thereby allowing authorities to verify that the third-country national is in compliance with the rules on short stays. Other measures and tools available at border crossing points (such as databases, whose consultation is compulsory at entry, but not at exit) are not intended for the purpose of recording border crossings and do not provide for this functionality. Therefore there are no centralised electronic means to check if a third-country national has entered the Schengen area in one Member State and left via another.

The calculation of the exact time spent in the Schengen area of third-country nationals coming for a short stay based solely on stamps in the travel documents is both time-consuming and difficult. Checking a traveller who has been making 10 visits to the Schengen area during the last months means verifying 20 stamps. Maintaining the quality and security of the stamps requires both resources and efforts, as they can be subject to counterfeiting and forgery. In addition, there is no stored record available indicating that a third-country national has entered the Schengen area or of the time he/she has spent within it.

For these reasons, there are currently no reliable means to determine if a third-country national has exceeded his/her lawful right to stay and there is no consistent record of entries and exits of travellers to and from the Schengen area. Furthermore in-depth verification of the authorised stay is time consuming and can lead to tensions between border guards and travellers who, for example, need to catch a flight.

Difficulties affecting the legibility of the stamps as well as the absence of entry stamps were highlighted by the Member States in their replies to the questionnaire carried out by the Commission prior to the report on the operation of the provisions on the stamping of travel documents of third-country nationals.[20] The report also highlighted further problems encountered by third-country nationals crossing the external border frequently, such as lorry drivers or cross-border commuters, due to the need to use separate sheets for affixing the entry or exit stamps when there are no free pages left in the passport.

The setting up an entry/exit system would leave the current legislation and border checks unchanged except for the stamping of passports of third-country nationals, which would be replaced with the obligation to electronically record entry and exit dates in the entry/exit system and an automatic calculation of the authorised stay.

2.1.1.2. Increased border crossings and delays in border checks

According to the most recent comprehensive data provided by the Member States, there were 669 million external border crossings in 2009, 675 million in 2010, and 700 million in 2011, including EU citizens and third-country nationals. The number of border crossings did not increase significantly during the past few years, presumably because of the economic downturn. However, based on discussions with Member States, it can be assumed that border crossings at the largest and busiest border crossing points have been generally increasing and will continue to do so in the future[21]. Further predictions by Member State cannot be made with any precision; main third country nationality vary greatly between Member States eg due to their geographical situation and historical ties, and the development of those flows will be greatly influenced by the economic development in each third country in question.

To gather comparable data on border crossings, the Czech and Swedish Presidencies together with the Commission organised a data collection exercise at all external border crossing points between 31 August to 6 September 2009.[22] Based on this data, it is estimated that 73.5 % of travellers crossing the border are EU citizens or persons enjoying the Union right of free movement (9,1 million/week), 15,2 % are third-country nationals without a visa (2,1 million/week) and 11,3 % are third-country nationals holding a visa (1,4 million/week). On a yearly basis this means around 109 million third-country nationals without a visa and around 73 million with a visa. Most third-country nationals cross the border via land, the next largest number by air and the smallest number via sea borders. The number of third-country nationals crossing the border varies significantly between Member States and also between border crossing points.

Taking into account the size of travel flows and the principle of a thorough border check on all third-country nationals, queuing time at the border is a problem for many Member States. This problem is influenced by the time needed under current rules for systematic stamping of passports and the need to verify a sometimes long travel history based on previous stamps to calculate the authorised stay at entry and exit as described in the previous section. The implementation of the Visa Information System and the resulting obligation to verify the identity of all visa holders using fingerprints may further slow down border crossing times. The options for facilitating and speeding up border crossings is further assessed in the parallel impact assessment on the setting up of a Registered Traveller Programme, but this problem must be kept in mind when assessing the design of an entry/exit system also.

Differences between Member States in this regard are obvious due to geographical location (with or without an external land border) or size (with major airports). Future developments are linked to economic developments but also to developments in visa policy, where a lifting of the visa obligation with a neighbouring third country would most likely lead to a major increase in the travel flows to, in particular, the Member State(s) directly bordering that country.

2.1.1.3. Lack of reliable information on irregular immigration, in particular on overstayers, and problems of return

Reliable data on the number of irregular immigrants currently staying in the EU does not exist, a point emphasised by the EDPS in his preliminary comment on the draft 2011 Communication. Conservative estimates of the number of irregular immigrants within the EU vary between 1.9 and 3.8 million according to the results of Clandestino[23], an EU-sponsored project implemented by the International Centre for Migration Policy Development. Assessing how individual Member States are affected by this phenomena is therefore equally difficult and can only be a matter of estimates. It is generally assumed that the Member States most affected by irregular migration (including irregular border crossings as well as overstays) are those at the southern external border of the EU as well as the biggest economies of the EU. Future developments in this regard are hard to predict as they are influenced by the political situation in, especially, the wider European neighbourhood (cf Arab spring) and the economic situation in that region as well as in the EU, both in absolute and relative terms.

It is generally agreed that a clear majority of irregular immigrants are 'overstayers', i.e. persons who have entered legally for a short stay, with a valid visa when required, and then remained in the EU beyond the limit of their authorised stay.

In terms of apprehensions of irregular immigrants[24] in the EU, the total for 2011 was 351 000 which shows, in comparison to the above estimate, that a very small share of overstayers are actually apprehended.

The lack of reliable data is confirmed by the replies of Member States to the questionnaires mentioned in section 1.2. Only 14 Member States were able to provide data on the estimated number of irregular immigrants within their territory and the number of overstayers detected at the border. An additional four Member States were able to provide data for one of the two categories. The total number for the two categories was 76,669 persons, although it should be noted that three Member States accounted for 51,543 persons in total.

As a consequence of this lack of reliable data, no breakdown can be provided concerning overstayers per third country or per category of traveller[25].

As a result of the absence of any electronic recording of travel movements it is not possible at any given time to know who, among the millions of third-country nationals admitted legally for a short stay every year, has actually complied with the obligation to leave the territory after a maximum of three months. This means also that there is no information on the nationalities of overstayers or whether they are from countries subject to the visa obligation or not. The risk of overstay should be assessed by Member States authorities when assessing whether to grant a visa and whether to allow entry at the border, but there is thus limited feedback on which nationalities present a higher risk than others in this respect, as well as to whether the visa obligation is imposed on the third countries with a high overstay rate.

There is reason to believe that not all overstayers who voluntarily leave the territory are detected at the exit border check due to the problem of stamping as described above. Such overstays can therefore not be sanctioned (i.e. with a fine) or taken into account for a subsequent decision on allowing a new entry.

In turn this contributes to the difficulty in detecting those that do overstay in each Member State. Member States carry out random checks within the territory for this purpose, for example, at major transport hubs or workplaces suspected of hiring irregular migrants.

The low number of detections of irregular migrants taken together with problems of identifying them (as many will have no identification document) and in ensuring cooperation of third countries explain the low number of returns carried out by Member States each year compared to the overall estimate of the total number of irregular migrants on EU territory.

A major obstacle to effective return is uncertainty concerning the identity of the person and/or his or her lack of necessary travel documents, which may make it impossible to either issue a return decision or to enforce such a decision. Countries of origin often delay or deny the issuing of return travel documents because of missing information on nationality or identity. In order to avoid removal, irregular residents may therefore hide or destroy their travel documents and often claim a completely false identity and/or nationality. Figures provided for the follow up of the Return Directive show that over the last years, an average of only 200,000 out of 500,000 return decisions could be carried out, however, this data includes situations in which returnees could not be returned also due to other reasons, such as non-refoulement or because no third-country would accept them.

2.1.1.4. National EES systems and experiences with EES in third countries

There are several Member States and third countries implementing their own national entry/exit systems. 13 Member States[26] currently have such a system in place and the only data collected are alphanumeric. The main purpose of these systems is to give law enforcement authorities the opportunity to store travel records of certain third-country nationals in accordance with security-related national legislation. Therefore these Member States give access to their national systems not only to border authorities but also to law enforcement authorities for the purpose of investigating crime. As for non-Schengen countries, part of the UK's e-Borders programme aimed, among other things, to record entry and exit data based on the advance passenger information transmitted to government authorities by carriers transporting persons to the UK.

If a person lawfully exits the same Member State through which he or she entered, then any overstayer would be detected by the relevant national EES systems. Beyond that, there are no possibilities for using such systems to detect overstayers as entry and exit records cannot be matched when persons leave the Schengen area via a different Member State from the one through which they entered and in which their entry was recorded.

As regards third countries, the US-VISIT programme was implemented in the wake of 9/11 in the United States. The objectives of this system go considerably beyond those of an entry/exit system and are achieved by collecting, maintaining and sharing information on individuals who enter and exit the United States to detect fraudulent travel documents, verify traveller identity, and determine traveller admissibility through the use of biometrics[27]. The matching of entry and exit records for the purpose of identifying overstayers is currently done based on alphanumeric data, although pilot projects incorporating the use of biometrics have been carried out recently. While the number of overstayers remains significant, the creation of the exit part of an entry/exit system based on biometrics has been repeatedly postponed. The US-Congress has long pushed and is still pushing for a biometric exit system.The US Department of Homeland Security (DHS) stated that several more years are still needed to implement the technology because of the high costs, manpower and the scope of the issue due to the variety and number of ways to exit the United States, in particular through its land borders. The ultimate impediment to biometric exit is that highway lanes and other architecture have been designed for entry only[28]. This is the main reason why implementation problems are not transferable or applicable to the Schengen area, because there exists a full and complete developed architecture and sufficient human recources at all border crossing points in both directions.

Arrival and departure records of travellers to and from Australia are contained within the Movements Reconstruction database, set up in 1981. In Japan, a biometric border control programme for all non-Japanese citizens was introduced in 2007 as a measure for preventing terrorism and irregular immigration, while a system for recording biographical entry and exit data has been in place for several years.

At the high level conference on 2 and 3 February 2012 in Copenhagen (see footnote 15), representatives from the responsible authorities in the USA and Australia described the new systems as a success and as an effective tool for the authorities to detect irregular migrants and to fight serious cross border crime. However precise figures on the number of apprehended irregular migrants were not presented.

2.1.1.5. Summary of overall problems related to border control and irregular migration

The overall problems related to border crossings, stamping, irregular migration, overstays and returns have remained fairly constant since the impact assessment report of 2008 was carried out. There has not been any technological developments either that would influence the problems. These can be summarised as follows based on what was described in the preceding sections:

2.1.2. Law enforcement aspects

Border controls play an important role in combating terrorism and serious crime. Europol's EU Organised Crime Threat Assessment 2011 (OCTA 2011) points out that most organised crime involves international travel, including trafficking in human beings or the trafficking of illicit drugs, weapons and other illicit goods into the EU. Information about the travel record of persons who are suspects of these serious crimes can be necessary for criminal investigations.

Controls of third-country nationals at external borders involve identity checks and searches against various databases of known persons or groups posing a threat to public security that should be either apprehended or denied entry to the territory. Currently, all verifications are carried out based only on the travel documents. Even though the alerts on these persons may have been recorded in the Schengen Information System (SIS), or other national and international databases, they can only be identified on the basis of the alphanumeric data that was introduced with the alert. This makes it difficult for the authorities to detect a person using different identities to cross the borders.

In general, identification is essential for law enforcement authorities in their mission to prevent and combat terrorism and other serious crime. However, in the event that a third country national destroys his/her official documentation once having entered the Schengen area, it can be very difficult for law enforcement authorities to identify that person in case he/she is suspected of a crime or is a victim of crime. While data on EU citizens exists in different databases in Member States that are in general accessible to law enforcement authorities, there is an information and verification gap concerning third country nationals that are not covered by the Visa Information System (VIS).

2.1.2.1. Summary of overall problems related to law enforcement aspects

The overall problems related to identifying and detecting terrorist and criminal suspects have also remained fairly constant since the impact assessment report of 2008 was carried out. There has not been any technological developments either that would influence the problems. These can be summarised as follows:

2.1.3. Fundamental rights issues

An EES would, due to the personal data involved, in particular have an impact on the right to the protection of personal data, enshrined in Article 8 of the Charter of Fundamental Rights of the European Union. An EES would need to guarantee the right to an effective remedy before a tribunal (Article 47 of the Charter) for challenging a notification of an overstay, for example in cases of forced overstay, errors or when a migrant has a legal right to stay.

Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data[29] and the Regulation (EC) 45/2001 would apply to the processing of personal data carried out for the purpose of an EES respectively by the Member States and by the EU institutions, bodies and agencies involved. Negative impacts of sharing personal data have to be minimised by appropriate technical safeguards against misuse, clear legal limitations for access, including purpose limitations and data retention periods which are as short as possible.

Council Framework Decision 2008/977/JAI[30] on the protection of personal data processed in the framework of police and judicial co-operation in criminal matters, the Europol Decision 2009/371/JHA and the Regulation (EC) 45/2001 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data would apply to the processing of personal data if access would be given for law enforcement purposes.

According to the Commission Communication of July 2010 on information management[31], data protection rules should be embedded in any new instruments relying on the use of information technology. This implies the inclusion of appropriate provisions limiting data processing to what is necessary for the specific purpose of that instrument and granting data access only to those entities that ‘need to know.’ It also implies the choice of limited data retention periods depending solely on the objectives of the instrument and the adoption of mechanisms ensuring an accurate risk management and effective protection of data subjects' rights.

The system would have to comply with data protection principles and the requirements of necessity, proportionality, purpose limitation and quality of data. All safeguards and mechanisms should be in place for the effective protection of the fundamental rights of travellers particularly the protection of their private life and personal data. Third-country nationals must be made aware of these rights.

In accordance with data protection legislation, access should be given to the data stored in the entry/exit system only for specified, explicit and legitimate purposes. This means that the authorities who should have access to the entry/exit system have to be designated for a specific limited purpose. The EDPS raised this concern in his preliminary comment on the 2011 Communication as well as in his letter of 10 August 2012, stressing that the purposes and modalities of access to EES data have to be closely circumscribed. Therefore, access for consulting the data should be reserved exclusively to duly authorised staff of the authorities of each Member State who are competent for the specific purposes of the entry/exit system and limited to the extent the data are required for the performance of the tasks in accordance with these purposes.

2.2. Problem: how to design an EES? 2.2.1. The core features of an EES

An EES would need to allow the accurate and reliable calculation of authorised stay as well as the verification of the individual travel history for both visa holders and visa exempted travellers as an essential part of border checks. It would do so by replacing the current system of stamping passports with an electronic registry of the dates and places of border crossings of third country nationals admitted for short stays. As part of the preferred option, the 2008 impact asessment identified a "core" entry/exit system, that is, the common minimum features which are needed to develop the system in the first place, without prejudicing any choices on how it should be implemented. These core features are still valid in the light of the overall problem definition as described in section 2.1. There have been no technological developments since 2008 influencing these core features. They can be defined as follows:

· a system which records and stores, as a minimum, the basic alphanumeric data (equivalent to the biographic data in the passport) of a third-country national admitted for a short stay, together with the date and place of entry and exit, upon each crossing of the external border of the Schengen area, with a defined retention period for the storage of the data;

· a system that would automatically calculate the authorised stay and issue an alert to the authorised competent national authorities when there is no exit record on the expiry of the authorised stay;

· access to the data in the system would be given to the national authorities responsible for immigration and border control, at the external border and within the Schengen territory.

A number of safeguards would be integral to the core system, in particular for complying with fundamental rights:

· If there were errors on the identity checks of passengers, facilities would need to be made available for carrying out manual checks and for amending the data on entry and exit at all border crossing points. Regarding such facilities, the Schengen Borders Code currently requires that thorough second line checks for third-country nationals shall be carried out in a private area where the facilities exist and if requested by the third-country national.

· Individuals should have the right to access information held on them and to challenge and correct it, if the processing of this data does not comply with the provisions of Directive 95/46 and Regulation 45/2001, in particular because of the incomplete or inaccurate nature of the data. In case the information is held by law enforcement authorities following access to the EES, such rights shall be granted under Framework Decision 2008/977.

· Individuals should have the right to lodge a complaint with a data protection authority regarding the processing of their personal data and they should also have the right to effective administrative and judicial remedies (Article 47 of the Charter).

· Guarantees ensuring an effective remedy (Article 47 of the Charter) for third-country nationals that would enable them to challenge a notification of an overstay by the entry/exit system must be in place, for example in situations when they were forced to overstay, particularly if it appears that they overstayed for a valid reason (e.g. hospitalization, change in travel arrangements), when errors were made in recording dates of entry or exit or to show that they have a legal right to stay (e.g. based on a new visa, marriage to an EU citizen, application for asylum, refugee status). Given the large numbers of new travellers affected and the new requirement for them to provide information, safeguards for data protection and mechanisms for ensuring an effective remedy would need to be visible and evident.

· In case the entry/exit system notifies an overstay, this indication should not lead automatically to detention, removal or a sanction for the third-country national. Third-country nationals should have access to effective remedies in such proceedings in order to protect the right to liberty and security (Art. 6 of the Charter), right to asylum (Art. 18 of the Charter), respect for family life (Art. 7 of the Charter) and the obligation of non-refoulement (Art. 19(2) of the Charter). A decision to detain, remove or sanction a third-country national shall not be based solely on a nofitication of overstay by the entry/exit system. In addition the safeguards of Directive 2008/115/EC have to be respected.

· The supervision of all data processing activities should be carried out by Member States data protection authorities and the European Data Protection Supervisor which should be conferred with all the necessary powers to intervene and enforce compliance with data protection rules.

· The measures protecting rights of travellers, including right to an effective remedy, must also take into account the privileged position of non-EU family members of EU citizens whose right to enter and to stay depend on the right of the respective EU citizen in accordance with Directive 2004/38/EC.

2.2.2. Could these features be provided through existing systems?

A number of Member States raised the issue of whether the Visa Information System (VIS) could be expanded to incorporate the features of an EES.

The main purpose of the VIS is to permit the verification of the visa application history and, at entry, to verify whether the person presenting the visa at the border is the same person to whom the visa has been issued. It concerns only those third-country nationals who are required to hold a visa.

The VIS was not developed to keep track of entries and exits of third-country nationals nor is it meant to allow checking whether a person, after entering the EU legally, has or has not complied with the authorised stay according to the visa. The VIS feasibility study, carried out in 2003 before the development of the VIS, suggested that it would not be beneficial to develop several large-scale IT systems as one, nor to use VIS to record entry and exit data. It would need substantial changes to the nature and capacity of the VIS if entry/exit data were also to be recorded in it. The workflow of the VIS is optimised to deal with 10 million visa applications per year. Adding around 200 million records of entries and exits would require significant investments especially in hardware, software, data storage and communication infrastructure.

Moreover, there would be significant data protection implications if the system were to include both visa holders and visa-exempt persons. The principle of purpose limitation needs to be adhered to and the risk of function creep has to be prevented as highlighted by the EDPS in his opinion on the Communication on Migration.

Therefore the possibility of including entry/exit functionality in the VIS itself and the storage related to non-visa holders in the VIS can be discarded. However, there would be major technical and functional links between the Visa Information System (VIS) and the entry/exit system. Besides the same technical features and common matching functionality, VIS is the repository of the biometric identifiers of visa holders who will be registered in the entry/exit system. It must be checked systematically upon entry of the visa holders.

The technical development of an EES should therefore exploit technical synergies, organisational simplification and economies of scale to the maximum by using the same technical platform as VIS. Biometric matching functionality could be performed by the existing Biometric Matching System, which already provides such a functionality in the VIS. Furthermore, the fingerprints of the visa holders would not be stored in the entry/exit system, as they already exist in the VIS. Duplication of data would be subsequently avoided. This would allow also for cost savings by building on the technical platform of the VIS. Therefore, storing fingerprints of visa holders in VIS only and not in the entry/exit system would create economies of scale and avoid storing the fingerprints of visa holders twice. Indeed, building the EES on the same technical platform as the VIS (but not on the VIS itself) would mean that the EES would take advantage of the biometric matching functionality already built for VIS and would optionally re-use the visa holder fingerprints already captured for the benefits of VIS, without duplicating the effort or the data.

Annex 4 summarizes the other main EU level systems (SIS, Eurodac and the Prüm Decisions) that are currently used at the external border or which are relevant for internal security and migration management, the future plans for the systems and their possible link to the entry/exit system. Annex 6 summarizes the current and future management of those systems.

None of these instruments are, however, a pre-condition for the setting up of an entry/exit system, nor is there any potential overlap with the functions that an entry/exit system would carry out. Other developments in the EU's policy on border management are not relevant here, such as changes to the legal framework of Frontex, the development of Eurosur, or other amendments to the Schengen Borders Code. Likewise, no other initiatives to combat irregular immigration[32] or to combat serious crime and terrorism are relevant either for reducing the number of overstayers or the possibilities of identifying or detecting them.

2.2.3. Implementation issues

There are a number of key choices that need to be made when designing an entry/exit system and that will influence to what extent it will solve the overall problems described in section 2.1. These choices must maximise the overall usefulness and efficiency of the system while respecting fundamental rights. By maximising only usefulness and/or efficiency of the system there is a risk of contravening fundamental rights. For example, an EES could be designed so that it would store the largest possible amounts of data, any search criteria used would give access to all information (alphanumeric and biometric data) and flexible access rights would be given for all relevant authorities, even third countries. However, all this would cause exorbitant data protection implications and would not be proportionate against the objectives of the EES.

This involves choices both with regard to the overall architecture of the system and to additional features, including possible adaptations of the basic purpose of the system, in relation to the "core" system as described in section 2.2.1.

In summary the choices involve deciding the data to be collected and processed; defining with precision the purpose of the system; deciding the retention period of the data taking into account the purpose; and finally deciding on how to technically implement the system in practice.

2.2.3.1. What type of personal data should be included in the entry/exit system?

As mentioned above a minimum amount of alphanumeric personal data[33] on third-country nationals admitted for a short stay is required to make the system functional. The question arises, however, as to whether biometric data should also be stored on these travellers (taking into account that such data is used for the VIS) in addition to alphanumeric data. While the use of biometric data helps in identifying people, it would present a negative impact on privacy and data protection. It would also require more resources for processing and storing additional data. This is a recurring issue that was widely discussed especially in the context of the VIS.

The impact on the time taken for the border check process would also need to be taken into account given that biometric data for third-country nationals not requiring a visa, who make up approximately 15% of all travellers, is currently neither collected nor stored in any other system.

The question of which type of biometrics to use is not addressed further in this impact assessment as existing EU law already stipulates the use of fingerprints as concerns the VIS, e-passport, and residence permits.[34] This legislation also stipulates that children under the age of twelve and persons physically unfit to give fingerprints should be exempted from that requirement, so for these categories alphanumeric data only will always be used. Using the same biometric data (fingerprints) under the same conditions in an EES would therefore be consistent with previous policy choices at EU level and also allow for the use of the same infrastructure and equipment as used for the VIS.

2.2.3.2. For which purpose(s) and by which authorities could entry/exit data be accessed?

One of the problems in enforcing returns of irregularly staying third-country nationals is linked to proving the identity and nationality of the person in order for the third country in question to accept to readmit him/her. For that reason Member States have the right under certain conditions to share data stored in the VIS with third countries. Data generated by the entry/exit system could be shared in a similar way for the same purpose. However, the sharing of personal data with third countries raises important questions related to data protection and under what conditions such data could be shared.

Moreover, the data generated by the entry/exit system could support law enforcement authorities in the fight against terrorism and serious crime both as an identity verification tool and as a criminal intelligence tool. The use of such data for identity verification would reduce the above mentioned identification and verification gap concerning third country nationals that are not covered by the Visa Information System (VIS). The use of biometric data, and more specifically fingerprints, would substantially increase the added value of the entry/exit data in establishing the identity of a person who is suspected of a crime or a crime victim such as victim of trafficking in human beings. Biometric information provides a reliable means to establish the identity of a person and the comparison of fingerprints is generally acknowledged as an important source of information for fighting crime. This is both in cases where the third-country national has destroyed his/her documents, but also where law enforcement authorities are investigating a crime through the use of fingerprints and wish to establish an identity.

The data generated by the entry/exit system could also be used as a criminal intelligence tool for investigations and prosecutions of terrorism and serious crime. The data could be used to construct evidence by tracking the travel routes of a person suspected of having committed a crime. However, as law enforcement authorities would need to go back sufficiently in time in their analysis of travel routes, an effective use of the data generated by the entry/exit system as a criminal intelligence tool requires a commensurate period of retention of that data.

2.2.3.3. For how long should entry/exit data be stored?

The conditions set for the retention of the collected personal data would have to be precisely defined on the basis of the system’s objectives fully respecting data protection requirements. Whatever option is considered, the data retention period would have to be restricted to the minimum length required for the system to serve its purpose fully and effectively, while limiting the need for data from the same person to be enrolled several times over a short time-span. It should be ensured that the data in the record should be automatically erased after the retention period has expired. Conditions would also have to be defined for the possible advance deletion of data (e.g. in case the third-country national marries an EU citizen).

According to the information provided by Member States in 2009 concerning the existing national entry-exit systems, retention periods were ten years minimum in six Member States. For existing EU IT systems, the retention period is 2-10 years for Eurodac, 1-3 years for SIS, and 5 years for the VIS.[35] Member States did not provide concrete feedback on their preferred retention period for an EU EES.

This choice is directly dependent on the choices made with regard to the data to be stored and the precise purpose for storing the data. A table on the data retention period of the existing EU systems is in Annex 5.

2.2.3.4. Centralised vs decentralised storage of entry/exit data

This last implementation choice is essentially a technical one, independent of the previous choices, concerning how the system should be implemented technically to ensure reliable functioning as the system needs to be continuosly available at border crossing points, data security to prevent unauthorised access to the data stored in the system, and limit costs for developing and running the system. The system would eventually collect and store millions of records of third-country nationals personal data, which would need to be stored in a database to allow for matching of entry and exit records and the generation of alerts in case of overstay. A choice will therefore have to be made whether to set up a new centralised database at EU level, or whether the data could be stored at national level, with a connection for the exchange of data between the national databases. Lessons learnt from the development of other IT systems at EU level must be taken into account when making that choice.

2.3. Baseline scenario – how would things evolve without new EU intervention?

Currently there are some 700 million external border crossings every year. The tendency at least for the air borders is clearly leading upwards. For 2030 the figures of border crossings at the airports are expected to rise from 400 million in 2009 to some 720 million, an increase of 80%. As far as the expected development of irregular migration and overstay is concerned, it is difficult to estimate how figures for these phenomena will develop: Member States have not able to provide information on this issue. Both regular travel flows and irregular migration will be influenced by future economic development in the EU as well as in third countries.

The EU border management policy has to keep pace with this development. The optimisation of the existing instruments like the Schengen borders code and the role of the Frontex agency has continued but cannot address further this specific challenge. New instruments and possibilities to optimise the border management systems have to be found.

To cope with the increasing cross border travel and for the sake of speeding up and facilitation of border crossing procedures, IT technologies and new instruments are the most promising options.

It is reasonable to assume that the existing national entry/exit systems will continue to exist insofar they comply with EU law, in particular data protection rules. No other Member State has announced the development of a national system, awaiting the policy choices to be made at EU level concerning a European EES. In any case, national systems functioning in isolation will remain of little consequence as they cannot provide a response to the overall problems described in section 2.1.1.

In summary therefore the baseline scenario can be expected to develop as follows:

- Border checks will be carried in the same way as they are today, except that the biometrics of all visa holders will be verified at entry against the VIS as of 2014; this may contribute to preventing the legal entry of potential overstayers as this check will prevent identity fraud at the border; it may also increase the processing time of visa holding travellers at the border;

- The VIS will also give the possibility to identify overstayers within the territory who have entered legally with a valid short-stay visa and who are no longer in possession of their travel documents;

- The EU will continue its efforts towards further visa liberalisation with third countries based on the visa dialogues on-going for that purpose; however it can not be predicted when and for which third country the visa obligation will be lifted in the future; any such development will lead to an increase of the share of travellers who are not registered in the VIS when entering the EU;

- No tools exist or will be developed concerning visa exempt travellers with the exception of SIS/SIS II;

- In terms of overall irregular immigration, it is not possible to predict how the problem will evolve taking into account the influence of a number of economic and social factors as well as relations with and the situation in third countries; however, it can be assumed that the full roll-out and implementation of the VIS will have a positive impact in this respect;

- For the reasons outlined in section 2.1, different Member States may be affected differently by changes in travel flows and in irregular migration, but this cannot be predicted.

- The introduction of a Registered Travellers Programme could have a positive impact on reducing queuing time at the border, but this does not form part of the baseline as it is assessed in the parallel impact assessment report.

2.4. Subsidiarity

Under Articles 74 and 77(2) of the Treaty on the Functioning of the European Union (TFEU), the Union has the power to adopt measures relating to the crossing of the external borders of the Member States. Under Articles 82 (1)(d) and 87(2)(a) TFEU the Union also has the power to adopt measures to strengthen police and judicial cooperation by collecting, storing, processing, analysing and exchanging relevant information.

No Member State alone is able to cope with irregular immigration and with combating international terrorism and serious crime. A person may enter the Schengen area at a border crossing point in a Member State where a national register of entry/exit data is used, but exit through a border crossing point where no such system is used. The monitoring of compliance with EU rules on authorised stays can therefore not be done by Member States acting alone. Third-country nationals who enter the Schengen area are able to travel freely within it. In an area without internal borders, action against irregular immigration should in principle be undertaken on a common basis. Considering all this the EU is better placed than Member States to take the appropriate measures.

Although Member States may retain their national systems in accordance with security-related national legislation, an EU entry/exit system would allow Member State authorities to access data on third-country nationals who crossed the EU external border in one country and exited via another Schengen country.

Better information on cross border movements of third-country nationals at EU level would also facilitate the negotiation and conclusion of visa agreements between the EU and third countries and contribute to a common understanding of immigration issues with third countries of origin.

3. Objectives of the Entry/Exit System

The general policy objectives are, in order of priority:

· To counteract irregular immigration;

· To contribute to the fight against terrorism and serious crime and ensure a high level of internal security;

The specific objectives are:

· To enhance the efficiency of border checks through monitoring of the rights to authorised stay at entry and exit, and to improve the assessment of the risk of overstay;

· To monitor compliance with the authorised stay of persons within the territory;

· To generate reliable information to allow the EU and Member States to make informed policy choices concerning visa and migration;

· To identify and detect irregular immigrants, especially overstayers, also within the territory and to increase the possibilities for return;

· To identify and apprehend terrorist and criminal suspects crossing the external borders;

· To generate information that would reduce the identification and verification gap concerning third country nationals that are not covered by the Visa Information System (VIS) and that would contribute to the apprehension of terrorist and criminal suspects;

The operational objectives are:

· To create entry and exit records of third country nationals crossing the external borders;

· To automatically calculate the authorised stay and issue an alert when there is no exit record on the expiry of the third country national's authorised stay;

· To delete the EES data upon expiry of the retention period;

· To generate information on the size and trends of movements across the external borders, especially with regard to irregular immigration;

· To inform third country nationals of their rights and to implement effective appeal procedures.

4. Policy options

The problem definition and the consultation of stakeholders show that the key issues to decide are which data are to be processed in the system and for which precise purpose. The retention period needs to be chosen as a function of the choices made with regard to these two issues, that is, the shortest possible retention period needed to fulfill the purpose. The four policy options, in addition to the baseline (policy option 0), are therefore the following:

1) An entry/exit system with alphanumeric data for the purpose of border control and migration management; this option reflects essentially the "core features" of an entry/exit system as presented in section 2.2.1;

2) Same as policy option 1, with the addition of biometric data;

3) Same as policy option 1, with the purpose of the system extended to also include the fight against terrorism and serious crime;

4) Same as policy option 1, with the addition of biometric data and with the purpose of the system extended to also include the fight against terrorism and serious crime (so a combination of policy options 2 and 3).

Once the preferred policy option has been identified – in other words, what the system will do – a choice needs to be made how to implement the system technically.

4.1. Policy option 1: Core system

The alphanumeric data would include the surname, first names, birth date, sex, nationality as well as the number and expiry date of the travel document. Only an alphanumeric check would be made against the alphanumeric entry record upon exit.

In order to identify and return irregular immigrants, full access to the data stored in the entry/exit system should as a minimum be given to the competent border and immigration authorities carrying out checks at external border crossing points or within the territory of the Member States in order to determine whether the conditions for entry to or stay in the territory of the Member States are fulfilled. Such access corresponds to the basic purpose of border control and migration management.

This option would as such have the support of a large majority of Member States as it involves the setting up of an entry/exit system per se, but many Member States would consider it insufficient in view of that only alphanumeric data would be stored and no access would be given for law enforcement purposes. The concerns expressed by members of the EP and the EDPS related to overall proportionality and added value of an entry/exit system are valid also for this policy option, but to a more limited extent taken into account that this option represents the most limited set of data and the most limited purpose that is possible.

4.2. Policy option 2: Core system + biometric data

An entry/exit system with biometrics would in addition contain fingerprints of third-country nationals. For visa-exempt third-country nationals, fingerprints would need to be enrolled on first entry at an EU external border crossing point. When the individual exits, his fingerprints would be verified against his/her entry record. For third-country nationals requiring a visa, the fingerprints enrolled at a consular post and stored in the VIS when applying for a Schengen visa would be verified on entry and exit at an EU external border crossing point. This option is in particular linked to the problem of identifying irregular migrants within the territory who are no longer in possession of their travel documents, and the specific objective of identifying and increasing the possibilities for return of those persons.

The results of discussions on the 2011 Communication showed that a large majority of Member States support the introduction of biometrics from the start of the system. In his preliminary comment on the Communication, the EDPS considered that the use of biometric data should only be considered if there is conclusive proof that the use of alphanumeric data only is not effective and that the impacts of the use of biometrics on privacy should be thoroughly examined.

4.3. Policy option 3: Core system + law enforcement purposes

In addition to the authorities mentioned under option 1 this sub-option would foresee access to the alphanumeric data, under specific conditions, to be given to national authorities and Europol for the purpose of fighting terrorism and serious crime, mirroring the solution for the VIS according to Council Decision 2008/633[36].

Member States' designated law enforcement authorities and Europol would consult the entry/exit data in a specific case, e.g. to establish the travel route of a person suspected of having committed a terrorist offence or another serious criminal offence, when there are reasonable grounds to consider that the consultation of the entry/exit data will substantially contribute to the detection or investigation of this offence.

Under this policy option, compared to the "core features" described in section 2.2.1, special data protection rules could be added to the extent necessary. For instance, the system could be developed in such a way that only specific data sets would be accessible and/or modifiable by specific authorities and data sets could be unlinked at the back-end. The database could also be designed to only provide a summary of events after a certain length of time or indeed to certain authorities. Such a 'privacy by design' approach limits the possibilities of abuse from the outset. The 2008 Framework Decision requires Member States in particular to lay down effective, proportionate and dissuasive sanctions to be imposed in case of infringement of data protection provisions, including criminal sanctions for particularly serious and intentionally committed infringements. Such safeguards would minimise the impact on fundamental rights and entry and exit data on travellers would automatically be deleted after the end of the retention period.

This is relevant for the problems described in relation to law enforcement aspects and the specific objectives of identifying and verifying terrorist and criminal suspects.

The results of discussions following the adoption of the Communication on smart borders showed that a large majority of Member States support the use of the information stored in the system not only for the purpose of border control but also by other immigration and law enforcement authorities.

4.4. Policy option 4: Core system + biometrics + law enforcment purposes

This is a combination of policy options 2 and 3: in addition to the core system biometric data would be stored as described under policy option 2, and access would be given to law enforcement purposes as described under policy option 3.

Member States' designated law enforcement authorities and Europol would consult the entry/exit data in a specific case for the purpose of establishing the identity of a person who is a crime victim or of a person who is suspected of having committed terrorist offences or other serious criminal offences if there are reasonable grounds to consider that this consultation will substantially contribute to this purpose.

This is likely to be the policy option most supported by the Member States, and the least supported by the EP and the EDPS.

4.5. Other issues linked to the four policy options 4.5.1. Transfer of data to third-country authorities

The transfer of data stored in the entry/exit system to border and immigration authorities of certain third countries could be authorised in compliance with fundamental rights and, subject to conditions, for the fight against irregular immigration. This would mirror the solution for the VIS where transfers of certain specified alphanumeric data are possible for the purpose of assisting the identification of a third-country national in relation to his/her return. This is linked to the specific objective of increasing the possibilities of returning irregularly staying third-country nationals. The validity of authorising such transfers is wholly dependent on the use of biometric data as the purpose of sharing data with a given third country would be to provide proof of the identity and nationality of a given individual to be returned to that country. This issue will therefore not be further assessed but taken as directly linked to the overall choice of the policy options, ie if policy options 2 or 4 would be chosen such transfers would be authorised for the purpose as described above.

Moreover, should access be given to law enforcement authorities of the Member States and Europol (cf policy options 3 and 4), transfers of data to the law enforcement authorities of certain third countries for the purpose of fighting terrorism and serious crime could be envisaged. However, access for certain third countries for law enforcement purposes would have significant negative implications for data protection having regard to the potentially vast amounts of data that could be shared and the risk of "data mining". It would require the negotiation and conclusion of an extensive agreement with selected third countries to ensure, to the greatest possible extent, that the EU can regulate how and for what purpose such data would be used, and how long it would be stored. Certain third countries may also misuse access to data on their citizens (e.g. political dissidents) for exercising repercussions on the members of their families still present in that third country, which requires a serious analysis into which countries could potentially gain such access and under what strict conditions. Transfers of data for this specific purpose is therefore discarded regardless of which policy option is chosen.

4.5.2. The retention period of the personal data in relation to each policy option

For the determination of the retention period it has to be considered that for reasons of data protection as guaranteed by Article 8 of the EU Charter of Fundamental Rights and Article 8 of the European Convention on Human Rights, personal data should not be kept any longer than it is necessary for the purposes for which the data were collected. This principle was also stressed by the EDPS in his preliminary comments on the 2011 Smart Borders Communication. It should be ensured that the data in the record should be automatically erased after the retention period has expired. Conditions would also have to be defined for the possible advance deletion of data (e.g. in case the third-country national marries an EU citizen).

The shortest possible retention period would, as a minimum, be the time that the data is required for the calculation of the authorised stay, meaning a minimum of six months. Once the person has exited the Schengen area the need to store his or her personal data, and the entry/exit record, is significantly reduced. In other words, the data has served its purpose to monitor the respect of the authorised stay and should only be stored for a maximum of another 6 months to allow the correct calculation of the permitted stay of 90 days within a period of 180 days. However, the period cannot be set the same for all travellers, since for an overstayer who has not exited the territory it would be necessary to store the data for a longer period. This period can be set at 5 years, to ensure that data are available long enough to support the identification and return process, while remaining proportionate by setting an upper limit. It would also be coherent with the retention periods for the VIS and that envisaged for the RTP, and support applicants for a multiple-entry visa or to the Registered Traveller Programme, both in proving a travel history without overstays when applying for the first time as well as when applying for renewing their multiple-entry visa and/or access to the RTP. For a person who has exited within the authorised period of stay, and only visited the Schengen area once for a maximum of three months during a six month period, the data can be deleted after six months. To be effective and to benefit Member State authorities as regards future visa and entry decisions, statistical data in a fully anonymous form would have to be retained for a longer period on the history of cross border movements of third-country nationals, by nationality and visa required/exempt.

However, from a law enforcement point of view, and especially for the use of this data as a criminal intelligence tool, a travel record of a suspect of crime would need to cover a commensurate period of retention, possibly with several entries and exits, in order to have any added value as a source of information for law enforcement authorities. Hence should the purpose of the system be extended to include the fight against terrorism and serious crime, a retention period of, as a general rule, six months would be too short to allow the system to meet its purpose. In order to construct evidence in criminal cases by analysing data on travel routes, law enforcement authorities have to be able to track the travel routes back for a period of several years.

Consequently the retention period in relation to the policy options would be the following:

· For an entry/exit system set up on the basis of either policy options 1 or 2, as a general rule 6 months, while for travellers who have not exited the territory within the authorised stay the period would be 5 years, and for participants in the RTP a period equivalent to the time they are granted access to the system;

· For an entry/exit system set up on the basis of either policy options 3 or 4, the retention period would be five years for all travellers.

4.5.3. Technical implementation

Two possibilities for the technical implementation can be identified. These will be further assessed in the light of the preferred policy option.

National databases running regular crosschecks

Member States would be responsible for the storage of data in a national system as well as for the acquisition and maintenance of those systems. At EU level, the setting up of a secure communication infrastructure for the exchange of data would be required, as the entry and exit data could be stored in different Member States for the same person (e.g. entering the Schengen area via one Member State and exiting through another).

This could involve obliging each Member State to set up a national EES. However, from a technical perspective, stand-alone national systems operating on a small scale as they currently exist in some Member States (cf section 2.1.3.) would not be of use or adapted to this solution. Despite their autonomy, such national systems should be built on the same technical platform and adopt interoperable technical specifications to communicate with the central infrastructure.

Central database with national interfaces

This would mirror the solution for the VIS with central storage (at EU level) of the data, with the establishment and maintenance of a central database and a secure communication infrastructure between the central database and Member States, including the national interfaces. Member States would be responsible for establishing the national systems and transmitting data according to defined parameters and specifications. The development and operational management of the central database and the communication infrastructure would be handled by the Management Authority, which would be the Agency for the operational management of large-scale IT systems established by Regulation (EU) No 1077/2011 of the European Parliament and of the Council of 25 October 2011 (the Agency)[37] set up to manage existing systems (SIS II, VIS, Eurodac) as well as to develop and operationally manage any future large-scale IT-systems in the area of justice, freedom and security. This approach was clearly favoured by Member States during the consultations in terms of cost-benefits and synergies with other systems.

5. Analysis of impacts

This section considers each of the four policy options described in section 4 against the assessment criteria. The options have been rated on a nine-point scale with respect to their likely performance relative to the general and specific objectives. The options are assessed against the baseline. All options are also assessed against other relevant criteria, in this case criteria belonging to the general economic and social criteria:

· The border management process, in particular ensuring a fast processing of travellers without compromising security.

· Protection of fundamental rights, particularly protection of personal data (Article 8 of the Charter), right to liberty and security (Article 6), respect for private and family life (Article 7), right to asylum (Article 18), protection in the event of removal, expulsion or extradition (Article 19) and right to an effective remedy (Article 47)..

· The total one-time development costs of the system related to the expected duration of three years and the total yearly operational costs for the ensuing period of five years, split into central (EU) and national (Member States) costs; the tables in annex 2 contain more detailed information on cost categories and costs per item; a breakdown and further description of administrative costs is provided in this annex also.

The impacts have been indicated graphically with symbols:

- √√√√ || Highest negative impact/cost

- √√√ || Significant negative impact/cost

- √√ || Medium negative impact/cost

- √ || Small negative impact/cost

0 || No impact

√ || Small positive impact/savings

√√ || Medium positive impact/savings

√√√ || Very significant positive impact/savings

√√√√ || Highest positive impact/savings

5.1. Policy option 1: Core system

· To counteract irregular immigration √√

The efficiency of border checks will be enhanced compared to the baseline. Replacing the stamping obligation will speed up the border checks, as alphanumeric data can be entered into the system in a matter of seconds by scanning the passport using already existing equipment at the border crossing points. Likewise the automatic calculator will immediately provide the border guard – and the traveller - with precise information of the authorised stay, which is of particular importance when, for example, a traveller is returning for multiple entries and exits during the 6 month period. This also means that the border guard will have immediate and precise information at exit whether the traveller has complied with the maximum authorised stay.

Compared to the baseline precise information will be available on the structure and composition of irregular migrants overstaying, meaning that visa and border authorities will have information on the nationalities and type of travellers (visa exempt or not) most at risk for not complying with the rules. This will support the application of the Visa Code, which in its Article 21 refers to the assessment of the risk of illegal immigration as part of assessing the visa application. This information can also help to better understand the overall phenomenon of irregular migration and influence visa policy, where a low rate of overstays would be an important factor in considering whether to lift the visa obligation for nationals of a given third country.

The core system would also provide the EU with a precise overall understanding of who is crossing the borders and who is on the territory, something which can be seen as a core responsibility of the state in managing access to its territory.

A positive impact can be assumed as the information can be used together with other data on the presumed place of stay of the person and other information indicating where the possibilities of apprehending irregularly staying migrants are the highest and hence help in deciding where to carry out spot checks. The information provided by the system on persons whose identity is known can contribute to enforcing a return decision. The system would thus have a positive impact in reducing the current gap between return decisions issued and decisions actually enforced.[38]

A further positive impact comes from the capacity to monitor voluntary returns. Information on persons subject to a return decision who subsequently decide to return voluntarily (for which preference should be given according to the return directive) are often not available to Member States' authorities today as no information is registered at exit when the person crosses the external border. The EES would ensure that such information is available to Member States' authorities, thus avoiding that persons are considered not to have complied with the return decision and in turn risks being imposed with an entry ban, although the person may have complied with the decision within the prescribed period of time.

In terms of actually detecting persons within the territory the impact compared to the baseline is more uncertain. Information that a given person has overstayed will by no means lead to an automatic apprehension as the person can at that time be in any of the 26 countries of the Schengen area.

To fight against terrorism and serious crime 0

The impact of this policy option on this criterion can be regarded as close to zero taking into account that no access to the system is given for the purpose of investigating serious crime or terrorism under this option. A small indirect impact may occur due to more effective border checks on typical cross-border crimes such as trafficking in human beings or the trafficking of illicit goods.

Border management process 0

The impact on the border management process of an entry/exit system based on alphanumeric data at entry would be positive, as the only process required is to swipe the machine-readable zone of the passport, which is already done today; adding this process at exit would add only 10 seconds (max) to the process, so the negative impact would be negligible. A positive impact will result from abolishing the manual stamping of the passport of travellers and need to manually calculate the authorised stay. Annex 3 provides further information on the impact of the entry/exit system in the border processing.

However, a certain number of false hits and mistaken identities could be expected due to the use of alphanumeric data only to match entry and exit records. For example, this could mean that a traveller registered as having entered on a given date is registered in another name on exit and as a result the system would signal the person as an "overstayer" although he or she has effectively left the Schengen area. This could occur, for example, for persons travelling with two equally valid passports. The effects will need to be mitigated by a careful scrutiny of the responses given by the system, especially at exit, where a missing entry record should be immediately checked and clarified before the traveller passes the border check.

· Protection of fundamental rights, particularly privacy and data protection -√

The recording of the border crossings would create a 'track record' of the cross-border movements of any individual and in order to guarantee the respect of fundamental rights the safeguards listed under section 2.2.1 and the purpose limitation must always be fully complied with. However, this recording can also have positive impacts as it could also be in the interest of the individual traveller e. g. in case he or she applies for the RTP or for a multiple entry visa, and by generating a reliable travel history and proof of compliance with the existing rules regarding the right to stay. While the storage of data is vast compared to the baseline, taking into account the limited retention period the overall impact on data protection can be regarded as limited under this option, and proportionate in relation to the objectives.

5.2. Policy option 2: Core system + biometric data

· To counteract irregular immigration √√√

This policy option would have a significant effect on reducing irregular immigration compared to the baseline. The biometric identifiers of third-country nationals holding a visa will be stored in the VIS (part of the baseline) and it will therefore be possible to identify them biometrically at border crossing points or within the Schengen area even without travel documents. Conversely, this would not be possible in the case of third-country nationals not holding a visa, if the entry/exit system were to be implemented without biometrics. Therefore, if biometrics are captured and stored also from third-country nationals not holding a visa, this policy option is likely to have a significant impact on reducing irregular immigration as it will allow for identifying any undocumented third-country national found within the territory.

It should nevertheless be recalled that compared to the baseline – which includes the VIS – the added value cannot be assessed with precision due to the absence of reliable data on the share of overstayers who entered legally with and without a visa respectively. The greater the share of overstayers who are visaholders, the lesser the impact of using biometric data in the EES. That share may change – in any direction – due to a possibly evolving baseline in the future, where the visa obligation is gradually lifted for further third countries.

A further positive impact on border control of this policy option would be the possibility to prevent identity fraud: as long as the data is stored, it would be impossible for an individual to cross a second time using another travel document with another identity, as his/her fingerprints can be compared with those stored at the first entry. It would also make it impossible for different individuals to use the same travel document.

To fight against terrorism and serious crime 0

Same as for policy option 1.

Border management process 0

As noted under the baseline, with the integration of the VIS into border check processes, border control procedures have become more complex. Visa holders will all be subject to a biometric verification against the VIS at the border, once the transition phase of three years (started on 31 October 2011) will have expired.

An entry/exit system with biometrics would introduce, in addition, the capturing of biometrics at the first entry and the subsequent biometric verification of the visa-exempt third-country nationals, who make up approximately 17% of all travellers. This will affect the time it takes to conduct a border check in comparison with a traditional check. Member States will need to ensure that their border crossing points take into account the possible increase in queuing time for third-country nationals, and adjust their procedures at border crossing checkpoints accordingly. This negative impact will concern all Member States with significant travel flows at the external borders, and in particular those with long land borders. However, this negative impact of biometrics should be nuanced by the fact that the process of recording biometrics of visa exempted third-country nationals will be done only at the first entry and will not need to be repeated as long as the data is still stored in the system.

Positive impacts on border control would occur due to the use of biometric data as the risk of mismatches would be minimised, as with biometric data entry and exit records can be matched using a unique identifier, ie fingerprints, of each traveller.

Transitional provisions as in the VIS for the compulsory use by Member States of biometrics could be considered for an entry/exit system also. However, also in that case it would be necessary to decide whether to use biometrics from the start taking into the overall impact of that choice. Moreover, there is a risk of uneven levels of security at the external borders, as persons not subject to the visa obligation could effectively chose whether their fingerprints will be recorded or not by choosing to enter the Schengen area via a Member State that is making use of such transitional provisions. Consequently any transitional period must provide for one common approach for all Member States, instead of allowing an individual Member State not to use biometrics.

The introduction of a Registered Traveller Programme would help to mitigate these effects, in particular at air borders, as further analysed in the respective impact assessment.

The exact impact on the border management process, including how that impact may differ between land, sea and air borders, can only be fully assessed after the full implementation and rollout of the VIS as of 2014, both with regard to adapting the processes and travel flows at the border crossing points as well as with regard to the use of mobile equipment for verifying fingerprints during the border check process (e.g. at land borders).

· Protection of fundamental rights, particularly privacy and data protection -√√

Fundamental rights are clearly negatively impacted by the use of biometric identifiers in combination with the systematic recording of border crossings of third-country nationals. Use of biometric identifiers would at the same time however reduce the instances of identity fraud and safeguard the identities of travellers. Otherwise the same considerations as raised under policy option 1 are relevant here also.

5.3. Policy option 3: Core system + law enforcement purposes

· To counteract irregular immigration √√

Given the longer retention period (5 years) for this policy option consulates and border guards would have better means for assessing the risk of future overstays on the basis of solid evidence in relaton to a given individual, i.e. a person who has travelled to the EU several times over the last five years and has never overstayed presents a practically non-existent risk of overstaying, and vice versa. Beyond this the impact is the same as for policy option 1.

To fight against terrorism and serious crime √√

The entry/exit system would provide a record of travel histories of travellers including those who are suspects of crime. It would thus complement the information in the SIS.

The data generated by the entry/exit system could be used in specific cases as a criminal intelligence tool for investigations and prosecutions of terrorism and serious crime. The data could be used by law enforcement authorities to construct evidence by tracking the travel routes of a person suspected of having committed a terrorist offence or another serious crime. There would therefore be a positive impact on this objective.

Without biometric information, the data generated by the entry/exit system could not be used to establish the identity of person who is suspected of a crime or a crime victim in case that person no longer holds any official documentation. However, law enforcement authorities could still consult the system in order to check the documents presented by a suspect or found with a victim against the alphanumeric data in the system.

It should be noted that also without access for law enforcement purposes to an EU EES, Member States could continue to operate their national EES (where existing) and to provide for such access at national level.

Border management process 0

Same as for policy option 1.

· Protection of fundamental rights, particularly privacy and data protection -√√

It can be seen as stigmatising to store the data of a traveller due to the simple fact that he/she has crossed the external border, and a risk of abuse certainly exists as that data would allow retracing the movements of an individual over a long period of time. The large amount of data that would be stored in the system should also be taken into account (cf size of travel flows in chapter 2) in relation both to the core purpose (border and migration management) and to the more extended purpose of law enforcement: the system would store hundreds of millions of records for 5 years although only a very small – and based on existing data, impossible to quantify - share of those records would be of interest in order for the system to meet its purposes. The resulting increase in the retention period would also lead to that the cumulative size of the database, at any given moment, would be 10 times bigger compared to options 1 and 2. The proportionality of this option compared to the baseline can therefore