EUROPEAN COMMISSION Brussels, 6.4.2016 SWD(2016) 115 final COMMISSION STAFF WORKING DOCUMENT



IMPACT ASSESSMENT

Impact Assessment Report on the establishment of an EU Entry Exit System Accompanying the document Proposal for a regulation of the European Parliament and of the Council establishing an Entry/Exit System (EES) to register entry and exit data and refusal of entry data of third country nationals crossing the external borders of the Member States of the European Union and determining the conditions for access to the EES for law enforcement purposes and amending Regulation (EC) No 767/2008 and Regulation (EU) No 1077/2011



and



Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EU) 2016/xxx as regards the use of the Entry/Exit System (EES)

{COM(2016) 194 final}

{COM(2016) 196 final}

{SWD(2016) 116 final}



Table of Contents 1.Introduction 1.1.Background 1.2.Proof of concept 1.3.Changed context 1.4.Revised proposal 2.Problem definition 2.1.The problems addressed by the Smart Borders package 2.2.Implementation problems addressed by this impact assessment 2.3.The drivers of the problems 2.4.Who is affected, in what ways and to what extent? 2.5.What is the EU dimension of the problem? 2.6.How would the problem evolve, all things being equal? 2.7.Conclusions of the evaluations of the existing policy 3.Why should the EU act? 4.Objectives 4.1.General policy objectives 4.2.Specific policy objectives 4.3.Consistency with other EU policies and with the Charter for fundamental rights

5.Policy options 5.1.The architecture: how can the system be most effectively built? 5.2.Biometrics: what biometric identifier(s) are required for the correct functioning of the system? 5.3.Facilitation of border crossing 5.4.Retention time for the storage of data 5.5.Access for law enforcement purposes 6.Analysis of impacts 6.1.Social impacts 6.2.Economic impacts 6.3.Impacts on SME's 6.4.Impacts on Public Services 6.5.Impact on International Relations 7.Comparison of options 7.1.Comparison in terms of effectiveness, fundamental rights, efficiency and coherence 7.2.Preferred option 7.3.Subsidiarity and proportionality of the preferred option 8.Monitoring and evaluation 8.1.Practical arrangements of the evaluation: when, by whom 8.2.Operational objectives and monitoring indicators for the preferred option 9.Abbreviations

10.Glossary 11.List of Annexes 1.Introduction 1.1.Background In February 2013, the Commission adopted a Smart Borders package consisting of three proposals: (1) a Regulation for an Entry/Exit System (EES)for the recording of information on the time and place of entry and exit of third country nationals travelling to the Schengen area, (2) a Regulation for a Registered Traveller Programme (RTP) to allow third country nationals who have been pre-vetted to benefit from facilitation of border checks at the Union external border, (3) a Regulation amending the Schengen Borders Code in order to take into account the existence of the EES and RTP. The Smart Borders proposals intended to contribute to the modernisation of Schengen area’s external border management by improving the quality and efficiency of the management of border crossing processes. They aimed to help Member States dealing with ever increasing traveller flows without necessarily increasing the number of border guards, and to promote mobility between Schengen and third countries in a secure environment. During the first examination of the package which was completed in February 2014, the co-legislators voiced technical, cost-related and operational concerns on the design of the systems. However the key choices made in 2013 – centralised systems based on biometrics – have not been questioned. 1.2.Proof of concept In order to assess the technical, organisational and financial impact of possible solutions to the contentious issues, the Commission initiated with the support of both co-legislators a so-called ‘proof of concept’ exercise consisting of two stages: A Commission-led Technical Study on Smart Borders (published in October 2014, hereinafter 'The Technical Study'), and A testing phase led by eu-LISA (European Agency for the operational management of large-scale IT systems in the area of freedom, security and justice) on the impact of the use of various biometric identifiers on the border control processes (report published in December 2015, hereinafter 'The Pilot'). The aim of the Pilot was to verify the feasibility of the options proposed in the Technical Study in operational environments with real travellers across the EU. Twelve different test cases were performed in 18 Border Crossing Points spread over eleven Member States, covering air, sea and land borders in different climatological situations, with different operational requirements. In total 78 tests were carried out. The pilot not only collected quantitative test case results but also sought feed-back from travellers as well as border guards. In parallel to the Pilot, the Commission services engaged in a series of technical meetings on various topics with experts from Members States as well as with the Smart Borders' rapporteurs and shadow rapporteurs in European Parliament (EP). The Commission hosted dedicated meetings with representatives of civil society, carriers and national law enforcement services. A particularly important consultation opportunity was organised by the LIBE Committee (Committee Civil Liberties, Justice and Home Affairs) of the EP (European Parliament) in February 2015, when a two-day inter-parliamentary hearing on Smart Borders took place, with the participation of national parliaments. The question related to the protection of Fundamental Rights were discussed and analysed in dedicated meetings and workshops with experts of the European Data Protection Supervisor (EDPS) and the Fundamental Rights Agency (FRA). The EDPS also submitted comments in writing. The Commission conducted a public consultation on the Smart Borders Package, inviting citizens (both EU nationals and non-EU nationals) and organisations to contribute. The results of the consultation were published in December 2015. 1.3.Changed context Today, like in 2013, the need for establishing an EU wide Entry Exit System is broadly recognised and supported by the Commission and co-legislators alike. If anything, public and political support for investing in the establishment of 'smart' border management solutions has further increased, also as a result of the current refugee crisis and recent terrorist attacks. Whereas it is important to underline that the proposal to establish an Entry Exit System is as such not related to these developments (the EES strictly deals with the recording of short-term legal stay of third country nationals; refugees are not included in the scope of this project), it is equally correct to stress that EES will contribute to the fight against irregular migration (e.g. the phenomenon of 'overstayers') and can provide an additional instrument for law enforcement authorities to prevent and combat terrorism. The question whether an Entry Exit System is necessary and desirable is no longer in the centre of political debate. The real issue, which was addressed in the 'proof of concept' and forms the main part of this Impact Assessment, is how such a system should be developed: how would it relate to other, already existing, systems, how would it be integrated in existing border crossing processes, what biometrics should be used, how would data storage be organised, and how could the system contribute to law enforcement objectives, all of this in an efficnent and cost-effective way.

When discussing these questions some relevant developments since 2013 should be taken into account: The Visa Information System became fully operational. Its 'roll-out' to Member States consulates in all relevant third countries was concluded in November 2015. The biometric verification of visa-holders against VIS at Schengen external borders is now compulsory. Law enforcement authorities increasingly use VIS for identification and investigation purposes.

Visa liberalisation dialogues with countries in the Western Balkan and at the Eastern and South-Eastern borders of the EU were concluded or have been accelerated, which will lead to an increasing proportion of visa-exempt travellers to the EU. It is expected that this trend will continue in the coming years.

The Internal Security Fund (ISF-B) was adopted, which earmarked € 791 million financial reservation for the development of Smart Borders (to start after the adoption of the relevant legal basis).

Rapid developments in the area of biometric technology opened up new possibilities for 'lighter' and 'faster' enrolment and verification of travellers, not only for fingerprints, but also for facial images.

The Court judgment on the Data Retention Directive provided legal clarity on the conditions and safeguards that need to be respected for the storage and use of EES data. These elements have partly changed the political, legal and institutional environment in which the Smart Borders proposals were discussed, and contributed to the need for a thorough review of the 2013 legislative package. 1.4.Revised proposal Based on the findings of the Technical Study, the results of the Pilot and the numerous technical discussions with co-legislators and stakeholders as well as the outcome of the public consultation, the Commission has considered potential improvements and simplifications to the 2013 proposal. These will be explored in chapter 5 of this Impact Assessment. The policy objectives of the 2013 proposals remain essentially unchanged , and so do several other features of the original proposals. This Impact Assessment is building on the 2013 Impact Assessments accompanying the 2013 proposals, and focusing on those elements of the 2013 proposals where changes are being proposed, notably (a) architecture of the system, (b) biometrics to be used, (c) the use of process facilitators, (d) the retention of data and (e) access by law enforcement authorities. Discussions in Council and EP during the proof of concept phase largely focused on these options. They constitute the essence of how an effective and efficient EES can be built. To ensure that this Impact Assessment can be read as a 'stand-alone' document, the problems to be addressed by the Smart Borders Package are recalled. However the establishment of an EES is not questioned and is assumed. This Impact Assessment addresses the specific question of 'how the EES should be established', focusing on the five aspects mentioned above, and taking account of the main relevant developments that occurred since 2013. 2.Problem definition Before defining the problem it is important to specify the scope of this Impact Assessment: the Schengen Borders Code stipulates that third country nationals have the right to enter in the Schengen area for a short stay of up to 90 days within any 180 day period. Third country nationals who are in possession of a valid residence permit or long-stay visa issued by a Member State ('residence permit holders') are not bound by this limitation. The same applies for third country nationals who are family members of a person that holds the nationality of a Member State of the EU or of a Schengen associated country. Unless stated otherwise, wherever this Impact Assessment speaks about third country nationals it refers to people that enter for a short stay. The border control processes at entry/exit according to current Schengen Borders Code are summarised in annex 5. 2.1.The problems addressed by the Smart Borders package This section recalls the problems which the package, and notably the Entry-Exit system addresses. Problem 1: The number of border crossings is increasing and lead to delays in border checks. Passenger flows at the external borders of the European Union have been growing and will continue to increase in the future. On the basis of the survey done during the Technical Study it is expected that external border crossings in and out of the Schengen area will increase by approximately 28% by 2020 and 57% by 2025. The total number of border crossings in 2025 is forecast to rise to 887 million of which around one-third are expected to be by third-country nationals (TCN). Based on the travel patterns observed in 2014, it was estimated that around 127 million of these crossings would be by visa exempt travellers (TCN-VE) and 175 million by visa holders (TCN-VH). However it can be expected that the ratio between TCN-VH and TCN-VE will change substantially in the coming decade following the progress in 2015 on visa liberalisation dialogues between the EU and Ukraine, Georgia, Turkey, and Kosovo.

The total number of third country nationals involved (visa required and visa exempt) will be around 76 million per year in 2025. While 'minimum checks' are currently performed on EU citizens and persons enjoying the right of free movement, third country nationals crossing the Schengen area external border are subject to ‘thorough checks’. The Schengen Borders Code currently requires that thorough checks are made manually at borders (both at entry and exit) and do not allow the use of modern technologies for automated processes for third-country nationals. The increasing traveller flows and the principle of a thorough border check on all third-country nationals have increased waiting times at borders in such a way that it constitutes already a problem for many Member States. On 15 December 2015, the Commission proposed an amendment to the Schengen Borders Code in order to enforce systematic checks of EU citizens and persons enjoying the right of free movement against databases on lost and stolen documents as well as in order to verify that those persons do not represent a threat to public order and internal security. The implementation of these systematic checks will put further demands on the border management capacity and resources of Member States. Problem 2: Control of authorised period of stay of Third Country Nationals is error prone, slow and not systematically implemented. The Schengen Borders Code stipulates that third-country nationals have, as a general rule, the right to enter for a short stay of up to 90 days within any 180 day period. There are however no provisions on the recording of travellers’ cross border movements into and out of the Schengen area. Currently the stamping of the travel document indicating the dates of entry and exit is the sole method available to border guards and immigration authorities to calculate the duration of stay of third-country nationals and to verify if someone is overstaying. Checking a traveller who has been making 10 visits to the Schengen area during the last months means verifying 20 stamps and using them to calculate the time spent in the area. These stamps can be difficult to interpret: they may be unreadable or the target of counterfeiting. Difficulties affecting the legibility of the stamps as well as the absence of entry stamps were highlighted by the Member States in their replies to the questionnaire carried out by the Commission prior to the report on the operation of the provisions on the stamping of travel documents of third-country nationals. Calculating time spent in the Schengen area on the basis of stamps in the travel documents is thus both time-consuming and difficult with the consequence that often it may not be checked accurately. Bilateral agreements between Member States and third countries authorising citizens from these third countries to stay for period of time longer than 90 days in the Member State bound by these bilateral agreement create exceptions to the short stay rule. These exceptions make border checks even more complex. Similarly, it is difficult for consulates having to process visa applications to establish the lawful use of previous visas on the basis of the stamps present in the travel document. Problem 3: Current border control process cannot report and identify overstayers systematically and easily and in a reliable manner, resulting in a lack of reliable information on irregular immigration and problems for return. Irregular migration into the EU poses a challenge to every Member State. Irregular immigrants include both persons who crossed the borders irregularly – usually not at an official border crossing point - and so-called “overstayers”: persons having legally entered the EU at an official border crossing point but who stayed after their entitlement to do so expired. Up to 2013 and the beginning of the refugee crisis, it was estimated that the majority of irregular immigrants consisted of this second category. While accurate figures or estimates are not available, it is probable that ratio has evolved since then and will continue to change in the coming years. Overstayers can represent a burden for the Schengen area if, for example, they intend to stay in the Schengen area for a long period of time taking a job in the underground economy or participating in any kind of criminal activity. The category of overstayers may also include victims of human trafficking, including victims of labour or sexual exploitation. Overstayers can be apprehended by means of inland controls. In 2014, the number of overstayers detected within the Schengen area amounted to 441.780, according to the regular collection by Frontex of data from Member State . As reported in the 2013 EES Impact Assessment, conservative and by now outdated estimates of the total number of irregular immigrants (both irregular arrivals and overstayers) in the EU vary between 1.9 and 3.8 million. More precise and updated figures are not available. As border crossings by third country nationals are currently not registered, it is not possible to establish lists of overstayers. For the control of third country nationals present in the Schengen area, if the individuals do not present their travel documents (for example, because they claim to have lost them), it is impossible to determine accurately their entry date as well as their citizenship. As a result immigration authorities have no effective and reliable means to identify and detect overstayers, which is a major shortcoming of the current EU policy against irregular migration. Problem 4: The fight against international criminality, terrorism and other security threats needs to be further reinforced The globalisation of criminality follows the globalisation of economics. International criminal organisations are developing their activities across borders. Criminal activities such as trafficking in human beings, smuggling of people or the smuggling of illicit goods involve numerous border crossings, which are facilitated by the absence of registration of the border crossings of the third country nationals concerned. Likewise, terrorist organisations and radicalised individuals can benefit from the absence of registration of border crossings. Controls of third-country nationals at external borders involve identity checks and searches against various databases of known persons or groups posing a threat to public security that should be either apprehended or denied entry to the territory. Currently, all verifications are carried out based only on the travel documents presented by the third country national. Even though the alerts on these persons may have been recorded in the Schengen Information System (SIS), or other national and international databases, they can only be identified on the basis of the alphanumeric data that was introduced with the alert. This makes it difficult for the authorities to detect a person using different identities to cross the borders. In general, identification is essential for law enforcement authorities in their mission to prevent and combat terrorism and other serious crime. However, in the event that a third country national destroys his/her official documentation once having entered the Schengen area, it can be very difficult for law enforcement authorities to identify that person in case he/she is suspected of a crime or is a victim of crime. While data on EU citizens exists in different databases in Member States that are in general accessible to law enforcement authorities, there is an information and verification gap concerning third country nationals who are not covered by the Visa Information System (VIS). 2.2.Implementation problems addressed by this impact assessment

During the first examination of the package which was completed in February 2014, the co-legislators voiced technical, cost-related and operational concerns, mainly on the feasibility of both systems and the practicability of certain features. Concerns related especially to the limited number of potential users and administrative burden of implementing RTP, the length of the data retention period in the EES, the choice of the biometric identifiers, the extent to which the national entry exit systems could be integrated and/or reused, the need for enhanced synergies and/or interoperability with existing systems used during border controls and, last but not least, the possibility for law enforcement authorities to access the system. In that context, the Commission proposed to initiate a two-step proof of concept exercise to cope with the identified concerns, the first step being a technical study and the second one a testing phase. The purpose of the proof of concept was to ensure that the two co-legislators would be given a sound analysis containing the best possible options and solutions from a technical and a cost-benefit point of view. On 4 February 2014, the Permanent Representatives Committee (COREPER) endorsed the "Approach for the way forward on the Smart Borders Package" as proposed by the Commission as well as a list of questions to be addressed during the proof of concept: "… there appears to be consensus on including 1) interoperability between EES and RTP and other existing systems used during border checks, 2) the technical aspects of law enforcement access, 3) biometrics and 4) feasibility of the token and other possible options. Other issues which have been mentioned by delegations include: 1) detailed and updated cost analysis of different options and technical solutions, including in relation to costs at national level, 2) integration of the national systems in the future EES and RTP, and 3) processing time at the border." The European Parliament proposed to include in the list of questions to be studied the impact on border crossing time, the feasibility at all type of border (air, sea and land), a scope reduction for the RTP, an EES with law enforcement access and the interoperability of existing systems. The EP asked also for a cost analysis, statistics concerning border crossings and information concerning MS experiences with automated border control systems, The Commission has invited experts of Member States as well as representatives of the EP to a meeting on 7 February 2014 to establish the objectives of the study. The participants in this meeting agreed to organise the questions to be addressed in five themes: 1. Architecture of the systems, including the possibility to develop EES and RTP as one single system, the possibility of developing EES/RTP as new VIS functionalities, the interoperability with VIS and SIS as well as the relation with the existing national systems. 2. Biometrics, which identifier should be used, impact on border crossing time and on border control process. 3. Impact on Border control processes, including automation, facilitation, process accelerators, impact for different border types, impact on border crossing point infrastructures and RTP enrolment process. 4. Data, including retention period, law enforcement access, impact on Fundamental Rights, data set minimisation and privacy by design. 5. Cost analysis of the various options and statistics on border crossing. These five groups of questions addressed during the proof of concept have resulted in the options that are subject of this Impact Assessment, while the cost analysis is a cross-cutting issue. 2.3.The drivers of the problems The main drivers of these problems are: The absence of an EU wide IT system: ofor recording travel movements of third-country nationals admitted for a short stay; ofor identifying persons detected within the territory without travel documents who cannot be identified using the VIS; ohelping in detecting persons subject to a SIS alert who use different identities to cross the borders.

The very limited value of national entry exit systems in an area without internal border control between 26 countries. The lack of information in the area of migration management: oof who is in the Schengen area and who complies with the maximum allowed short stay of up to 90 days within a 180 day period; othat can support random checks within the Schengen area to detect irregularly staying persons; oon nationalities and groups (visa exempt/required) of travellers overstaying. The challenges posed by the current border control process: owhich makes it difficult for the border guard to assess the authorised stay at the border check of the traveller; owhich does not allow for the use of modern technologies for automated processes and border checks facilitation for third-country nationals. The lack of information in the area of law enforcement: oallowing the identification of a suspect who has destroyed his or her travel documents; oon cross-border movements of persons suspected of criminal activities or of victims of these activities. 2.4.Who is affected, in what ways and to what extent? Where the problems mentioned above have an impact on the quality of border controls they affect border guards, visa/immigration authorities and authorities competent for carrying out checks within the territory. Where they lead to a slow control process and long waiting times, they affect third-country nationals crossing the external borders of the Schengen area for short stays. Carriers (airlines, buses, ferries), tourist agencies as well as infrastructure operators (airports, ferry terminals), whose activities involve third country national border crossings, are equally affected by the waiting time for border crossing. EU regions close to the eastern external land border and major seaports or airports can be affected, in cases where retail activities are dependent on third country nationals travelling for shopping. EU citizens crossing the external border of the Schengen area are not directly affected and use their specific lanes at border control posts. However, increasing number of third country national border crossings combined with human resources limitations for border controls could in the future also have an impact on their waiting time at borders. EU citizens, as well as Member State administrations, public services and private economic operators, are also affected by the fact that EU border management is currently insufficiently equipped to tackle the problem of overstaying (and hence irregular migration). Finally, law enforcement authorities are also affected as they are facing difficulties for the identification and monitoring cross border movements of third country nationals involved in criminal or terrorist activities and for identifying criminals among suspects.

2.5.Experiences with EES and RTP systems 2.5.1.Entry Exit Systems There are several Member States and third countries implementing their own national entry/exit systems. 13 Member States currently have such a system in place and the only data collected are alphanumeric. The main purpose of these systems is to give law enforcement authorities the opportunity to store travel records of certain third-country nationals in accordance with security-related national legislation. Therefore these Member States give access to their national systems not only to border authorities but also to law enforcement authorities for the purpose of investigating crime. If a person lawfully exits the same Member State through which he or she entered, then any overstayer would be detected by the relevant national EES systems. Beyond that, there are no possibilities for using such systems to detect overstayers as entry and exit records cannot be matched when persons leave the Schengen area via a different Member State from the one through which they entered and in which their entry was recorded. As for non-Schengen countries, part of the UK's e-Borders programme aimed, among other things, to record entry and exit data based on the advance passenger information transmitted to government authorities by carriers transporting persons to the UK. The Office of Biometric Identity Management—which has absorbed the former U.S. Visitor and Immigrant Status Indicator Technology (US-VISIT) system in 2013—requires most foreign nationals to provide fingerprints, photographs, or other biometric identifiers upon arrival in the United States. The automated biometric entry-exit system grew from a photograph and two-finger biometric system for immigration identification to the major identity management and screening system for the Department of Homeland Security. U.S. Customs and Border Protection (CBP) collects biographic information on all nonimmigrant arrivals to the United States through an inspection by a CBP officer.

In the air and sea environment, CBP officers validate the manifest information provided by commercial and private aircraft operators. For many nonimmigrants, submission of biometric information is also required upon admission and is captured in the presence of a CBP officer. Since US airports do not have designated areas exclusively for travelers leaving the United States, departures of travelers are recorded biographically using outbound passenger manifests provided by commercial carriers. Under regulations governing the Advance Passenger Information System, carriers are required to validate the manifest information against the travel document being presented before a traveler is permitted to board their aircraft or sea vessel.

In the land environment, there is no such requirement for advance reporting of arrivals and departures, as the majority of travelers cross the borders using their own vehicle or as a pedestrian. On June 30, 2013, Canada and the United States began exchanging entry data for third-country nationals, permanent residents of Canada, and U.S. lawful permanent residents, who enter through land POEs (Points of Entry) along the shared border, where information is collected electronically. As a result of this initiative, the United States now has a working land border exit system on its Northern border for non-U.S. and non-Canadian citizens. There is currently no equivalent entry/exit system operated with Mexico. Arrival and departure records of travellers to and from Australia are contained within the Movements Reconstruction database, set up in 1981. In Japan, a biometric border control programme for all non-Japanese citizens was introduced in 2007 as a measure for preventing terrorism and irregular immigration, while a system for recording biographical entry and exit data has been in place for several years. At the high level conference on 2 and 3 February 2012, representatives from the responsible authorities in the USA and Australia described the new systems as a success and as an effective tool for the authorities to detect irregular migrants and to fight serious cross border crime. However precise figures on the number of apprehended irregular migrants were not presented. Hong Kong SAR (Special Administrative Region) records entries and exits of both its own permanent residents using e-Gates (the so-called e-Channels) for 43% of cross-border movements and of non-residents whose use of automated means is increasing over recent years. Independently of the means used, Hong Kong has a full record of entries and exits of all travellers at all types of borders (air, land and sea). The increased efficiency of border controls using automated means is demonstrated by the fact that Hong Kong increased manpower of the immigration department only by 16% from 2003 till 2014, while traveller’s throughput increased 81% over the same period. 2.5.2.Registered Travellers' Programme Many non-EU countries such as the US, Canada, Australia and Singapore have also automated their border check procedures based by means of a Registered or Trusted Traveller's Programmes. The access granted for these programmes are limited. They are established only for their own citizens or their own citizens and neighbouring country citizens. Singapore eIACS system has three million users and the US system has one million users (see next). Global Entry is a U.S. Customs and Border Protection (CBP) program that allows expedited clearance for pre-approved, low-risk travelers upon arrival in the United States. Participants may enter the United States by using automated kiosks located at specific airports. At airports, program participants proceed to Global Entry kiosks, present their machine-readable passport or U.S. permanent resident card, place their fingertips on the scanner for fingerprint verification, and complete a customs declaration. The kiosk issues the traveler a transaction receipt and directs the traveler to baggage claim and the exit. Travelers must be pre-approved for the Global Entry program. All applicants undergo a rigorous background check and in-person interview before enrollment. While Global Entry's goal is to speed travelers through the process, members may still be selected for further examination when entering the United States. Global Entry is open to U.S. citizens, lawful permanent residents, citizens of Germany, the Netherlands, Panama, and South Korea, and Mexican nationals. Canadian citizens and residents may enjoy Global Entry benefits through membership in the NEXUS program. Membership fee is USD 100 (about € 92) for five years. Out of 1.070.142 participants 95% were US citizens and permanent residents, 4% Mexican residents and only 1% (so about 10.000) of other nationalities. U.S. Customs and Border Protection (CBP) runs in total four trusted travellers programmes, Global Entry being one of them, each aimed for specific target groups (like NEXUS which is for US and Canadian citziens and permanent residents). On average 7% of arriving passengers in the US use the trusted traveller lanes. In 2015, the United Kingdom implemented a new Registered Travellers' Scheme open to nationals of Australia, Canada, Japan, New Zealand or the USA, who are at least 18 years old and have visited the UK at least four times in the last 24 months before applying. The target is to enrol up to 200.000 persons at an annual fee of £70 (about € 92). As opposed to the schemes used in the US and Australia, neither UK nor other EU nationals need to enrol in such a scheme as they can cross the UK automated border lines using their biometric passport without any pre-enrolment. It is a national scheme as opposed to other ones specific to an airport such as Privium evoked in the next paragraph, in principle applicable to all types of borders although practically by its fee level and sort of advantage (use of automated control lanes in airports) it only provides a real benefit to frequent fliers. The RTP scheme that is often cited is Privium, the Schiphol Airport’s (Netherland) automated border crossing programme for frequent fliers. The passport holders of all EU countries as well as Norway, Iceland, Liechtenstein and Switzerland are eligible to apply for the membership of the programme. Also US Global Entry members can use the Privium services The majority of its members are business travellers, flying an average of 16 times a year through Schiphol Airport. During the pre-enrolment procedure the applicant has to fill in the commercial database so that the smartcard would be prepared for the final enrolment. The final enrolment includes application processing, biometrics capturing, check of blacklist databases etc. The Dutch Privium programme asks for a membership fee of €121 for the basic version and is reported to be mainly attractive for both its border crossing facilitation as well as the use of parking close to the terminal and of dedicated lounges. In 2014 the scheme had 48,000 members, which accounts for approximately 0.5% of the total targeted number of travellers. 2.6.What is the EU dimension of the problem? The effective management of the external borders by the 26 countries which are part of the Schengen area is a prerequisite for the free movement of persons within the area. A Member State could register third country nationals entering through its external border, but, as any of those third country nationals can and often do leave the Schengen area through a different Member State's external border, the relevance of such registration is very limited. Where national entry exit systems are in place today, their main objective is to support law enforcement. These different systems result in a redundancy of stored data (the same person's identity is stored in different databases) based on diverging national legislation, which is clearly undesirable from the perspective of data protection.

To address the EU-wide problems mentioned in section 2.1 any Schengen-wide solution needs to be uniformly applied at the 1800 external border crossing points of the Schengen Area. 2.7.How would the problem evolve, all things being equal? The following elements are considered to be satisfactory and either will remain stable or evolve positively: An increasing proportion of EU citizens will use the Automated Border Control gates (e-Gates). Today these are mainly installed at airports but they will progressively also be used at sea and land borders. The deployment of additional e-Gates in the EU is promoted through the EU's Internal Security Fund (ISF). Following the recent completion of the roll-out of the EU's Visa Information System (VIS), all applications for a Schengen-visa will contain the ten fingerprints and a facial image of the applicant. The enrolment of these biometric identifiers in VIS prevents visa fraud and allows identity verification at borders, as well as identification. Adoption of the Commission proposal for a touring visa will resolve the unsatisfactory patchwork of bilateral agreements. The following elements are considered to be or to become unsatisfactory: To cope with the increased travellers’ flow, in particular of third-country nationals, while remaining compliant with the existing Schengen Borders Code, the number of border guards will need to follow the same upward trend and the border crossing point infrastructures will necessitate enlargements and investments. This is not sustainable as it implies more budget and also more floor occupation which at air and especially at land borders can be physically impossible. As a result, the foreseen increase of border crossings will result in a waiting time increase for third country national travellers and as a side effect also for EU citizens as the border crossing points will reach saturation level. This could result in less thorough checks with direct consequences for the security of the Schengen Area. It will remain difficult for border guards to check compliance of the rule on the maximum duration of stay (no more than 90 days in any 180 day period) if border controls have to continue to rely on reading entry and exit stamps of the Schengen area. At the same time, it does not become easier for travellers to know their remaining duration of authorised stay as they can also only rely on reading these stamps. It will remain as difficult as it is today to identify overstayers and to implement the EU Return Policy. Border guards can only identify an infringement of the rule on the maximum duration of stay by verifying the entry and exit stamps in the passport. In practice, at border, this check is often not performed given the time pressure. For irregular migrants, the absence of travel documents constitute a major obstacle to the effective return due the uncertainty about the identity of the person and the impossibility to define accurately the overstay period as there is not possibility to check any entry stamp. Visa applications will continue to be handled without systematic information on the travel history of the applicant and compliance of duration of previous stay. Each time a visa-required third country nationals applies for a visa, the consular officer from the Schengen Member State looks into previous visa applications of the same traveller in VIS. The consular officer is also required to verify whether the visa applicant is prohibited entry into the Schengen area. However, neither VIS nor other systems contain the information as to whether the visa applicant complied with the duration of stay; this can be ascertained only by checking the entry and exit stamps in the travel document used, assuming that the travel document has remained the same. While the use of the VIS will certainly continue to contribute to the security of the Schengen area, the successful finalisation of the ongoing visa liberalisation dialogues will also lead to a considerable increase in the number of visa exempt travellers crossing the external borders, placing additional challenges for the management of the external borders of the Schengen area. Law enforcement authorities will not have access to information on movements across the Schengen borders that could be used as a criminal intelligence or identification tool in the fight against terrorism and other forms of serious crime. 2.8.Conclusions of the evaluations of the existing policy At the moment, the entries and exits of third country nationals in the Schengen area are recorded only in their travel documents, which entails the limitations and consequences described above for border management and overstayers identification. This recording is materialised by the stamping of travel documents. The stamp indicates the location, date and direction (entry or exit) of the border crossing and is not machine readable. The existing EU policy does not foresee any register for entries and exits of third country nationals. The existing policy cannot be adapted or modified to cope with the increasing traveller flows at external borders. A new approach relying on IT systems and automation has to be considered. Such entry exit systems are operational in the United Kingdom, Australia, Japan and several other countries, where they deliver the expected results of better border management and control of overstay. The International Organisation for Migration considers that a system correlating entry and exit data is required for an efficient and effective border management. The VIS is an example of a successfully delivered EU large-scale IT system, where the use of biometrics, reliability and availability, and the management of access to its data by different groups of users having different access rights are amongst the main features. The VIS is in operation since October 2011 and its roll-out in all the consular posts of Schengen Member States was completed in November 2015. Systematic verification at the border by means of biometrics to check that the visa belongs to the traveller is mandatory since October 2014. Although a formal evaluation report of the VIS will only be available in 2016, some important observations can already be made: (1) The use of biometrics has provided the expected benefits. "Visa-shopping" has stopped because any time a new visa application is created the "visa history" of the applicant is checked in the system. The biometrics captured is used to ascertain whether another visa-application is outstanding for the same person under another identity. Visa-fraud is excluded because the fingerprints taken at the border are matched with fingerprints provided at the moment of the visa application. (2) The biometric verification of visa-holders at the border was not reported to have negatively affected border crossing time. Border control processes have not slowed down, but did become more secure.

(3) VIS was delivered on time and on budget. Although the VIS was delivered twelve months later than initially announced, this delay was entirely due to a well-evaluated and duly accepted change to its technical requirements. The VIS feasibility study estimated the multi-annual project budget at €158 million while the project was delivered for €161 million. 3.Why should the EU act? Under Articles 74 and 77(2) of the Treaty on the Functioning of the European Union (TFEU), the Union has the power to adopt measures relating to the crossing of the external borders of the Member States. Under Articles 82 (1)(d) and 87(2)(a) TFEU the Union also has the power to adopt measures to strengthen police and judicial cooperation concerning the collection, storage, processing, analysis and exchange of relevant information. The absence of internal borders in the Schengen area requires a sound management of external borders where each country has to control the external border on behalf of the other Schengen States. Consequently, no Member State alone is able to cope on its own with irregular immigration. A person may enter the Schengen area at a border crossing point in a Member State where a national register of entry/exit data is used, but exit through a border crossing point where no such system is used. The monitoring of compliance with EU rules on authorised stays can therefore not be done by Member States acting alone. Third-country nationals who enter the Schengen area are able to travel freely within it. In an area without internal borders, action against irregular immigration should be undertaken in common. Considering all this the EU is better placed than Member States to take the appropriate measures. At the Justice and Home Affairs and European Councils in December 2015, Member States emphasised the need to improve the controls at external borders through the use of new technologies. The European Agenda on Migration identifies "border management" as one of the "four pillars to manage migration better". Securing external borders and managing them more efficiently implies making better use of the opportunities offered by IT systems and technologies. The use of the three existing EU large-scale IT systems (SIS, VIS and Eurodac (European Dactyloscopy)) brings benefits to border management. A new phase will come with the Entry Exit System implementation to increase the efficiency of border crossings, facilitating crossings for the large majority of 'bona fide' third country travellers, whilst at the same time strengthening the fight against irregular migration by creating a record of all cross-border movements by third country nationals, fully respecting proportionality. The implementation of an EU wide Entry Exit System will result, amongst other things, in the automation of certain tasks and activities related to border controls. This automation will ensure a homogeneous and systematic control of the authorised period of stay of third country nationals. The use of EES in combination with new possibilities for using self-services systems and automatic or semi-automatic border control solutions will facilitate the work of border guards and help them absorbing the forecasted increase of border crossings. From the traveller’s perspective this will result in a facilitation of border crossing, as the waiting time will be reduced and border checks will be faster. An amendment to the Schengen Border Code will introduce the possibility for Member States to implement facilitation schemes at national level. This amendment will secure facilitation schemes, existing or future, providing clear common rules consistent with the Schengen Border Code provisions. Although Member States may retain their national systems in accordance with security-related national legislation, an EU Entry Exit System would allow Member State authorities to access data on third-country nationals who crossed the EU external border in one country and exited via another Schengen country. Better information on cross border movements of third-country nationals at EU level would establish a factual basis to develop and adapt the EU migration policy, including its visa policy. It would help setting priorities for readmission agreements and visa facilitation agreement with third countries. It would contribute to a common understanding of immigration issues and priorities in policy dialogues with countries of origin and transit. 4.Objectives 4.1.General policy objectives The general policy objectives are essentially the same as in the initial 2013 proposals. They are, in order of priority: (1)To improve the management of external borders (2)To reduce irregular migration, by addressing the phenomenon of overstaying. (3)To contribute to the fight against terrorism and serious crime and ensure a high level of internal security' Improved border management can be measured by its effectiveness and efficiency. Effectiveness in border management is achieved if it facilitates the border crossing of legitimate travellers whilst at the same time preventing that travellers not meeting the entry conditions from entering the Schengen area or apprehending them at exit. Efficiency in border management is achieved when the increase of border crossings does not require a similar increase of border guards, The fulfilment of the second objective is dependent on the first, but also requires utilisation of the Entry Exit System by relevant authorities within the territory of the Schengen area. The EES will contribute to the implementation of the EU policy on the return of illegally staying third-country nationals. The implementation of EES will ensure a better identification of third country nationals and will allow for the detection of people using several identities. This will help to achieve to a certain extent the third policy objective. However, this objective can only be fully realised when access to the entry exit system is granted to law enforcement authorities (see section 5.5).

No new policy in new areas will be developed. The proposal is part of the continuous development of the Integrated Border Management Strategy of the European Union. 4.2.Specific policy objectives The main policy objectives of the Entry Exit System and modifications of the Schengen Borders Code are, in order of priority, to: (1)Enhance the efficiency of border checks through monitoring of the rights to authorised stay at entry and exit; (2)Identify and detect overstayers (also within the territory) and enable national authorities of the Member States to take appropriate measures including to increase the possibilities for return; (3)Free up border control resources from performing checks that can be automated and enable better focus on traveller assessment; (4)Facilitate the crossing by third-country nationals of EU external borders through self-service systems and semi-automated or automated systems while maintaining the current level of security; (5)Enable consulates to have access to information on the lawful use of previous visas; (6)Inform third country nationals of the duration of their authorised stay; (7)Improve the assessment of the risk of overstay; (8)Support evidence based EU migration policy making; (9)Combat identity fraud. (10)To identify and apprehend terrorist, criminal suspects as well as of victims crossing the external borders; (11)To generate information on travel histories of third country nationals including crime suspects that would help investigations related to terrorism or serious crime. 4.3.Consistency with other EU policies and with the Charter for fundamental rights The idea of establishing an EU Smart Borders System was first suggested in the Communication of 13 February 2008 'Preparing the next steps in border management in the European Union'. The proposal was endorsed in the Stockholm Programme agreed by the European Council in December 2009. In October 2011 the Commission further developed this idea in a Communication on the implementation options for the EES and RTP. This was followed in February 2013, as already mentioned in the introduction of this Impact Assessment, by legislative proposals for a Smart borders package. The proposals therefore build on a long-standing political mandate to undertake concrete action in this area. 4.3.1.Consistency with EU migration and security policy

In 2015 the revision of the legislative proposals on Smart Borders was announced in both the European Agenda on Migration and the European Agenda on Security. The latter underlines that common high standards of border management are essential to preventing cross-border crime and terrorism and points out that the revised proposal on Smart Borders will help increasing the efficiency and effectiveness of border management. The Agenda on Migration stresses that in order to manage Schengen borders more efficiently there is a need to make better use of the opportunities offered by IT systems and technologies. It refers to the three existing systems: Eurodac (to deal with the administration of asylum), VIS (for managing visa applications) and SIS (for sharing of information on persons and objects for which an alert has been created). It announces a new phase will come with the Smart Borders intiative, which addresses objectives that are not met by the other three systems, and has a scope which is complementary to them. The inter-relation between Eurodac, VIS, SIS and the future EES is further explained in the Communication 'Stronger and Smarter Borders' that will accompany the presentation of the revised proposals on Smart Borders. As explained in the introduction of this Impact Assessment, there is no direct link between the EES proposal and the current refugee crisis. There are cases of third country nationals that apply for asylum after having arrived in Schengen in the framework of short-term legal stay (these people would be recorded in a future EES) or on arrival at a border crossing point; but the large majority of refugees arrives irregularly, not at a border crossing point, and are hence recorded only in Eurodac. Proposals to better adjust Eurodac to current challenges are currently being prepared and will be adopted by the Commission around the same time as the Smart Borders proposals. The revised proposals on Smart Borders (as well as the proposal on Eurodac) are complementary to the Border Package that was presented by the Commission on 15 December 2015. This package proposed, inter alia, the creation of a European Border and Coast Guard, reinforced crisis prevention and intervention at external borders, the implementation of the hotspot approach, and an amendment of the Schengen Borders Code, to reinforce the border checks on EU citizens and other persons enjoying the right of free movement. The revised proposals on Smart Borders will also support the implementation of the EU return policy. The EES will record refusal of entry data of third country nationals. More broadly, it will allow for the identification of undocumented third country nationals that at one point of time have legally entered the Schengen zone. Finally, in the context of internal security, the EES will allow for the identification of third country nationals suspected of committing terrorist acts or serious crime, e.g. based on fingerprints found at the crime scene, or video surveillance images (again, assuming that these people at one point of time legally arrivd in the Schengen zone). In addition, information on travel routes and travel history in- and out of Schengen of suspected individuals may be made available in the context of criminal investigations, thereby contributing to the fight against terrorism and serious crime. 4.3.2.Consistency with the Charter of Fundamental rights The use of modern technologies can be beneficial to fundamental rights. Such technologies will reduce the risk of mistaken identities, of discrimination and of ethnic profiling. They will assist in the detection of missing children or of victims of trafficking in human beings. They can reduce the risk of people being wrongfully apprehended and arrested. It can also contribute to increased security of citizens residing in the Schengen area as it will help to combat terrorism and serious crime. On the other hand, establishing an entry exit system, due to the personal data involved, has an impact on the right to the privacy and the protection of personal data, enshrined in Articles 7 and 8 of the Charter of Fundamental Rights of the European Union. Therefore it should be examined in light of the Article 52.1 of the Charter. The legal basis for an EU Entry Exit System will therefore need to guarantee the right to an effective remedy before a tribunal, in line with Article 47 of the Charter, for challenging a notification of overstay, for example in cases of forced overstay, errors or when a migrant has a legal right to stay. Annex 13 'Impact Assessment on Fundamental Rights' contains a complete analysis of these impacts. The proposals will include appropriate provisions limiting data processing to what is necessary for the specific purpose of the system and granting data access only to those entities that ‘need to know’. The choice of limited data retention periods will be made depending solely on the principal objectives of the instrument. Mechanisms ensuring an accurate risk management and effective protection of data subjects' rights will be foreseen. The system will have to comply with data protection principles and the requirements of necessity, proportionality, purpose limitation and quality of data. It will be developed in full respect of the privacy by design principles. All safeguards and mechanisms will be in place for the effective protection of the fundamental rights of travellers particularly the protection of their private life and personal data. Third-country nationals must be made aware of these rights. In accordance with data protection legislation, access should be given to the data stored in the Entry Exit System only for specified, explicit and legitimate purposes. This means that the authorities who should have access to the Entry Exit System have to be designated for a specific limited purpose. Therefore, access for consulting the data should be reserved exclusively to duly authorised staff of the authorities of each Member State who are competent for the specific purposes of the Entry Exit System and limited to the extent that the data are required for the performance of the tasks in accordance with these purposes. 5.Policy options The impact assessments carried out for the 2013 proposals concluded that an EES and an RTP for third-country nationals should be established. The proposals were based on a preferred solution of an EES system, as a centralised system containing both alphanumeric and biometric data. It was proposed that after a period of two years, the EES should be evaluated and, in this context the Commission would evaluate in particular the possible access to the system for law enforcement purposes as well as the retention period, also taking into account the experience of access for such purposes to the VIS. As explained in the introduction, this Impact Assessment focuses on the most contentious elements of the 2013 proposals for which changes have been considered. These elements relate to the concerns expressed by the co-legislators during the first examination of the package, notably the RTP, the length of the data retention period in the EES, the choice of the biometric identifiers, the extent to which the national entry exit systems could be integrated and/or reused, the need for enhanced synergies and/or interoperability with existing systems used during border controls and, last but not least, the possibility for law enforcement authorities to access the system. In response to these concerns, five main areas were identified for which policy options need to be analysed. In each case the 2013 proposals are taken as the baseline scenario. (1)The architecture of the system

(2)The biometrics used to identify travellers (3)The facilitation of border crossings (4)The retention time for the storage of data (5)The access for law enforcement purposes of the EES data. The analysis in this section is based on the results of the 'proof of concept' exercise that took place in 2014 and 2015, consisting of a Technical Study on Smart Borders and a testing phase ('Pilot'). The analysis reflects where appropriate past experiences and potential synergies with existing large scale IT systems and the solutions they provide, notably with a view to contributing to reducing costs and increasing efficiency. Privacy by design, personal data protection and data set minimisation are principles sustaining the proposed options. All options are intended to respect the proportionality principle (see annex13 - Impact Assessment on Fundamental Rights). All options would in principle apply to all third country nationals. 5.1.The architecture: how can the system be most effectively built? The 2013 proposals foresaw a separate Entry Exit System and Registered Travellers Programme system. The Technical Study has compared the advantages and inconveniences of building EES and RTP separately or as one single system. Two options have therefore to be considered: a)Separate EES and RTP systems (2013 proposal) b)One single EES/RTP system One possible way of building a single system would be to combine the functionalities of EES and RTP on the basis of VIS. This option was promoted by several stakeholders as the preferred architectural option. Such 'upgrading' of VIS would create a complete system, relying on a single database where data required for VIS, EES and RTP functionalities are registered. VIS, EES and RTP data would remain logically separated in such a way that each type of data can be accessed exclusively through its own functionalities. This would have advantages from a business processes and data perspective point of view. With a single system, maintenance and development can be streamlined and costs will be lower, based on the fact that such developments benefit three systems rather than a single system at a time. This option was analysed and discarded in the 2012 Impact Assessment, concluding however that biometric matching functionality could be performed by the existing Biometric Matching System, which already provides such a functionality for the VIS. The 2014 Technical Study, analysed in details this option and demonstrated that it would have a significant impact on the existing VIS, at national level in particular. The evolution of a complex system, already operational worldwide in the consulates and at the borders of all Schengen countries with high requirements of availability, will lead to an increase of the risks due to a much more complex testing phase and entry into operation, compared to the development of stand-alone systems. In addition, such an implementation of the EES/RTP starting from the existing VIS platform would also lead to a complex legislative process since the VIS legal framework would need to be significantly adapted. This option has therefore been discarded again. However, as explained hereunder, this is without prejudice to the fact that interoperability between EES/RTP and VIS will be maximised. 5.1.1.Description of the options (a) If EES and RTP were to be developed as two physically separated systems each system would rely on its own database with its own data being separately registered. User access rights are managed separately for both systems. Both systems are using the same biometric matching functionalities as used by the Visa Information System. (b) If one single system was to be developed containing the functionalities of both EES and RTP, this system would rely on a single database where data required for the EES and RTP functionalities are registered. EES and RTP data are logically separated in such a way that RTP data can be accessed exclusively through RTP functionalities while EES data can be accessed exclusively through EES functionalities. However, data used by both EES and RTP functionalities (e.g.: name, surname, date of birth, nationality, travel document number, biometrics) are shared. User access rights will define which transactions from EES and/or RTP can be used by which user. For both options, Interoperability would be established between the EES/RTP and VIS (see details under point 5.1.3). The Schengen Information System (SIS) can play a significant role with regard of overstayers as EES will notify the Member States competent for a record about the expiry date which will allow the Member State to take the appropriate measures, including the creation of an alert in SIS for the refusal of entry or stay in the Schengen area. Specific web services for travellers and carriers will be made available. Travellers will have the possibility to check when planning visiting the Schengen area if the intended visit is compatible with the right to enter for a short stay of up to 90 days within any 180 day period. Carriers will have access to a web service allowing them verifying whether the "traveller is eligible for transportation until destination". These secured web services will be physically and logically separated from the central system. Users will be required to send the minimum data set required for their query and will receive an OK or non-OK answer.

5.1.2.What are the differences between the options? The question of whether EES and RTP should be built as one or two systems does not have an impact on the operational processes: border crossing processes can be designed in an efficient and effective way in either case. The argument that the existence of two systems would make the work of border guards more complicated because they would access two systems is ill-founded because end-users do not access the central system directly but through an end-user's interface. The data originating from different systems are integrated in one single response. The real issue is where that integration layer is located. This has both technical and cost-related implications. Technical considerations: The Technical Study looked at the commonality of processes, data and required technology between EES and RTP, and concluded in favour of one single system: "Having a single, integrated system for EES and RTP would have multiple benefits. It aligns best with the process approach and the minimal dataset for EES and RTP which show the interweaving between them. There would also be a lowering of the infrastructure and development cost when choosing this option". This conclusion is independent of the biometric identifiers used, whether facial image or fingerprints. Simply said, the EES will contain data of all third country nationals, while RTP will contain the Registered Traveller's status (active or not) and application data of frequent travellers. RTP can be considered as a subsystem of EES using the same identification data for those third-country nationals that have applied for RT status. Associated costs: The cost analysis developed as part of the Technical study shows that if EES and RTP would be developed as one single system rather than as two separate ones this would entail a total saving of €49.4 million over 4 years and €69.2 million over 7 years. The savings result from reduced development costs, shared project infrastructure as well as lower recurrent operational costs. Implementation considerations: The Technical Study clearly concluded in favour of building EES and RTP as one single system. However, one disadvantage of this option is that delivering one single system combining EES and RTP functionalities carries inherently a higher project management risk than two projects delivering each a single system. This disadvantage however only relates to the time-restricted project phase (estimated to be three years) and not to the subsequent operations phase. 5.1.3.Interoperability between EES/RTP and VIS The 2013 proposals consider already that EES and RTP should rely on the VIS biometric matching functionalities for all transactions based on the use of biometric data (biometric identification and biometric identity verification). The second option (one single EES/RTP) would achieve further interoperability as a direct communication channel between both systems would be established enabling EES/RTP to query VIS, acting in this case on behalf of the EES/RTP user, provided that this user has the required VIS access rights: A direct communication channel between EES functionalities and VIS is created. It will allow: oEES retrieving information from VIS concerning a traveller's visa; obiometric identity verification of visa holder travellers using fingerprints registered in VIS without having to register again these fingerprints in EES; oestablishing a relation of trust between the systems: a biometric identity verification performed by one of the systems is recognised by the other system (which will avoid having to perform two biometric identity verification for visa holder travellers); oidentification at the border crossing point (see point 5.2 "Biometrics"). oretrieving in EES information concerning the travel history (entry and exit records) of a visa applicant for the VIS processing of applications. This channel can be used under strictly defined conditions: access rights are defined for each system, meaning that for using the interoperability functionalities an end user needs to have the 'rights' required for accessing both systems. For both EES and RTP functionalities, the system is using the same biometric matching functionalities as used by the Visa Information System. This communication channel will enable both systems relying on each other for biometric identifications or biometric identity verifications, avoiding that the same biometric identifiers have to be enrolled twice (e.g.: a visa holder's fingerprints enrolled in VIS are not enrolled again in EES/RTP as this later system can rely on VIS data for any biometric identifications or biometric identity verification based on these fingerprints). The implementation of such interoperability corresponds to the privacy by design principles as it will reduce the duplication of personal data as (biometric) data registered in one system can be used by the other system without having to register them again. The collection of personal information is thus limited to what is strictly necessary for the specified purposes. It will also reduce the amount of data circulating on the communication networks and transiting through national systems as the queries done on behalf of the user and the corresponding answers (mostly limited to 'HIT'/'NO HIT' or 'YES'/'NO') will use this direct communication channel. Definition of interoperability and main options are explained in annex 9. EES/RTP would also use the same communication infrastructure (network) as VIS, the respective data flows remaining logically separated.

5.2.Biometrics: what biometric identifier(s) are required for the correct functioning of the system? Biometric identifiers are used to strengthen identity checks at external borders and to establish the relationship between an individual, his or her travel document(s) and the information registered in the database. Biometric identifiers are used also for detecting identity frauds (e.g.: people using several identities), detecting travel document fraud (e.g.: look-alike people using the same travel document) and identifying undocumented people inside the Schengen area. Biometric identifiers allow using self-service systems for the automation or semi-automation of border controls as explained under point 5.3 (c). The 2013 proposals suggested using fingerprints as the sole biometric identifier (10 fingerprints for EES and 4 fingerprints for RTP) while the EES impact assessment acknowledged that enrolling 10 fingerprints of visa-exempt travellers would increase the border crossing time. The Technical Study and the Pilot produced evidence on the feasibility of other options while maintaining a high level of reliability as an identification tool. The Study and the Pilot also took into account the diversity of border crossing types (air, sea or land) as well as the diversity of conditions (environment and climate, inside or outside building, in moving trains or vessels) for border control implementation. The following options are therefore considered: a)Fingerprints only (2013 proposal) b)Fingerprints and facial image combined. c)Facial image only. Some stakeholders have mentioned the capturing of the iris image as a possible alternative biometric identifier, either alone, or in combination with facial image. The iris has the advantage that while it is captured a facial image can be taken at the same time: the device for capturing the iris is a dedicated camera integrated in the equipment for taking the facial image. 'Iris' would be enrolled in the same way as the facial image. Identity verification would be based on iris or on facial image, at border crossing. Despite having some advantages, the iris option has been discarded. The Pilot has clearly demonstrated that: –Iris capturing appeared to be more difficult for a larger share of the population than the other biometrics i.e. people with a hanging eyelid; –Iris capturing can be very fast where fixed equipment is deployed (average of 4 seconds) but increases to 20 seconds on average with mobile equipment which is not significantly faster than for a small fingerprint set. The process was also not easier to be done with mobile devices in moving trains or vessels; –The implementation of iris as a biometric would require new investments in border posts and eliminates any possibility of re-use of existing equipment: the iris is taken at the same moment as the facial image but with a specific camera. The Smart Borders pilot report indicates that "The simplest iris cameras costs approximately 1000€ but more sophisticated devices were indicated to cost significantly more. The addition of in-built software for verification and inclusion of anti-spoofing features in the hardware also results in higher device prices" which is significantly more per item and brings in a high uncertainty on final costs.; –The accuracy level of iris technology used in outdoor conditions is currently not sufficient to achieve the objectives of the system as the false negative identification rate was estimated to be 2,5% which is significantly higher than for fingerprints; –Finally, iris was perceived by travellers as more intrusive than any other biometric. 5.2.1.Description of the options (a) Fingerprints only (2013 proposal): For EES, 10 fingerprints of the visa-exempt third country national that is not yet (first entry) or no more (after the end of the data retention period) registered in EES will be enrolled at the border crossing point. For third country nationals registered in EES, identity verification at border crossing will be based on a number of fingerprints to be approved by the committee established by the EES regulation. On the assumption that this committee would propose the same solution as in the case of VIS, verification would be done based on 1, 2 or 4 fingerprints. For RTP, 4 fingerprints for all third-country nationals are enrolled at application. At border crossing, identity verification would be based on a number of fingerprints to be defined by the formal committee set up by the RTP regulation. With the same assumption as for EES, it is likely that verification would be done based on 1, 2 or 4 fingerprints.

For enrolling or verifying fingerprints, the third country national has to press the fingers on the glass of a scanner in the case of a contact scanner or to move the hand(s) in a contactless scanner. (b) Fingerprints and facial image combined In this option fingerprints and facial image are used in combination. The Technical Study has demonstrated that the best results in terms of security versus processing speed are achieved when combining the use of four fingerprints and facial image. For EES, the fingerprints and the facial image are enrolled at the border crossing point for third-country nationals not yet (first entry) or no more (after the end of the data retention period) registered in EES. For third-country nationals registered in EES, identity verification based on fingerprints or on facial image is done at border crossing. For RTP, the biometric identifiers are enrolled at application. At border crossing, identity verification based on fingerprints or on facial image is done. The use of one biometric identifier is sufficient for identity verification. For enrolling or verifying fingerprints, the traveller has to press the fingers on the glass of a scanner in the case of a contact scanner or to move the hand in a contactless scanner. The facial image is enrolled using the picture contained in the chip of the electronic travel document or using a live camera. For verification, a picture from a live camera is compared with the image(s) registered in the system. If the verification is successful, this live-picture is also enrolled. The live-picture in the system is updated if a better quality live-picture is taken. If the image contained in the chip of the electronic travel document is not usable (broken chip, no image, bad quality) or if the travel document is not electronic, the use of a picture taken by a live camera is mandatory. The individual file of a person may contain multiple images, extracted from multiple electronic travel documents (in the case of a traveller using more than one travel document) and acquired from live cameras. (c) Facial image only For EES, the facial image of the third country national that is not yet (first entry) or no more (after the end of the data retention period) registered in EES will be enrolled at the border crossing point. For third country nationals registered in EES, an identity verification based on facial image is done at border crossing. For RTP, the facial image is enrolled at application. At border crossing, identity verification is done on the basis of a facial image. The processes for enrolling and verifying the facial image are identical to those described for option (b). 5.2.2.Use of biometrics for identity verification and for identification Biometric identifiers will be used in the following situations: at first entry, for enrolment in EES, when the individual file is created in the system, for enrolment in RTP, at subsequent border crossings for identity verification, each time the identification of an individual is required. Before entering into the details of using biometrics, it needs to be emphasised that visa-required third country nationals have their 10 fingerprints taken and registered in the Visa Information System (VIS) at the moment of making their first visa-application. When entering into the Schengen area, the identity of the visa-holder is authenticated by verifying the match of 1, 2 or 4 fingerprints vs. the 10 fingerprints stored in the VIS. The VIS also contains a picture of the applicant, which appears on the visa-sticker, but is not used by the biometric matching system. A visa-holder can therefore not be searched in VIS on the basis of /her picture only. Enrolment in EES

At border crossing point, if the traveller is not yet (first visit to the Schengen area) or no more (visit after the end of the data retention period) registered in the EES, the traveller needs to be "enrolled" in the system so that his/her identity is recorded and can serve as the reference for any further checks. If the facial image will be used as biometric identifier (alone or in combination with fingerprints) pictures of all third-country nationals (both visa-exempt and visa-holders) visiting the Schengen area will be registered in EES. If fingerprints are used as biometric identifier (alone or in combination with facial image) the fingerprints of visa-exempt third-country nationals will be registered in EES while for visa-required third country nationals the EES will rely on the fingerprints already registered in the VIS. As the enrolment process happens at the border it needs to be fast. At the same time it should produce high quality results, as the enrolled biometrics will be used for all subsequent verifications and identifications. Enrolment in RTP When a third-country national applies for Registered Traveller status, the traveller needs to be "enrolled" in the RTP so that his/her identity is recorded and can serve as the reference for any further checks. Verification at the border During the retention period of the EES and RTP individual files, the identity of the third-country national is verified before any border crossing at entry and exit. The traveller's biometrics are compared with the biometrics stored in his/her individual file in the EES database and in the VIS database for the fingerprints of visa holders. For this operation, called a 'one-to-one verification', the biometric identifier of the traveller is compared only with his/her own biometrics enrolled in his/her individual file in the database. This identity verification allows establishing a link between the individual and his/her individual file in the database. The biometric identity verification is an operation that happens for each and every crossing of the EU external border. It needs to be quick and reliable. Identification A biometric identification is performed if the identity of an individual needs to be determined because his/her travel documents are not available, or appear to be counterfeited or do not necessarily belong to the individual. Such a biometric identification can take place either at second line border control when the individual seeks to cross the border, or within the Schengen area in the case of an identity check. In these cases a sample of the biometric identifier from the individual is compared with each biometric record of the reference database to find out against which recorded identity a match is found. This operation is called the 'one-to-n (or one-to-all) identification'. The biometric identification would also be used if the identification at the border (deduplication) is implemented. In that case, for each third-country national whose claimed identity is not yet recorded in EES, the biometric identifier is compared with each biometric record of the reference database to confirm that the individual is not yet recorded. If this is confirmed, the individual file is created and the biometrics are recorded in the database. If the individual is already registered in the database, it is because: the individual is using the same identity in more than one travel document issued by one or several countries (bi-nationals); in this case, the different travel documents have to be linked to the same individual file; the individual already registered in the database has legally changed identity (e.g.: change of name after marriage); in this case, the new travel document with the new identity has to be linked to the existing individual file; the individual is using several identities. The biometric identification is a complex operation as in essence the biometric sample is compared with all stored samples. When this operation is performed for inland checks or second line border control operations, the volume of requests remains low compared to the verifications and a response time expressed in minutes is deemed acceptable. These two factors (volume and response time) combined do not therefore have a significant impact on the processing capacity (and cost) of the biometric matching system sized for the frequent 1-to-1 verifications. When systematic identification is required for first-line border checks, the response time needs to be brought down to a few seconds. The volume of identifications then also becomes of the same order of magnitude as the number of enrolments. This requires a significant increase of the processing capacity (and cost) of a biometric matching system sized only for 1-to-1 verifications. 5.3.Facilitation of border crossing

One of the main objectives of the system is to facilitate border crossings for regular travellers. The 2013 proposal suggests setting up an RTP programme for pre-vetted third country nationals. The technical study considered potential simplifications to this approach. The following options are considered: (a)RTP (2013 proposal), (b)RTP with on-line registration, (c)The use of process accelerators (a) RTP (2013 proposal) In this option the application process for registered traveller status is very similar to the visa application process. Applicants can submit their applications for RTP status in a consular post of any Member State. The traveller has to submit an application file, present the required supporting documents (regarding the purpose of the intended journeys, the sufficient means of subsistence, and the applicant's occupational or family status) and pay the fee. At first application, the traveller is required to appear in person for fingerprint enrolment, interview and check of the travel document. The whole process requires additional resources in consular posts and border crossing points for application collection, as well as in Member States' central administration for the pre-vetting and again in border posts for its completion. Although it is not inherent to the described process, the 2013 proposal provided that all registered traveller's identity and their biometrics would be stored in a database distinct from the EES database. The RTP database would also contain some of the data collected during the application process. At the border crossing, the third country national who has acquired the Registered Traveller (RT) status would have the possibility, to use dedicated ABC gates, if available, or lanes dedicated to EU citizens. The identity of the RT is verified (biometric verification), the RT status is checked and the person is subject to the checks applicable according to the Schengen Borders Code (the compliance with the rules concerning the authorised stay is verified and the VIS, SIS, Interpol database and national database are queried). However, due to the pre-vetting done during the RTP application process, RTs benefit at entry from three derogations to the thorough checks (no thorough scrutiny of the travel document for signs of falsification or counterfeiting; no questions on the point of departure and the destination and on the purpose of intended stay; no questions on the means of subsistence). The technical study, where this option is called Target Operational Model "M" (TOM M), considers that such a Registered Traveller Programme could interest 5 to 7 million third-country nationals. (b) RTP with on-line registration This option was identified in the Technical Study as a 'lighter' and less resource-intensive alternative for option (a). It assumes that the RTP applicant is already enrolled in EES and has at least one entry and exit record. This ensures that the biometric information of the traveller already exists as it has already been collected for the EES or VIS. Travellers would apply via a secured website dedicated for RT applications. All supporting documents for the request would be provided as scanned versions. Fees would be collected on line. Once the application is lodged, the pre-vetting would be performed by the competent Member State indicated as the Schengen country of main destination. The same supporting documents have to be submitted to obtain the RT status as for option (a). The conclusion of the vetting process would be communicated to the requester by e-mail. The RT status would be activated once the traveller has met with a border guard at the first visit to the Member State having processed the application. This would allow a final check and the verification of original documents if required by the Member State that vetted the application. At border crossing, the process is the same as for option (a).

Option (b), called in the technical study Target Operational Model "N" (TOM N), is only possible when EES and RTP are built as one single system. The advantage of this option is that it relies systematically on electronic communication, which could also make it a more attractive proposition for visa exempt regular travellers. (c) The use of process accelerators This third option takes as a starting point that border controls should be facilitated for the largest possible group of travellers. Both option (a) and (b) require active advance application to undergo a pre-vetting process in view of obtaining a 'status' that allows the RT to cross the borders on the basis of his/her authenticated identity. Option (c) is based on the idea that following a risk assessment using the information provided at the border crossing, and the responses from the different databases consulted (including EES) and the answers provided by the travellers through self-service systems, the border guard may decide to relieve the traveller from additional questions when a 'face to face' border check is not necessary. This option does not require the development of a specific IT system or of specific functionalities in EES. A detailed example of a border crossing process using accelerators is provided in annex 8 ('New Smart Border processes at border crossing points'). It assumes that third-country nationals would scan their travel document (passport) in a self-service kiosk, enrol their biometrics (if not yet registered in EES) or have a biometric verification of their identity (if already registered in EES) and answer the questions that are part of the thorough checks but reformulated as a set of closed questions. The kiosk application would trigger all queries to databases (VIS, SIS, Interpol database, national databases). The border guard would see on his/her working screen the results of these queries, of the operations done by the traveller and of the former entry/exit records in EES. On the basis of his/her risk assessment the border guard would then decide, whilst respecting the conditions set in the Schengen Borders Code, what further detailed questions are required for this traveller. In case there is no need for further controls, the border guard can decide to let the traveller leave using an automatic e-Gate where the exit record will be created. This last possibility shall only be granted when all the conditions of entry or exit foreseen under the Schengen Borders Code are met. If the traveller is not yet registered in EES, a verification of the biometrics and the travel document performed by the border guard is mandatory.

Option (c) relies on the "ease of use" of self-service kiosks by the "average" traveller and concentrates the border guard work on value-adding tasks. Considering the evolution of technology, the self-services kiosks could be complemented or eventually be replaced by mobile “app” solutions.

5.4.Retention time for the storage of data The functioning of the Entry Exit System requires the registration of data concerning the identity of the third country national (first name(s), surname, date of birth, current nationality, gender), the biometrics of the third country national, the travel document used by the third country national (document number, document type, document country code and expiry date), the visa in the case of a visa-required third-country national (visa sticker number, visa expiry date, number of authorised entries, authorised period of stay), the cross border movements (entry/exit) of the third country national (date and time of entry, entry authorising authority, entry Border Crossing Point, date and time of exit, exit Border Crossing Point), and the stay changes (revised expiry data of the authorisation of stay, date of change of limit of stay, place of change of limit of stay, ground for change or revocation). The identity (first name(s), surname, date of birth, current nationality and gender) of the third country national is copied from the travel document. Data concerning the identity of the third country national and the travel document are used for identifying the traveller. Biometrics are used for establishing a link between the individual and the database record as well as for detecting identity fraud. The visa information, the entry/exit records and stay changes are used for the calculation of the authorised stay. Compared with the 2013 proposals, the number of data elements to be recorded in the system has decreased as 10 elements such as the name at birth or the place of birth will not appear anymore in the revised proposal. In application of the privacy by design principles and in accordance with 2012 Commission's proposals for Data Protection, the data set detailed above is the minimum strictly required for the proper functioning of the Entry Exit System. It is limited to the minimum amount of information necessary for the specified purposes of the processing. To answer the question of how long data need to be retained for the correct functioning of the system the following options are considered: (a)An EES data retention period of 181 days (5 years for overstayers) and a RTP data retention period of 5 years (2013 proposal). (b)An EES data retention period of 181 days and reduction of the data retention period for RTP. (c)An extension of data retention periods. In all three options the question arises of what shall be done with the data on overstayers that have not yet left the Schengen area at the end of the data retention period. The legal proposals will suggest that in such case the identity of overstayers is removed from EES and, following a national decision, can be included as an alert in SIS for refusal of entry or stay. This will guarantee that the persons concerned can still be identified at inland checks or at border controls under the strict data protection and retention rules applicable to SIS data. SIS being systematically consulted at visa issuance, overstayers cannot have new visas or cannot pass borders without being identified. In all three options, the recorded data are automatically erased after the retention period has expired. Conditions for the possible advance deletion of data (e.g. in case the third-country national marries an EU citizen) are also defined.

(a) An EES data retention period of 181 days (5 years for overstayers) and a RTP data retention period of 5 years (2013 proposal) Under the 2013 EES legislative proposal, the minimum period to be taken into account for retaining entry and exit records for the purpose of EES is 181 days because it makes it possible to calculate all short stays during a period of 180 days and to verify whether the maximum 90-day period of stay has not been exceeded. In the case of an overstayer, the proposed retention period is 5 years after the last day of authorised stay. This retention period ensures that data are kept long enough to support the identification and return process, while remaining proportionate by setting an upper limit. For RTP data, the retention period is 5 years after the end of RT status. The period is determined in order to meet the goal of facilitated border crossings: by keeping data (including fingerprints) for five years the registered traveller does not need to provide fingerprints again at each yearly renewal. (b) An EES data retention period of 181 days and reduction of the data retention period for RTP and in the case of overstay A reduction of the data retention period can be considered for the RTP only as any reduction of the data retention period proposed in 2013 for the EES would result in the impossibility of controlling the respect of the rule concerning the maximum duration of stay in the Schengen area. Moreover, by having EES data deleted after a short period of time any third country national who comes back to the Schengen area beyond that period will again need to be re-enrolled. This operation is time-consuming whatever the choice of biometrics and would slow down considerably the border crossing processes. For RTP, a reduction of the data retention period would not affect the functioning of the system. The fact that in the 2013 proposals data are kept after the end of the RT status allows the reusing of information for a possible RT status renewal application. Considering that part of the data is unlikely to change (identity, biometrics), their retention simplifies the application process for the RT status renewal for both the traveller and the application collection process. Consequently, the retention period for RTP could be reduced without consequence on the functioning of the system. However, a short EES data retention period has an impact on Registered Travellers as, independently of the RT status, the data deletion will require frequent re-enrolment in EES, an operation that would reduce the advantages of the RTP. As a minimum the data retention period of registered travellers’ data in the EES would have to be the same as that of their registered traveller status. (c) An extension of the data retention periods In this option the view is taken that the data retention period should also take into account facilitation aspects for the traveller and operational aspects for the border guard. For the border guard the systematic deletion of the EES record after 181 days removes any trace of the traveller's recent history of entries and exits from the Schengen area which is required for a risk analysis. It would be a regression of useful information compared to what the border guard currently uses: consulting stamps in a travel document gives in many cases information that stretches a period of several years. A longer data retention period is thus necessary to allow the border guard performing the necessary risk analysis requested by the Schengen Border Code before authorising a traveller entering the Schengen area. The processing of visa application in consular posts requires also analysing the travel history of the applicant to assess the use of previous visas and the respect of the conditions of stay. The abandoning of passport stamping will be compensated by a consultation of the EES. The travel history available in the system should therefore cover a period of time which is sufficient for the purpose of visa issuance. A longer data retention period will reduce the re-enrolment frequency and will be beneficial for all travellers as the average border crossing time will decrease as will do the waiting time at border crossing points. Even for a traveller entering only once in the Schengen area, the fact that other travellers being already registered in the EES will not have to re-enrol will reduce the waiting time at border. A longer data retention period will also be necessary to allow for facilitation at border crossing by using process accelerators (as described under point 5.3.1 c)) and self-service systems. Facilitation is dependent of the data registered in the system. A short data retention period would reduce the group of travellers that can benefit of such facilitation and thereby undermine the stated objective of EES to facilitate border crossing. When considering the length of the data retention period, it should be noted that a period of five years would be consistent with the data retention period in VIS. In EURODAC, data concernin