EN Official Journal of the European Union C 162/9

Summary of the Opinion of the European Data Protection Supervisor on the Proposal for a European Travel Information and Authorisation System (ETIAS)

(The full text of this Opinion can be found in English, French and German on the EDPS website www.edps.europa.eu)

(2017/C 162/06)

EU border management policy has witnessed notable developments over the past years, due to the challenges posed by the influx of refugees and migrants, as well as security concerns heightened by the attacks in Paris, Brussels and Nice. The situation at present and the need to guarantee safety within the territory of the Member States prompted the Commission to launch several legislative initiatives aiming at improving control over persons accessing the Schengen Area.

One of these initiatives is the Proposal for a Regulation establishing a European Travel Information and Authorisation System (‘ETIAS’), tabled by the Commission on 16 November 2016.

According to the Proposal, the system would require visa-exempt travellers to undergo a risk assessment with respect to security, irregular migration and public health risks prior to their arrival at the Schengen borders. This assessment would be carried out by means of cross-checking applicant’s data submitted through ETIAS against other EU information systems, a dedicated ETIAS watchlist and screening rules. This process will result in granting — or denying — an automated authorisation for entering the EU.

With the ETIAS Proposal, the EU legislator appears to follow the increasing trend of addressing security and migration management purposes jointly, without taking into account the substantial distinctions between these two policy areas. The establishment of ETIAS would have a significant impact on the right to the protection of personal data, since various kinds of data, collected initially for very different purposes, will become accessible to a broader range of public authorities (i.e. immigration authorities, border guards, law enforcement authorities, etc.). For this reason, the EDPS considers that there is a need for conducting an assessment of the impact that the Proposal will entail on the right to privacy and the right to data protection enshrined in the Charter of Fundamental Rights of the EU, which will take stock of all existing EU-level measures for migration and security objectives.

Moreover, the ETIAS Proposal raises concerns regarding the process of determining the possible risks posed by the applicant. In this regard, specific attention should be given to the definition of those risks as such. Given that the consequence for an individual could be a denial of entry, the law should clearly define what the assessed risks are. The EDPS also questions the existence of the ETIAS screening rules. The EDPS understands that the legislator’s objective is to create a tool enabling the automatic singling out of visa-exempt third country nationals suspected of posing such risks. Nonetheless, profiling, as any other form of computerised data analysis applied to individuals, raises serious technical, legal and ethical questions. Therefore, the EDPS calls for convincing evidence supporting the necessity of using profiling tools for the purposes of ETIAS.

Furthermore, the EDPS questions the relevance of collecting and processing health data as envisaged in the Proposal. He asks for better justification of the chosen data retention period and of the necessity of granting access to national law enforcement agencies and Europol.

Finally, he provides recommendations for instance on the division of roles and responsibilities between the different entities involved and the architecture and information security of ETIAS.

I. INTRODUCTION

1. The European Commission’s initiative of establishing a European Travel Information and Authorisation System (hereinafter referred to as ‘ETIAS’) dates back to a Communication of 2008 entitled ‘Preparing the next steps in border management in the European Union’ (1). In this Communication, the Commission suggested new tools for the future management of European borders — notably the Entry/Exist System (‘EES’) and the Registered Traveller Programme (‘RTP’) — and considered for the first time the introduction of ETIAS, called an EU Electronic System of Travel Authorisation (‘ESTA’) at the time. The EDPS issued preliminary comments (2) on this Communication the same year.

2. In February 2011, the Commission issued a Policy Study (3) analysing four different options for the introduction of an EU ESTA. The Study reached the conclusion that the conditions were not met at the time to justify building an EU ESTA. In a Communication (4) of 2012 related to Smart Borders, the Commission considered that the establishment of an EU ESTA should be temporarily discarded but announced its intention to continue the work on the EES and the RTP.

3. In the Communication (5)‘Stronger and Smarter Information Systems for Borders and Security’ of 6 April 2016, the Commission announced that it will assess the necessity, technical feasibility and the proportionality of establishing a future European Travel Information and Authorisation System. The same year, the Commission carried out a Feasibility Study, which used as a benchmark three other existing travel authorisation systems in the world: the ESTA in the USA, the eTA in Canada and the eVisitor in Australia.

4. On 16 November, the Commission released the Final Report of the Feasibility Study (6) (hereinafter referred to as ‘2016 Feasibility Study’) as well as the Proposal for ETIAS (hereinafter referred to as ‘the Proposal’).

5. The EDPS welcomes that he was informally consulted by the Commission services before the adoption of the Proposal. However, he regrets that due to the very tight deadline and the importance and the complexity of the Proposal it was not possible to provide a meaningful contribution at that time.

V. CONCLUSION

113. The EDPS welcomes the attention paid to data protection throughout the Proposal for the establishment of ETIAS.

114. In full respect for the role of the legislator in assessing the necessity and the proportionality of the proposed measures, the EDPS recalls that these two high-level legal requirements enshrined by the Charter can be scrutinised by the Court of Justice of the EU and that the EDPS is tasked with safeguarding them. He underlines that the lack of a (data protection) impact assessment does not make it possible to assess the necessity and proportionality of ETIAS as it is currently proposed.

115. Since the Proposal establishes an additional system involving the processing of a significant amount of personal data of third country nationals for immigration and security objectives, the EDPS advises the legislator to take a stock tacking exercise of all EU-level measures involving data processing for migration and security objectives and to conduct an in-depth analysis in terms of theirs goals and achievements.

116. In this context, the EDPS recommends to include a definition of irregular migration risks and security risks in the Proposal to comply with the purpose limitation principle.

117. Furthermore, the EDPS is concerned whether the use of the ETIAS screening rules will be fully in line with the fundamental rights enshrined in the Charter. He recommends that the proposed ETIAS screening rules be subject to a prior comprehensive assessment of their impact on fundamental rights. He also wonders whether convincing evidence supports the necessity of using profiling tools for the purposes of ETIAS and, quod non, encourages the legislator to reconsider the use of profiling.

118. The EDPS questions the relevance and the efficiency of the collection and processing of health data as envisaged in the Proposal due to the lack of their reliability. He also wonders about the necessity to process such data due to the limited link between health risks and visa-exempt travellers.

119. As regards law enforcement and Europol access to ETIAS data, the EDPS stresses that convincing evidence supporting the necessity of such access is today missing. The EDPS recalls that necessity and proportionality of new schemes are to be assessed both globally, taking into consideration the already existing large-scale IT systems in the EU, and specifically, in the specific case of the third country nationals concerned who are legally visiting and entering the EU.

120. In addition to the main concerns identified above, the recommendations of the EDPS in the present opinion relate to the following aspects of the Proposal: — the necessity and proportionality of the set of data collected, — the chosen data retention periods, — the interoperability of ETIAS with other IT systems, — the data subjects’ rights and provided remedies, — the independent review of the conditions for access by law enforcement authorities, — the division of roles and responsibility between the EBCG Agency and eu-LISA, — the verification by the ETIAS Central Unit, — the architecture and information security of the ETIAS, — the statistics generated by the system, and — the role of the EDPS.

121. The EDPS remains available to provide further advice on the Proposal, also in relation to any delegated or implementing act adopted pursuant to the proposed Regulation, which might have an impact on the processing of personal data.

Brussels, 6 March 2017. Giovanni BUTTARELLI European Data Protection Supervisor

(1) Communication of 13 February 2008 from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions ‘Preparing the next steps in border management in the European Union’, COM(2008) 69 final.

(2) Preliminary Comments of the EDPS of 3 March 2008, available at: https://secure.edps.europa.eu/EDPSWEB/webdav/shared/Documents/Consultation/Comments/2008/08-03-03_Comments_border_package_EN.pdf

(3) Policy study on an EU Electronic System for travel Authorisation (EU ESTA) of February 2011, available at: http://ec.europa.eu/dgs/home-affairs/e-library/docs/pdf/esta_annexes_en.pdf

(4) Communication of 25 October 2011 from the Commission to the European Parliament and the Council ‘Smart borders — Options and the way ahead’, COM(2011) 680 final.

(5) Communication of 6 April 2016 from the Commission to the European Parliament and the Council ‘Stronger and Smarter Information Systems for Borders and Security’, COM(2016) 205 final.

(6) Feasibility Study of 16 November 2016 for a European Travel Information and Authorisation System (ETIAS) — Final Report available at: https://ec.europa.eu/home-affairs/sites/homeaffairs/files/what-we-do/policies/european-agenda-security/legislative-documents/docs/20161116/etias_feasability_study_en.pdf