Summary of the Opinion of the European Data Protection Supervisor on the Proposal for a Regulation on the digitalisation of the visa procedure (The full text of this Opinion can be found in English, French and German on the EDPS website www.edps.europa.eu) 2022/C 277/06
Date: 2022-07-19
Institutions: European Data Protection Supervisor
Subjects: EU visa policy, Schengen Agreement, admission of aliens, border control, data protection, digitisation, exchange of information, external border of the EU, foreign national, information system, personal data, protection of privacy








C_2022277EN.01000701.xml










19.7.2022   


EN


Official Journal of the European Union


C 277/7






Summary of the Opinion of the European Data Protection Supervisor on the Proposal for a Regulation on the digitalisation of the visa procedure


(The full text of this Opinion can be found in English, French and German on the EDPS website www.edps.europa.eu)


(2022/C 277/06)
On 27 April 2022, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council on the digitalisation of the visa procedure. The Proposal aims at introducing the possibility to submit visa applications online through the European digital visa application platform, and replacing the visa sticker with a digital visa. By doing so, the visa application procedures within the Schengen area should be simplified and harmonised, and security risks posed by the physical visa stickers would be reduced.
The EDPS recognises that the digitalisation of the visa processing has the potential to address a number of challenges faced by visa applicants and consulates. However, the mandatory nature of the new procedure may also create additional obstacles to visa applicants, for instance, due to IT illiteracy or lack of adequate equipment. The EDPS recommends including in the Proposal an explicit provision that would exempt individuals with accessibility issues from using the European digital visa application platform.
The EDPS takes note that the Proposal adds, among the personal data to be included in the visa application, the IP addresses from which application forms are submitted. In this regard, the EDPS recalls the principle of data minimisation, which should lead the Commission to assess whether the collection of IP addresses is needed for the purposes of the Proposal.
The EDPS also recalls the importance of providing to the data subjects information about the processing of their personal data, to ensure fair processing. Consequently, since the personal data for VIS shall be first collected in the European online visa platform, the EDPS is of the opinion that information about the processing of personal data in the context of VIS, in line with Article 37(1) of the VIS Regulation, should also be provided by the platform. Besides, in view of the operationalisation of interoperability and the consequent processing of personal data for multiple purposes, the right to information should not be limited to providing information about the purposes for which the data will be processed within the VIS. It should also provide information about the processing that takes place in all the other JHA large-scale database systems and interoperability components falling within the scope of the interoperability framework.
1.   INTRODUCTION AND BACKGROUND









1.


On 27 April 2022 the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council amending Regulations (EC) No 767/2008 (1), (EC) No 810/2009 (2) and (EU) 2017/2226 of the European Parliament and of the Council (3), Council Regulations (EC) No 1683/95 (4), (EC) No 333/2002 (5), (EC) No 693/2003 (6) and (EC) 694/2003 (7) and Convention implementing the Schengen Agreement (8), as regards the digitalisation of the visa procedure (‘the Proposal’).












2.


The Proposal aims to streamline and harmonise the procedures in the context of the common visa policy and align travel, entry requirements and border checks within the Schengen area through digitalisation and the interoperability framework at the borders (9). To this end, the Proposal would replace the paper visa sticker with a digital visa and introduce a mandatory online European digital visa application form.












3.


The Estonian Council Presidency began the discussion on the introduction of an online visa application (10) and a digital visa (11) back in 2017. In 2018, the European Commission took up the debate on the digitalisation of the visa processing and announced in its Communication on visa policy the launch of feasibilities studies and pilot projects that would have laid down the ground for future proposals (12). The New Pact on Migration and Asylum set the objective of making the visa procedure fully digitalised by 2025, with a digital visa and the ability to submit visa applications online (13).












4.


The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 28 April 2022, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 47 of the Proposal.




12.   CONCLUSIONS









24.


In light of the above, the EDPS makes the following recommendations:






(1)


to clarify Recital 14 in order to ensure that persons with digital accessibility issues should be entitled to lodge their applications in person, and to reflect this rule in the operative part of the Proposal;










(2)


to remove the reference in Article 2(3) of the Proposal to IP addresses as part of the data of the visa application pursuant to Article 7b(5) ;










(3)


to define a common procedure to ensure that data quality checks on the personal data inserted in the application form via the European digital visa application platform are homogeneous and auditable among different stakeholders;










(4)


to clarify the roles and responsibilities among eu-LISA, the Member States authorities and, if relevant, the external service providers involved in the processing of personal data via the European digital visa application platform;










(5)


to remove the derogation to Article 44(1) of Regulation (EC) No 810/2009, as mentioned in Article 1(29)of the Proposal, in order to ensure the encryption of personal data accessed by external service providers through the EU application platform, via the external service provider gateway and, more generally, to provide for security mechanisms for the use of this gateway;










(6)


to determine robust authentication mechanisms as part of the secure account service;










(7)


to include in the European digital visa application platform information about the processing of personal data for the purposes of VIS and additional purposes derived from the operationalisation of the interoperability framework.









Brussels, 21 June 2022.

Wojciech Rafał WIEWIÓROWSKI




(1)  Regulation (EC) No 767/2008 of the European Parliament and of the Council of 9 July 2008 concerning the Visa Information System (VIS) and the exchange of data between Member States on short-stay visas (OJ L 218, 13.8.2008, p. 60).

(2)  Regulation (EC) No 810/2009 of the European Parliament and of the Council of 13 July 2009 establishing a Community Code on Visas (OJ L 243, 15.9.2009, p. 1).

(3)  Regulation (EU) 2017/2226 of the European Parliament and of the Council of 30 November 2017 establishing an Entry/Exit System (EES) to register entry and exit data and refusal of entry data of third-country nationals crossing the external borders of the Member States and determining the conditions for access to the EES for law enforcement purposes, and amending the Convention implementing the Schengen Agreement and Regulations (EC) No 767/2008 and (EU) No 1077/2011 (OJ L 327, 9.12.2017, p. 20).

(4)  Council Regulation (EC) No 1683/95 of 29 May 1995 laying down a uniform format for visas (OJ L 164, 14.7.1995, p. 1).

(5)  Council Regulation (EC) No 333/2002 of 18 February 2002 on a uniform format for forms for affixing the visa issued by Member States to persons holding travel documents not recognised by the Member State drawing up the form (OJ L 53, 23.2.2002, p. 4).

(6)  Council Regulation (EC) No 693/2003 of 14 April 2003 establishing a specific Facilitated Transit Document (FTD), a Facilitated Rail Transit Document (FRTD) and amending the Common Consular Instructions and the Common Manual (OJ L 99, 17.4.2003, p. 8).

(7)  Council Regulation (EC) No 694/2003 of 14 April 2003 on uniform formats for Facilitated Transit Documents (FTD) and Facilitated Rail Transit Documents (FRTD) provided for in Regulation (EC) No 693/2003 (OJ L 99, 17.4.2003, p. 15).

(8)  Convention implementing the Schengen Agreement of 14 June 1985 between the Governments of the States of the Benelux Economic Union, the Federal Republic of Germany and the French Republic on the gradual abolition of checks at their common borders (OJ L 239, 22.9.2000, p. 19).

(9)  COM(2022) 658 final, p. 7.

(10)  Presidency Council of the European Union, e-Visa: Improving the current visa process with online visa application, 12546/17, October 2017.

(11)  Presidency Council of the European Union, e-Visa: Improving the current visa process with digital visa, 11816/17, October 2017.

(12)  Communication from the Commission to the European Parliament and the Council, Adapting the common visa policy to new challenges, COM(2018) 251 final.

(13)  COM(2020) 609 final, p. 13.