CELEX: 
Language: en
Date: 2021-11-23 00:00:00
Title: COMMISSION DELEGATED DECISION on further defining security, illegal immigration or high epidemic risks

EXPLANATORY MEMORANDUM
            
            
               1.CONTEXT OF THE DELEGATED ACT
            
            
               In September 2018, the European Parliament and the Council adopted Regulation (EU) 2018/1240 establishing the European Travel Information and Authorisation System (ETIAS)
                  1
               . 
            
            
               It requires the European Commission to adopt delegated acts for the development and technical implementation of the European Travel Information and Authorisation System.
            
            
               In particular, pursuant to Article 33(2) of Regulation (EU) 2018/1240, the Commission is delegated the task ‘to further define the risks related to security or illegal immigration or a high epidemic risk’ on the basis of statistics and information referred to in Article 33(2)(a) to (f). 
            
            
               2.CONSULTATIONS PRIOR TO THE ADOPTION OF THE ACT
            
            
               An Expert Group on Information Systems for Borders and Security was established to help draft the delegated act. All Member States were given an opportunity to nominate experts, in accordance with Article 89(4) of Regulation (EU) 2018/1240 and the principles laid down in the Interinstitutional Agreement of 13 April 2016 on Better Law-Making. As a result, this Commission Decision was drafted on the basis of input from Member State experts in the Expert Group. This Expert Group was consulted between 3 July 2020 and 15 January 2021, after which the document was considered final by the experts and the Commission. The experts were also given the opportunity to provide the Commission with oral and written comments throughout this period. 
            
            
               The European Border and Coast Guard Agency, within which the ETIAS Central Unit will be established, and Europol, were also consulted. 
            
            
               The European Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (‘eu-LISA’) also advised the Commission on the technical needs and feasibility of the proposed initiative. 
            
            
               The European Data Protection Supervisor was consulted before adoption to ensure that the proposed initiative respected data protection provisions. 
            
            
               3.LEGAL ELEMENTS OF THE DELEGATED ACT
            
            
               In order to establish the specific risk indicators used as part of the screening process, it is necessary to define risks related to security, illegal immigration or epidemic outbreaks, by collecting and analysing statistics, information and reports referred to in Article 33(2)(a) to (f) of Regulation (EU) 2018/1240. This analysis is to result in sets of characteristics of specific groups of travellers associated with these risks. The interpretation of these sets of characteristics will make it possible to identify specific risks. These will, in turn, form the basis for the development of specific risk indicators.
            
            
               In order to ensure that risks may be defined on the basis of the elements referred to in Article 33(2)(a) to (c) of Regulation (EU) 2018/1240, it is necessary to ensure that such elements are monitored and collected by the European Travel Information and Authorisation System and the Entry/Exit System in accordance with Commission Delegated Regulation C(2021)4982
                  2
                and in a manner that makes it possible to continuously identify sets of characteristics of specific groups of travellers with overstaying, refusal of entry or refusal of travel authorisation. For this purpose, the ETIAS Central Unit should estimate the total number of cases associated with such practices, identify specific groups of travellers for which such practices occur at abnormal rates, identify the sets of characteristics of the specific groups of travellers in question, and any correlation with information collected through their application files. 
            
            
               Similarly, in relation to overstayers and refusals of entry, Member States responsible for providing the data referred to in Article 33(2)(e) of Regulation (EU) 2018/1240 through their ETIAS National Units, should provide, based on evidence, sets of characteristics of specific groups of travellers associated with overstaying or refusal of entry. For this purpose, the Member States should identify abnormal rates of overstayers present in a Member State or in a specific area of a Member State or abnormal rates of refusals of entry by a Member State for specific groups of travellers compared to other specific groups of travellers. This analysis should be reviewed every 6 months. 
            
            
               In order to ensure that risks may be defined on the basis of the elements referred to in Article 33(2)(d) of Regulation (EU) 2018/1240, Member States responsible for providing the data referred to in this provision through their ETIAS National Units should provide sets of characteristics of specific groups of travellers associated with security risks identified on the basis of known facts and evidence. This analysis should be reviewed every 6 months.
            
            
               Finally, in order to ensure that risks may be defined on the basis of the elements referred to in Article 33(2)(f) of Regulation (EU) 2018/1240, epidemiological risk assessments provided by Member States in particular through the epidemiological surveillance and control of communicable diseases network and the Early Warning and Response System, the European Centre for Disease Prevention and Control and the World Health Organization should include a minimum of detail that makes it possible to identify sets of characteristics of specific groups of travellers associated with high epidemic risks.
            
            
               COMMISSION DELEGATED DECISION
            
            
               of 23.11.2021
            
            
               on further defining security, illegal immigration or high epidemic risks  
            
         
         
            
               THE EUROPEAN COMMISSION,
            
            
               Having regard to the Treaty on the Functioning of the European Union,
            
            
               Having regard to Regulation (EU) 2018/1240 of the European Parliament and of the Council of 12 September 2018 establishing a European Travel Information and Authorisation System (ETIAS) and amending Regulations (EU) No 1077/2011, (EU) No 515/2014, (EU) 2016/399, (EU) 2016/1624 and (EU) 2017/2226
                  3
               , and in particular Article 33(2) thereof,
            
            
               Whereas:
            
            
               (1)Regulation (EU) 2018/1240 establishes the European Travel Information and Authorisation System (ETIAS) applicable to visa-exempt third-country nationals seeking to enter the territory of the Member States. 
            
            
               (2)Applications for authorisation are to be subject to screening rules that enable data recorded in the application to be analysed by reference to specific risk indicators corresponding to previously identified security, illegal immigration or high epidemic risks. 
            
            
               (3)In order to establish the specific risk indicators used as part of the screening process, it is necessary to further define these risks, by collecting and analysing statistics and information referred to in Article 33(2)(a) to (f) of Regulation (EU) 2018/1240. This analysis is to result in sets of characteristics of specific groups of travellers associated with security or illegal immigration or high epidemic risks. The interpretation of these sets of characteristics will make it possible to identify specific risks. These will, in turn, form the basis for the development of specific risk indicators.
            
            
               (4)In order to ensure that risks may be defined on the basis of the elements referred to in Article 33(2)(a) to (c) of Regulation (EU) 2018/1240, it is necessary to ensure that such elements are monitored and collected by the European Travel Information and Authorisation System and the Entry/Exit System in accordance with Commission Delegated Regulation C(2021)4982 and in a manner that makes it possible to continuously identify sets of characteristics of specific groups of travellers associated with overstaying, refusal of entry or refusal of travel authorisation. For this purpose, the ETIAS Central Unit should estimate the total number of cases associated with such practices, identify specific groups of travellers for which such practices occur at abnormal rates, identify the sets of characteristics of the specific groups of travellers in question, and any correlation with information collected through their application files. 
            
            
               (5)Similarly, in relation to overstayers and refusals of entry, Member States responsible for providing the data referred to in Article 33(2)(e) of Regulation (EU) 2018/1240 through their ETIAS National Units, should provide sets of characteristics of specific groups of travellers associated with overstaying or refusal of entry. For this purpose, the Member States should identify abnormal rates of overstayers present in a Member State or in a specific area of a Member State or abnormal rates of refusals of entry by a Member State for specific groups of travellers compared to other specific groups of travellers. This analysis should be reviewed every 6 months. 
            
            
               (6)In order to ensure that risks may be defined on the basis of the elements referred to in Article 33(2)(d) of Regulation (EU) 2018/1240, Member States responsible for providing the data referred to in this provision through their ETIAS National Units should provide sets of characteristics of specific groups of travellers associated with security risks identified on the basis of known facts and evidence. This analysis should be reviewed every 6 months.
            
            
               (7)In order to ensure that risks be defined on the basis of the elements referred to in Article 33(2)(f) of Regulation (EU) 2018/1240, epidemiological risk assessments provided by Member States in particular through the epidemiological surveillance and control of the communicable diseases network and the Early Warning and Response System, the European Centre for Disease Prevention and Control and the World Health Organization should include a minimum of detail that makes it possible to identify sets of characteristics of specific groups of travellers associated with high epidemic risks.
            
            
               (8)When identifying the sets of characteristics of specific groups of travellers associated with a specific risk, the ETIAS Central Unit and Member States should take into account the age range, sex, nationality, country and city of residence, level of education and current occupation of the individuals in the specific group of travellers identified.
            
            
               (9)Given that Regulation (EU) 2018/1240 builds upon the Schengen acquis, in accordance with Article 4 of Protocol No 22 on the position of Denmark, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, Denmark notified the implementation of Regulation (EU) 2018/1240 in its national law. Denmark is therefore bound by this Decision.
            
            
               (10)This Decision constitutes a development of the provisions of the Schengen acquis in which Ireland does not take part
                  4
               ; Ireland is therefore not taking part in the adoption of this Decision and is not bound by it or subject to its application.
            
            
               (11)As regards Iceland and Norway, this Decision constitutes a development of the provisions of the Schengen acquis within the meaning of the Agreement concluded by the Council of the European Union and the Republic of Iceland and the Kingdom of Norway concerning the association of those two States with the implementation, application and development of the Schengen acquis
                  5
               , which fall within the area referred to in Article 1, point A of Council Decision 1999/437/EC
                  6
               .
            
            
               (12)As regards Switzerland, this Decision constitutes a development of the provisions of the Schengen acquis within the meaning of the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation’s association with the implementation, application and development of the Schengen acquis
                  7
               , which fall within the area referred to in Article 1, point A of Council Decision 1999/437/EC, read in conjunction with Article 3 of Council Decision 2008/146/EC
                  8
               . 
            
            
               (13)As regards Liechtenstein, this Decision constitutes a development of the provisions of the Schengen acquis within the meaning of the Protocol between the European Union, the European Community, the Swiss Confederation and the Principality of Liechtenstein on the accession of the Principality of Liechtenstein to the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation’s association with the implementation, application and development of the Schengen acquis
                  9
               , which fall within the area referred to in Article 1, point A of Council Decision 1999/437/EC read in conjunction with Article 3 of Council Decision 2011/350/EU
                  10
               . 
            
            
               (14)As regards Cyprus, Bulgaria, Romania and Croatia, this Decision constitutes an act building on, or otherwise relating to, the Schengen acquis within, respectively, the meaning of Article 3(1) of the 2003 Act of Accession, Article 4(1) of the 2005 Act of Accession and Article 4(1) of the 2011 Act of Accession.
            
            
               (15)The European Data Protection Supervisor, consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 of the European Parliament and of the Council
                  11
               , delivered an opinion on 7 June 2021,
            
            
               HAS ADOPTED THIS DECISION: 
            
         
         
            
               Article 1
                  Subject matter
            
            
               This Decision further defines security, illegal immigration or high epidemic risks on the basis of detailed statistical data and information referred to in Article 33(2) of Regulation (EU) 2018/1240.
            
            
               Article 2
               Definitions
            
            
               For the purposes of this Decision, the following definitions apply:
            
            
               (a)‘specific group of travellers’ means a group of third-country nationals of a known size and composition attributed particular sets of characteristics;
            
            
               (b)‘sets of characteristics’ means distinguishing sets of observable qualities or properties identified based on information and statistics referred to in Article 33(2) of Regulation (EU) 2018/1240 and taking into account the data referred to in Article 33(4)(a) to (d) of that Regulation; 
            
            
               (c)‘serious cross-border threat to health’ means, in accordance with Article 3 of Decision No 1082/2013/EU, a life-threatening or otherwise serious hazard to health of biological, chemical, environmental or unknown origin which spreads or entails a significant risk of spreading across the external borders of Member States, and which may necessitate coordination at Union level in order to ensure a high level of human health protection;
            
            
               (d)‘communicable disease’ means, in accordance with Article 3 of Decision No 1082/2013/EU, an infectious disease caused by a contagious agent which is transmitted from person to person by direct contact with an infected individual or by indirect means such as exposure to a vector, animal, fomite, product or environment, or exchange of fluid, which is contaminated with the contagious agent;
            
            
               (e)‘epidemiologic surveillance’ means, in accordance with Article 3 of Decision No 1082/2013/EU, the systematic collection, recording, analysis, interpretation and dissemination of data and analysis on communicable diseases and related special health issues;
            
            
               (f)‘statistical data’ means the collection of statistics generated by Entry Exit System or the European Travel Information and Authorisation System and as further defined in Article 1, point 1 of Commission Delegated Regulation C(2021)4982; 
            
            
               (g)‘statistical reports’ means the reports as defined in Article 1, point 2 of Commission Delegated Regulation C(2021)4982; 
            
            
               (h)‘customisable reports’ means the reports as defined in Article 1, point 3 of Commission Delegated Regulation C(2021)4982.
            
            
               Article 3
               Analysis of statistical data on overstaying, refusal of entry and refusal of travel authorisation
            
            
               1.The ETIAS Central Unit shall monitor the statistical data referred to in Article 33(2)(a) to (c) of Regulation (EU) 2018/1240 stored in the central repository for reporting and statistics established pursuant to Article 39 of Regulation (EU) 2019/817.
            
            
               2.For the purpose of paragraph 1, the central repository for reporting and statistics shall enable the ETIAS Central Unit to obtain, in accordance with Article 6 of Commission Delegated Regulation C(2021)4982, statistical data, statistical reports and customisable reports that make it possible to analyse those data and reports to further define the risks of overstaying, refusal of entry or refusal of travel authorisation, including by identifying: 
            
            
               (a)the total number of cases associated with overstaying, refusal of entry or refusal of travel authorisation, respectively, using historical data;
            
            
               (b)specific groups of travellers associated with overstaying, refusal of entry or refusal of travel authorisation, respectively, using data derived from abnormal rates and absolute numbers of overstayers, refusals of entry or refusals of travel authorisation, respectively, compared to other specific groups;
            
            
               (c)the sets of characteristics of specific groups of travellers identified under point (b);
            
            
               (d)the sets of characteristics corresponding to correlations between the specific groups of travellers identified under point (b) and information collected through their application file.
            
            
               3.Where needed to analyse the reasons for specific abnormal rates and absolute numbers identified in accordance with paragraph 2(b), the ETIAS Central Unit may consult the ETIAS National Units of relevant Member State(s).
            
         
         
            
               Article 4
               Member State analysis of specific security risks or threats
            
            
               1.Through their ETIAS National Units, Member States shall provide the ETIAS Central Unit with the analysis referred to in Article 33(2)(d) of Regulation (EU) 2018/1240. The Member States shall review their analysis at least every 6 months or where new information emerges that makes it necessary to modify the analysis and, where applicable, provide the ETIAS Central Unit with the revised analysis through their ETIAS National Units. The analysis and any review of it shall include at least:
            
            
               (a)a description of the security risk or threat identified, including the frequency, trends and impacts of past occurrences of incidents, specifying a unique reference number for each risk or threat;
            
            
               (b)a list of known facts and evidence related to the security risk or threat identified;
            
            
               (c)the sets of characteristics of specific groups of travellers associated with the security risk or threat identified.
            
            
               2.Where one or more of the elements referred to in paragraph 1(a) are not available, Member States shall, through their ETIAS National Units, provide the ETIAS Central Unit with a justification.
            
            
               3.Member States shall receive advance notification from the ETIAS Central Unit of the need to review and update the analysis referred to in paragraph 1.
            
            
               4.The ETIAS Central Unit shall, in consultation with the ETIAS National Unit of the Member State that has provided the relevant information, assess its relevance for specifying the risks in question. 
            
            
               Article 5
               Member State analysis of abnormal rates of overstaying and refusals of entry
            
            
               1.Through their ETIAS National Units, Member States shall provide the ETIAS Central Unit with the analysis referred to in Article 33(2)(e) of Regulation (EU) 2018/1240. The Member States shall review their analysis at least every 6 months or where new information emerges that makes it necessary to modify the analysis and, where applicable, provide the ETIAS Central Unit with the revised analysis through their ETIAS National Units. The analysis and any review of it shall include at least:
            
            
               (a)a description of the risks associated with abnormal rates of overstaying or refusals of entry identified, specifying a unique reference number for each risk;
            
            
               (b)evidence concerning:
            
            
               –an abnormal rate and absolute number of overstayers for a specific group of travellers present in a Member State or in a specific area of a Member State compared to other specific groups of travellers present in a Member State or in a specific area of a Member State; or
            
            
               –an abnormal rate and absolute number of refusals of entry issued by a Member State for a specific group of travellers compared to the number of refusals of entry issued by a Member State for other specific groups of travellers;
            
            
               (c)the sets of characteristics of specific groups of travellers associated with overstaying or refusal of entry. 
            
            
               2.Where one or more of the elements referred to in paragraph 1(a) are not available, Member States shall, through their ETIAS National Units, inform the ETIAS Central Unit by providing reasons.
            
            
               3.Member States shall receive advance notification from the ETIAS Central Unit of the need to review and update the analysis referred to in paragraph 1.
            
            
               4.The ETIAS Central Unit shall, in consultation with the ETIAS National Unit of the Member State that has provided the relevant information, assess its relevance and usability for specifying the risks in question.
            
            
               Article 6
               Analysis of specific high epidemic risks 
            
            
               1.When further defining specific high epidemic risks as referred to in Article 33(2)(f) of Regulation (EU) 2018/1240, the ETIAS Central Unit shall base its analysis on:
            
         
         
            
               (a)information provided by Member States concerning cases of high epidemic risks in particular where posing a serious cross-border threat to health in the Union provided through the epidemiological surveillance and control of communicable diseases network and the Early Warning and Response System in accordance with Articles 6, 8 and 9 of Decision No 1082/2013/EU;
            
            
               (b)information provided by the European Centre for Disease Prevention and Control concerning epidemiological surveillance information and risk assessment of the potential severity of the threat to public health in accordance with Article 10(1)(a) of Decision No 1082/2013/EU;
            
            
               (c)disease outbreaks reported by the World Health Organization through the International Health Regulations protocols and the Disease Outbreak News.
            
            
               2.The ETIAS Central Unit shall take into consideration:
            
            
               (a)the recognition of a public health emergency in accordance with Article 12 of Decision No 1082/2013/EU;
            
            
               (b)a coordinated response in accordance with Article 11 of Decision No 1082/2013/EU;
            
            
               (c)the World Health Organization declaration of a Public Health Emergency of International Concern.
            
            
               In cases where the information referred to in Article 6(2) concerns any of the communicable diseases referred to in Annex I of Commission Implementing Decision (EU) 2018/945, the specific criteria and case definitions in Annex II of that Commission Implementing Decision shall apply.
            
            
               3.The analysis shall be carried out by the ETIAS Central Unit, in consultation with the ETIAS National Units of the Member State(s) in question and the European Centre for Disease Prevention and Control. It shall at least include the identification of the sets of characteristics of specific groups of travellers associated with the risk identified. 
            
            
               Article 7
               Communication
            
            
               1.For the purposes of Articles 3(3), 4, 5 and 6(3), the European Union Agency for Large-scale IT Systems shall establish a functionality of the software referred to in Article 6(2)(m) of Regulation (EU) 2018/1240 enabling the ETIAS National Units and the ETIAS Central Unit to exchange information. 
            
            
               2.For the purposes of the exchange of information referred to in Articles 4 and 5, the functionality referred to in paragraph 1 shall require that the information be provided in a specific format, taking into account Commission Implementing Decision C(2021)1840
                  12
                and Commission Delegated Regulation (EU) 2021/916
                  13
               .
            
            
               Article 8
               Data protection
            
            
               The different analyses referred to in this Decision shall not contain any personal data.
            
            
               Article 9
                  Addressees
            
            
               This Decision is addressed to the Kingdom of Belgium, the Republic of Bulgaria, the Czech Republic, the Kingdom of Denmark, the Federal Republic of Germany, the Republic of Estonia, the Hellenic Republic, the Kingdom of Spain, the French Republic, the Republic of Croatia, the Italian Republic, the Republic of Cyprus, the Republic of Latvia, the Republic of Lithuania, the Grand Duchy of Luxembourg, Hungary, the Republic of Malta, the Kingdom of the Netherlands, the Republic of Austria, the Republic of Poland, the Portuguese Republic, Romania, the Republic of Slovenia, the Slovak Republic, the Republic of Finland, the Kingdom of Sweden.
            
            
               Done at Brussels, 23.11.2021
            
            
               
                     For the Commission
               
               
                     Ylva JOHANSSON
                     Member of the Commission
               
            
            
                     
                        
                           
                     
                  
               
         
            
         
         
            
                  
                     (1)
                  
                        Regulation (EU) 2018/1240 of the European Parliament and of the Council of 12 September 2018 establishing a European Travel Information and Authorisation System (ETIAS) and amending Regulations (EU) No 1077/2011, (EU) No 515/2014, (EU) 2016/399, (EU) 2016/1624 and (EU) 2017/2226 (OJ L 236, 19.9.2018, p. 1).
               
               
                  
                     (2)
                  
                        Commission Delegated Regulation C(2021)4982 supplementing Regulation (EU) 2019/817 of the European Parliament and of the Council with detailed rules on the operation of the central repository for reporting and statistics.
               
               
                  
                     (3)
                  
                        OJ L 236, 19.9.2018, p. 1. 
               
               
                  
                     (4)
                  
                        This Decision falls outside the scope of the measures provided for in Council Decision 2002/192/EC of 28 February 2002 concerning Ireland’s request to apply some of the provisions of the Schengen acquis (OJ L 64, 7.3.2002, p. 20).
               
               
                  
                     (5)
                  
                        OJ L 176, 10.7.1999, p. 36.
               
               
                  
                     (6)
                  
                        Council Decision 1999/437/EC of 17 May 1999 on certain arrangements for the application of the Agreement concluded by the Council of the European Union and the Republic of Iceland and the Kingdom of Norway concerning the association of those two States with the implementation, application and development of the Schengen acquis (OJ L 176, 10.7.1999, p. 31).
               
               
                  
                     (7)
                  
                        OJ L 53, 27.2.2008, p. 52.
               
               
                  
                     (8)
                  
                        Council Decision 2008/146/EC of 28 January 2008 on the conclusion, on behalf of the European Community, of the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation’s association with the implementation, application and development of the Schengen acquis (OJ L 53, 27.2.2008, p. 1).
               
               
                  
                     (9)
                  
                        OJ L 160, 18.6.2011, p. 21.
               
               
                  
                     (10)
                  
                        Council Decision 2011/350/EU of 7 March 2011 on the conclusion, on behalf of the European Union, of the Protocol between the European Union, the European Community, the Swiss Confederation and the Principality of Liechtenstein on the accession of the Principality of Liechtenstein to the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation’s association with the implementation, application and development of the Schengen acquis, relating to the abolition of checks at internal borders and movement of persons (OJ L 160, 18.6.2011, p. 19).
               
               
                  
                     (11)
                  
                        Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39).
               
               
                  
                     (12)
                  
                        Commission Implementing Decision C(2021)1840 of 20 May 2021 laying down requirements concerning the format of personal data to be inserted in the application form to be submitted pursuant to Article 17(1) of Regulation (EU) 2018/1240 of the European Parliament and the Council as well as the parameters and the verifications to be implemented in order to ensure completeness of the application and coherence of those data.
               
               
                  
                     (13)
                  
                        OJ L 201, 8.6.2021, p. 1–18.