Article 18 Personal data of third-country nationals who have been refused entry
1. Where a decision has been taken by the border authority, in accordance with Article 14 of and Annex V to Regulation (EU) 2016/399, to refuse the entry of a third-country national for a short stay on the territory of the Member States and where no previous file is recorded in the EES for that third-country national, the border authority shall create an individual file in which it shall enter: (a) for third-country nationals subject to a visa requirement, the alphanumeric data required pursuant to Article 16(1) of this Regulation and, where relevant, the data referred to in Article 16(6) of this Regulation; (b) for visa-exempt third-country nationals, the alphanumeric data required pursuant to Article 17(1) of this Regulation. 2. Where the third-country national is refused entry on the basis of a reason corresponding to point B, D or H of Part B of Annex V to Regulation (EU) 2016/399 and where no previous file with biometric data is recorded in the EES for that third-country national, the border authority shall create an individual file in which it shall enter the alphanumeric data required pursuant to Article 16(1) or Article 17(1) of this Regulation, as appropriate, as well as the following data: (a) for third-country nationals subject to a visa requirement, the facial image referred to in point (d) of Article 16(1) of this Regulation; (b) for visa-exempt third-country nationals, the biometric data required pursuant to points (b) and (c) of Article 17(1) of this Regulation; (c) for third-country nationals subject to a visa requirement who are not registered in the VIS, the facial image referred to in point (d) of Article 16(1) of this Regulation and the fingerprint data as referred to point (c) of Article 17(1) of this Regulation. 3. By way of derogation from paragraph 2 of this Article, where the reason corresponding to point H of Part B of Annex V to Regulation (EU) 2016/399 applies and the biometric data of the third-country national are recorded in the SIS alert that results in the refusal of entry, the biometric data of the third-country national shall not be entered in the EES. 4. Where the third-country national is refused entry on the basis of a reason corresponding to point I of Part B of Annex V to Regulation (EU) 2016/399 and where no previous file with biometric data is recorded in the EES for that third-country national, the biometric data shall only be entered in the EES where the entry is refused because the third-country national is considered to be a threat to internal security, including, where appropriate, elements of public policy. 5. Where a third-country national is refused entry on the basis of a reason corresponding to point J of Part B of Annex V to Regulation (EU) 2016/399, the border authority shall create the individual file of that third-country national without adding biometric data. If the third-country national possesses an eMRTD, the facial image shall be extracted from that eMRTD. 6. Where a decision has been taken by the border authority, in accordance with Article 14 of and Annex V to Regulation (EU) 2016/399, to refuse the entry of a third-country national for a short stay to the territory of the Member States, the following data shall be entered in a separate refusal of entry record: (a) the date and time of refusal of entry; (b) the border crossing point; (c) the authority that refused the entry; (d) the point or points corresponding to the reasons for refusing entry in accordance with Part B of Annex V to Regulation (EU) 2016/399. In addition, for third-country nationals subject to a visa requirement, the data provided for in points (d) to (g) of Article 16(2) of this Regulation shall be entered in the refusal of entry record. In order to create or update the refusal of entry record of third-country nationals subject to a visa requirement, the data provided for in points (d), (e) and (f) of Article 16(2) of this Regulation may be retrieved from the VIS and imported into the EES by the competent border authority in accordance with Article 18a of Regulation (EC) No 767/2008. 7. The refusal of entry record provided for in paragraph 6 shall be linked to the individual file of the third-country national concerned.
Amendment rationale: CONTEXT OF THE PROPOSAL Reasons for and objectives of the proposal In September 2018, the Council and the European Parliament adopted two legislative acts, a Regulation establishing the European Travel Information and Authorisation System (‘ETIAS’) 1 and an amendment of the Europol Regulation for the purpose of establishing ETIAS 2 . Establishing ETIAS is among efforts undertaken in recent years at EU level to enhance the security of citizens and prevent irregular migration in an open Europe, securing and continuing to strengthen the management of external borders 3 , 4 . The context and the establishment of the system were announced in the 2016 State of the Union speech. President Juncker said: ‘ We will defend our borders […] with strict controls […] on everyone crossing them. Every time someone enters or exits the EU, there will be a record of when, where and why. In November [2016] we will propose a European travel information and authorisation system – an automated system to determine who will be allowed to travel to Europe. That way we will know who is travelling to Europe before they even get here ” . ETIAS will fill the information gap on travellers exempt from the requirement of being in possession of a visa when crossing the external borders. ETIAS will determine the eligibility of visa-exempt third-country nationals prior to their travel to the Schengen Area and whether such travel poses a security, irregular migration or high epidemic risk. ETIAS will also give travellers confidence that they would be able to cross the borders smoothly. If needed, ETIAS travel authorisation could be denied by ETIAS National Units. The assessment of such risks will involve automated processing of personal data provided in the applications for travel authorisation. The ETIAS Regulation establishes that personal data in the applications will be compared with the data present in records, files or alerts registered in EU information systems or databases (the ETIAS Central System, Schengen Information System (‘SIS’), the Visa Information System (‘VIS’), the Entry/Exit System ‘(EES’) or Eurodac), in Europol data or in the Interpol databases (the Interpol Stolen and Lost Travel Document database (‘SLTD’) or the Interpol Travel Documents Associated with Notices database (‘TDAWN’)) 5 . While the Regulation defines in its Article 20 which group of data from the ETIAS application files can be used to consult the other systems, not all those data are collected or recorded in the same way in the other EU information systems and Europol data. For instance in one of the systems, ‘country of issue of the travel document’ is collected while in another the same data is recorded in another way, e.g. as ‘three letter code of the issuing country of the travel document’. In other instances, a category of data is collected in one system but not in the other. For instance, ‘first names of parents of applicants’ are collected by ETIAS, but not in most of the other systems to be queried by ETIAS. Also at the time the ETIAS proposal 6 was adopted, the situation as regards the different EU information systems to be queried by ETIAS was different from today. At the time the ETIAS proposal was adopted, two other new EU information technology systems had been proposed to be set up: discussions were ongoing on the EES Regulation 7 while the Commission’s proposal on the European Criminal Records Information System – Third Country Nationals (‘ECRIS-TCN’) 8 was just about to be proposed. As regards existing information systems, the legal texts of the SIS were evolving due to the proposed revisions to the SIS legal framework in December 2016, finally adopted by co-legislators in November 2018 9 . The recast of the Eurodac Regulation 10 had also been proposed by the Commission as part of the reform of the Common European Asylum System, but had not yet been adopted by co-legislators 11 . The recast Eurodac Regulation still remains to be adopted by co-legislators today. Based on these considerations, the ETIAS Regulation stipulates, in its Article 11(2) that: “The amendments to the legal acts establishing the EU information systems that are necessary for establishing their interoperability with ETIAS as well as the addition of corresponding provisions in this Regulation shall be the subject of a separate legal instrument”. The present proposal therefore aims to set out the technical amendments necessary to fully set up the ETIAS system by amending the legal acts of the EU information technology systems ETIAS queries. The present proposal also sets out coresponding provisions and amends the ETIAS Regulation accordingly. First, the present initiative sets out amendments to the Regulation on ECRIS-TCN, on which recently, an ‘agreement in principle’ was found by the co-legislators. Thus, in line with the intention expressed by co-legislators in the ETIAS Regulation 12 it is now possible to include in ETIAS the necessary provisions on the relationship between ETIAS and ECRIS-TCN and to amend ECRIS-TCN accordingly. Secondly, the present initiative also aims to establish the relations between ETIAS and the SIS. The revised SIS legal framework has been adopted in November 2018. The present proposal includes consequential amendments resulting from the adoption of the new SIS Regulations. In line with the new SIS legal framework it is proposed to include the new alert category on inquiry checks 13 for the assessment of applications. It is not proposed to include the alert category on return decisions as such alerts are erased at the moment a return decision is implemented. This means that persons that apply for an ETIAS authorisation after having left the EU will – by definition – not have a return record in the SIS. Thirdly, the present initiative seeks to amend the EES Regulation to establish technically its relationship with ETIAS. Fourthly, the initiative also aims at amending the VIS Regulation in order to allow VIS to receive, process and answer ETIAS queries. Although in May 2018, the Commission presented a proposal to amend the VIS Regulation in order to upgrade that database, the present initiative puts forward amendments to the VIS Regulation currently in force, as the negotiations on the proposal for the upgraded VIS are not sufficiently advanced. However, if the proposal to amend the VIS Regulation were to be adopted first, it could become necessary to introduce some technical changes in the present proposal to align it with the amended version of the VIS Regulation. If the present proposal is adopted first, some technical changes could be required in the proposal amending the VIS Regulation before its adoption. In addition, following the adoption of both the EES Regulation and ETIAS Regulation, it is now required to align the way EES and ETIAS are working together on the way EES and VIS are integrated for the purpose of border control process and registration of border crossings in EES. This will rationalise and simplify the work of border guards through the implementation of a more uniform border control process for all third-country national entering for a short stay. The present initiative however does not include the amendments related to Eurodac, the EU asylum and irregular migration database, given that discussions have not yet been concluded on the May 2016 legislative proposal to strengthen Eurodac 14 . Furthermore, the data available in the current Eurodac are not sufficient for ETIAS purposes, given that the existing Eurodac only stores biometric data and a reference number, but no other personal data (e.g. name(s), age, date of birth) that would allow for contributing to the objectives of ETIAS. The May 2016 legislative proposal for a recast Eurodac Regulation seeks to extend the purpose of the database to the identification of illegally staying third-country nationals and those who have entered the EU irregularly. In particular, it provides for the storage of personal data such as the name(s), age, date of birth, nationality, and identity documents. These identity data are essential to ensure that Eurodac will be able to contribute to the objectives of ETIAS. Once the co-legislators reach political agreement on the recast Eurodac Regulation, the recast Eurodac Regulation will need to be supplemented with the necessary amendments to connect Eurodac to ETIAS. Additionally, once the co-legislators adopt the Commission’s legislative proposals 15 for the interoperability of information systems for security, border and migration management, and following political agreement on the proposal for a recast Eurodac Regulation, the Commission will apply the same approach with regards to the necessary amendments to make Eurodac part of the interoperability of information systems . Finally, in line with the April 2016 Communication on "Smarter Information Systems for borders and security", ETIAS is to be built based on a re-use of hardware and software components developed for the EES 16 . This is also the approach followed by the legislative proposals on the interoperability of information systems 17 . The technical development of the common identity repository and the European search portal as foreseen by the legislative proposals on the interoperability of information systems would be developed on the basis of the EES/ETIAS components. This proposal therefore presents amendments to the ETIAS Regulation to specify that the ETIAS Central System would build upon the EES Central System’s hardware and software components in order to establish a shared identity repository for the storage of the identity alphanumeric data of both ETIAS applicants and third-country nationals registered in EES. This shared identity repository would be the basis for the implementation of the common identity repository once the co-legislators adopt the legislative proposals on the interoperability of information systems. Moreover, during a transitional period, before the European search portal is available, the automated processing of ETIAS applications would rely on a tool, which would be used as the basis for the development and implementation of the European search portal. Due to the variable geometry in Member States' participation in EU policies in the area of freedom, security and justice, it is necessary to adopt two separate legal instruments which will nonetheless work seamlessly together to enable the comprehensive operation and use of the system. 
Revised version (Article 18 Personal data of third-country nationals who have been refused entry):
1. Where a decision has been taken by the border authority, in accordance with Article 14 of and Annex V to Regulation (EU) 2016/399, to refuse the entry of a third-country national for a short stay on the territory of the Member States and where no previous file is recorded in the EES for that third-country national, the border authority shall create an individual file in which it shall enter: for third-country nationals subject to a visa requirement, the alphanumeric data required pursuant to Article 16(1) of this Regulation and, where relevant, the data referred to in Article 16(6) of this Regulation; for visa-exempt third-country nationals, the alphanumeric data required pursuant to Article 17(1) and (2) of this Regulation. 2. (a) for third-country nationals subject to a visa requirement, the facial image referred to in point (d) of Article 16(1) of this Regulation; 3. By way of derogation from paragraph 2 of this Article, where the reason corresponding to point H of Part B of Annex V to Regulation (EU) 2016/399 applies and the biometric data of the third-country national are recorded in the SIS alert that results in the refusal of entry, the biometric data of the third-country national shall not be entered in the EES. 4. Where the third-country national is refused entry on the basis of a reason corresponding to point I of Part B of Annex V to Regulation (EU) 2016/399 and where no previous file with biometric data is recorded in the EES for that third-country national, the biometric data shall only be entered in the EES where the entry is refused because the third-country national is considered to be a threat to internal security, including, where appropriate, elements of public policy. 5. Where a third-country national is refused entry on the basis of a reason corresponding to point J of Part B of Annex V to Regulation (EU) 2016/399, the border authority shall create the individual file of that third-country national without adding biometric data. If the third-country national possesses an eMRTD, the facial image shall be extracted from that eMRTD. 6. Where a decision has been taken by the border authority, in accordance with Article 14 of and Annex V to Regulation (EU) 2016/399, to refuse the entry of a third-country national for a short stay to the territory of the Member States, the following data shall be entered in a separate refusal of entry record: (a) the date and time of refusal of entry; (b) the border crossing point; (c) the authority that refused the entry; (d) the point or points corresponding to the reasons for refusing entry in accordance with Part B of Annex V to Regulation (EU) 2016/399. In addition, for third-country nationals subject to a visa requirement, the data provided for in points (d) to (g) of Article 16(2) of this Regulation shall be entered in the refusal of entry record. In order to create or update the refusal of entry record of third-country nationals subject to a visa requirement, the data provided for in points (d), (e) and (f) of Article 16(2) of this Regulation may be retrieved from the VIS and imported into the EES by the competent border authority in accordance with Article 18a of Regulation (EC) No 767/2008. 7. The refusal of entry record provided for in paragraph 6 shall be linked to the individual file of the third-country national concerned.
Article 19 Data to be added where an authorisation for short stay is revoked, annulled or extended
1. Where a decision has been taken to revoke or annul an authorisation for short stay or a visa or to extend the duration of an authorised stay or visa, the competent authority that has taken such a decision shall add the following data to the latest relevant entry/exit record: (a) the status information indicating that the authorisation for short stay or the visa has been revoked or annulled or that the duration of the authorised stay or the visa has been extended; (b) the identity of the authority that revoked or annulled the authorisation for short stay or the visa or extended the duration of the authorised stay or the visa; (c) the place and date of the decision to revoke or annul the authorisation for short stay or the visa or to extend the duration of the authorised stay or the visa; (d) where applicable, the new visa sticker number, including the three letter code of the issuing country; (e) where applicable, the period of the extension of the duration of authorised stay; (f) where applicable, the new expiry date of the authorised stay or the visa. 2. Where the duration of authorised stay has been extended in accordance with Article 20(2) of the Convention implementing the Schengen Agreement, the competent authority that extended the authorised stay shall add the data regarding the period of extension of the authorised stay to the latest relevant entry/exit record and, where applicable, an indication that the authorised stay was extended in accordance with point (b) of Article 20(2) of the Convention implementing the Schengen Agreement. 3. Where a decision has been taken to annul, revoke or extend a visa, the visa authority which has taken the decision shall immediately retrieve the data provided for in paragraph 1 of this Article from the VIS and import them directly into the EES in accordance with Articles 13 and 14 of Regulation (EC) No 767/2008. 4. The entry/exit record shall indicate the grounds for revocation or annulment of the short stay, which shall be: (a) a return decision adopted pursuant to Directive 2008/115/EC of the European Parliament and of the Council ( 10 ); (b) any other decision taken by the competent authorities of the Member State, in accordance with national law, resulting in the return, removal or voluntary departure of a third-country national who does not fulfil or no longer fulfils the conditions for the entry into or for the stay on the territory of the Member States. 5. The entry/exit record shall indicate the grounds for extending the duration of an authorised stay. 6. When a person has departed or has been removed from the territory of the Member States pursuant to a decision as referred to in paragraph 4 of this Article, the competent authority shall enter the data in accordance with Article 14(2) in the related entry/exit record of that specific entry.
Amendment rationale: CONTEXT OF THE PROPOSAL Reasons for and objectives of the proposal In September 2018, the Council and the European Parliament adopted two legislative acts, a Regulation establishing the European Travel Information and Authorisation System (‘ETIAS’) 1 and an amendment of the Europol Regulation for the purpose of establishing ETIAS 2 . Establishing ETIAS is among efforts undertaken in recent years at EU level to enhance the security of citizens and prevent irregular migration in an open Europe, securing and continuing to strengthen the management of external borders 3 , 4 . The context and the establishment of the system were announced in the 2016 State of the Union speech. President Juncker said: ‘ We will defend our borders […] with strict controls […] on everyone crossing them. Every time someone enters or exits the EU, there will be a record of when, where and why. In November [2016] we will propose a European travel information and authorisation system – an automated system to determine who will be allowed to travel to Europe. That way we will know who is travelling to Europe before they even get here ” . ETIAS will fill the information gap on travellers exempt from the requirement of being in possession of a visa when crossing the external borders. ETIAS will determine the eligibility of visa-exempt third-country nationals prior to their travel to the Schengen Area and whether such travel poses a security, irregular migration or high epidemic risk. ETIAS will also give travellers confidence that they would be able to cross the borders smoothly. If needed, ETIAS travel authorisation could be denied by ETIAS National Units. The assessment of such risks will involve automated processing of personal data provided in the applications for travel authorisation. The ETIAS Regulation establishes that personal data in the applications will be compared with the data present in records, files or alerts registered in EU information systems or databases (the ETIAS Central System, Schengen Information System (‘SIS’), the Visa Information System (‘VIS’), the Entry/Exit System ‘(EES’) or Eurodac), in Europol data or in the Interpol databases (the Interpol Stolen and Lost Travel Document database (‘SLTD’) or the Interpol Travel Documents Associated with Notices database (‘TDAWN’)) 5 . While the Regulation defines in its Article 20 which group of data from the ETIAS application files can be used to consult the other systems, not all those data are collected or recorded in the same way in the other EU information systems and Europol data. For instance in one of the systems, ‘country of issue of the travel document’ is collected while in another the same data is recorded in another way, e.g. as ‘three letter code of the issuing country of the travel document’. In other instances, a category of data is collected in one system but not in the other. For instance, ‘first names of parents of applicants’ are collected by ETIAS, but not in most of the other systems to be queried by ETIAS. Also at the time the ETIAS proposal 6 was adopted, the situation as regards the different EU information systems to be queried by ETIAS was different from today. At the time the ETIAS proposal was adopted, two other new EU information technology systems had been proposed to be set up: discussions were ongoing on the EES Regulation 7 while the Commission’s proposal on the European Criminal Records Information System – Third Country Nationals (‘ECRIS-TCN’) 8 was just about to be proposed. As regards existing information systems, the legal texts of the SIS were evolving due to the proposed revisions to the SIS legal framework in December 2016, finally adopted by co-legislators in November 2018 9 . The recast of the Eurodac Regulation 10 had also been proposed by the Commission as part of the reform of the Common European Asylum System, but had not yet been adopted by co-legislators 11 . The recast Eurodac Regulation still remains to be adopted by co-legislators today. Based on these considerations, the ETIAS Regulation stipulates, in its Article 11(2) that: “The amendments to the legal acts establishing the EU information systems that are necessary for establishing their interoperability with ETIAS as well as the addition of corresponding provisions in this Regulation shall be the subject of a separate legal instrument”. The present proposal therefore aims to set out the technical amendments necessary to fully set up the ETIAS system by amending the legal acts of the EU information technology systems ETIAS queries. The present proposal also sets out coresponding provisions and amends the ETIAS Regulation accordingly. First, the present initiative sets out amendments to the Regulation on ECRIS-TCN, on which recently, an ‘agreement in principle’ was found by the co-legislators. Thus, in line with the intention expressed by co-legislators in the ETIAS Regulation 12 it is now possible to include in ETIAS the necessary provisions on the relationship between ETIAS and ECRIS-TCN and to amend ECRIS-TCN accordingly. Secondly, the present initiative also aims to establish the relations between ETIAS and the SIS. The revised SIS legal framework has been adopted in November 2018. The present proposal includes consequential amendments resulting from the adoption of the new SIS Regulations. In line with the new SIS legal framework it is proposed to include the new alert category on inquiry checks 13 for the assessment of applications. It is not proposed to include the alert category on return decisions as such alerts are erased at the moment a return decision is implemented. This means that persons that apply for an ETIAS authorisation after having left the EU will – by definition – not have a return record in the SIS. Thirdly, the present initiative seeks to amend the EES Regulation to establish technically its relationship with ETIAS. Fourthly, the initiative also aims at amending the VIS Regulation in order to allow VIS to receive, process and answer ETIAS queries. Although in May 2018, the Commission presented a proposal to amend the VIS Regulation in order to upgrade that database, the present initiative puts forward amendments to the VIS Regulation currently in force, as the negotiations on the proposal for the upgraded VIS are not sufficiently advanced. However, if the proposal to amend the VIS Regulation were to be adopted first, it could become necessary to introduce some technical changes in the present proposal to align it with the amended version of the VIS Regulation. If the present proposal is adopted first, some technical changes could be required in the proposal amending the VIS Regulation before its adoption. In addition, following the adoption of both the EES Regulation and ETIAS Regulation, it is now required to align the way EES and ETIAS are working together on the way EES and VIS are integrated for the purpose of border control process and registration of border crossings in EES. This will rationalise and simplify the work of border guards through the implementation of a more uniform border control process for all third-country national entering for a short stay. The present initiative however does not include the amendments related to Eurodac, the EU asylum and irregular migration database, given that discussions have not yet been concluded on the May 2016 legislative proposal to strengthen Eurodac 14 . Furthermore, the data available in the current Eurodac are not sufficient for ETIAS purposes, given that the existing Eurodac only stores biometric data and a reference number, but no other personal data (e.g. name(s), age, date of birth) that would allow for contributing to the objectives of ETIAS. The May 2016 legislative proposal for a recast Eurodac Regulation seeks to extend the purpose of the database to the identification of illegally staying third-country nationals and those who have entered the EU irregularly. In particular, it provides for the storage of personal data such as the name(s), age, date of birth, nationality, and identity documents. These identity data are essential to ensure that Eurodac will be able to contribute to the objectives of ETIAS. Once the co-legislators reach political agreement on the recast Eurodac Regulation, the recast Eurodac Regulation will need to be supplemented with the necessary amendments to connect Eurodac to ETIAS. Additionally, once the co-legislators adopt the Commission’s legislative proposals 15 for the interoperability of information systems for security, border and migration management, and following political agreement on the proposal for a recast Eurodac Regulation, the Commission will apply the same approach with regards to the necessary amendments to make Eurodac part of the interoperability of information systems . Finally, in line with the April 2016 Communication on "Smarter Information Systems for borders and security", ETIAS is to be built based on a re-use of hardware and software components developed for the EES 16 . This is also the approach followed by the legislative proposals on the interoperability of information systems 17 . The technical development of the common identity repository and the European search portal as foreseen by the legislative proposals on the interoperability of information systems would be developed on the basis of the EES/ETIAS components. This proposal therefore presents amendments to the ETIAS Regulation to specify that the ETIAS Central System would build upon the EES Central System’s hardware and software components in order to establish a shared identity repository for the storage of the identity alphanumeric data of both ETIAS applicants and third-country nationals registered in EES. This shared identity repository would be the basis for the implementation of the common identity repository once the co-legislators adopt the legislative proposals on the interoperability of information systems. Moreover, during a transitional period, before the European search portal is available, the automated processing of ETIAS applications would rely on a tool, which would be used as the basis for the development and implementation of the European search portal. Due to the variable geometry in Member States' participation in EU policies in the area of freedom, security and justice, it is necessary to adopt two separate legal instruments which will nonetheless work seamlessly together to enable the comprehensive operation and use of the system. 
Revised version (Article 19 Data to be added where an authorisation for short stay is revoked, annulled or extended):
1. Where a decision has been taken to revoke or annul an authorisation for short stay or a visa or to extend the duration of an authorised stay or visa, the competent authority that has taken such a decision shall add the following data to the latest relevant entry/exit record: (a) the status information indicating that the authorisation for short stay or the visa has been revoked or annulled or that the duration of the authorised stay or the visa has been extended; (b) the identity of the authority that revoked or annulled the authorisation for short stay or the visa or extended the duration of the authorised stay or the visa; (c) the place and date of the decision to revoke or annul the authorisation for short stay or the visa or to extend the duration of the authorised stay or the visa; (d) where applicable, the new visa sticker number, including the three letter code of the issuing country; (e) where applicable, the period of the extension of the duration of authorised stay; (f) where applicable, the new expiry date of the authorised stay or the visa. 3. Where a decision has been taken to annul, revoke or extend a visa, the visa authority which has taken the decision shall immediately retrieve the data provided for in paragraph 1 of this Article from the VIS and import them directly into the EES in accordance with Articles 13 and 14 of Regulation (EC) No 767/2008. 4. The entry/exit record shall indicate the grounds for revocation or annulment of the short stay, which shall be: (a) a return decision adopted pursuant to Directive 2008/115/EC of the European Parliament and of the Council ( 11 ); (b) any other decision taken by the competent authorities of the Member State, in accordance with national law, resulting in the return, removal or voluntary departure of a third-country national who does not fulfil or no longer fulfils the conditions for the entry into or for the stay on the territory of the Member States. The entry/exit record shall indicate the grounds for revocation or annulment of the short stay, which shall be: (a) a return decision adopted pursuant to Directive 2008/115/EC of the European Parliament and of the Council ( 11 ); (b) any other decision taken by the competent authorities of the Member State, in accordance with national law, resulting in the return, removal or voluntary departure of a third-country national who does not fulfil or no longer fulfils the conditions for the entry into or for the stay on the territory of the Member States. 5. The entry/exit record shall indicate the grounds for extending the duration of an authorised stay. 6. When a person has departed or has been removed from the territory of the Member States pursuant to a decision as referred to in paragraph 4 of this Article, the competent authority shall enter the data in accordance with Article 14(2) in the related entry/exit record of that specific entry.
Article 20 Data to be added in case of rebuttal of the presumption that a third-country national does not fulfil the conditions of duration of authorised stay
Without prejudice to Article 22, where no individual file has been created in the EES for a third-country national present on the territory of a Member State or where there is no last relevant entry/exit record for such a third-country national, the competent authorities may presume that the third-country national does not fulfil or no longer fulfils the conditions relating to duration of authorised stay within the territory of the Member States. In the case referred to in the first paragraph of this Article, Article 12 of Regulation (EU) 2016/399 shall apply and, if the presumption is rebutted in accordance with Article 12(3) of that Regulation, the competent authorities shall: (a) create an individual file for that third-country national in the EES, if necessary; (b) update the latest entry/exit record by entering the missing data in accordance with Articles 16 and 17 of this Regulation; or (c) erase an existing file where Article 35 of this Regulation provides for such erasure.
Article 21 Fall-back procedures where it is technically impossible to enter data or in the event of failure of the EES
1. Where it is technically impossible to enter data in the EES Central System or the CIR or in the event of a failure of the EES Central System or the CIR, the data referred to in Articles 16 to 20 shall be temporarily stored in the NUI. Where that is not possible, the data shall be temporarily stored locally in an electronic format. In both cases, the data shall be entered in the EES Central System or the CIR as soon as the technical impossibility or failure has been remedied. The Member States shall take the appropriate measures and deploy the required infrastructure, equipment and resources to ensure that such temporary local storage may be carried out at any time and for any of their border crossing points. 2. Without prejudice to the obligation to carry out border checks under Regulation (EU) 2016/399, the border authority, in the exceptional situation where it is technically impossible to enter data in either the EES Central System and the CIR or in the NUI and it is technically impossible to temporarily store the data locally in an electronic format, shall manually store the data referred to in Articles 16 to 20 of this Regulation, with the exception of biometric data, and shall affix an entry or exit stamp in the travel document of the third-country national. That data shall be entered in the EES Central System and the CIR as soon as technically possible. Member States shall inform the Commission of the stamping of travel documents in the event of the exceptional situations referred to in the first subparagraph of this paragraph. The Commission shall adopt implementing acts concerning the detailed rules on the information to be provided to the Commission. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 68(2). 3. The EES shall indicate that data referred to in Articles 16 to 20 were entered as a result of a fall-back procedure and that the individual file created pursuant to paragraph 2 of this Article is missing biometric data. The biometric data shall be entered in the EES at the next border crossing.
Article 22 Transitional period and transitional measures
1. For a period of 180 days after the EES has started operations, in order to verify, on entry and exit, that third-country nationals admitted for a short stay have not exceeded the maximum duration of authorised stay and, where relevant, to verify on entry that third-country nationals have not exceeded the number of entries authorised by the short-stay visa issued for one or two entries, the competent border authorities shall take into account the stays in the territory of the Member States during the 180 days preceding the entry or the exit by checking the stamps in the travel documents in addition to the entry/exit data recorded in the EES. 2. Where a third-country national has entered the territory of the Member States before the EES has started operations and exits it after the EES has started operations, an individual file shall be created on exit and the date of entry as stamped in the passport shall be entered in the entry/exit record in accordance with Article 16(2). This rule shall not be limited to the 180 days after the EES has started operations as referred to in paragraph 1 of this Article. In case of a discrepancy between the entry stamp and the EES data, the stamp shall prevail.
Article 23 Use of data for verification at the borders at which the EES is operated
1. Border authorities shall have access to the EES for verifying the identity and previous registration of the third-country national, for updating the EES data where necessary and for consulting the data to the extent required for the carrying out of border checks. 2. While performing the tasks referred to in paragraph 1 of this Article, the border authorities shall have access to search with the data referred to in points (a), (b) and (c) of Article 16(1) and point (a) of Article 17(1). In addition, for the purposes of consulting the VIS for verification in accordance with Article 18 of Regulation (EC) No 767/2008, for third-country nationals who are subject to a visa requirement, the border authorities shall launch a search in the VIS directly from the EES using the same alphanumeric data or, where applicable, consult the VIS in accordance with Article 18(3) of Regulation (EC) No 767/2008. If the search in the EES with the data set out in the first subparagraph of this paragraph indicates that data on the third-country national are recorded in the EES, the border authorities shall compare the live facial image of the third-country national with the facial image referred to in point (d) of Article 16(1) and point (b) of Article 17(1) of this Regulation or the border authorities shall, in the case of visa-exempt third-country nationals, proceed to a verification of fingerprints against the EES and, in the case of third-country nationals subject to a visa requirement, proceed to a verification of fingerprints directly against the VIS in accordance with Article 18 of Regulation (EC) No 767/2008. For the verification of fingerprints against the VIS for visa holders, the border authorities may launch the search in the VIS directly from the EES as provided in Article 18(6) of that Regulation. If the verification of the facial image fails, the verification shall be carried out using fingerprints and vice versa. 2a. For the purpose of the verifications in accordance with paragraph 1 of this Article, the border authority shall launch a query by using the ESP to compare the data on the third-country national with the relevant data in the EES and the VIS. 3. If the search with the data set out in paragraph 2 indicates that data on the third-country national are recorded in the EES, the border authority shall be given access to consult the data of the individual file of that third-country national and the entry/exit record or records or refusal of entry record or records linked to it. 4. Where the search with the alphanumeric data set out in paragraph 2 of this Article indicates that data on the third-country national are not recorded in the EES, where a verification of the third-country national pursuant to paragraph 2 of this Article fails or where there are doubts as to the identity of the third-country national, the border authorities shall have access to data for identification in accordance with Article 27 in order to create or update an individual file in accordance with Article 14. In addition to the identification referred to in first subparagraph of this paragraph, the following provisions shall apply: (a) for third-country nationals who are subject to a visa requirement, if the search in the VIS with the data referred to in Article 18(1) of Regulation (EC) No 767/2008 indicates that data on the third-country national are recorded in the VIS, a verification of fingerprints against the VIS shall be carried out in accordance with Article 18(5) of Regulation (EC) No 767/2008. For this purpose, the border authority may launch a search from the EES to the VIS as provided for in Article 18(6) of Regulation (EC) No 767/2008. Where a verification of a third-country national pursuant to paragraph 2 of this Article failed, the border authorities shall access the VIS data for identification in accordance with Article 20 of Regulation (EC) No 767/2008. (b) for third-country nationals who are not subject to a visa requirement and for whom no data are found in the EES further to the identification run in accordance with Article 27 of this Regulation, the VIS shall be consulted in accordance with Article 19a of Regulation (EC) No 767/2008. The border authority may launch a search from the EES to the VIS as provided for in Article 19a of Regulation (EC) No 767/2008. 5. For third-country nationals whose data are already recorded in the EES but whose individual file was created in the EES by a Member State which does not yet apply the Schengen acquis in full but operates the EES and whose data were entered in the EES on the basis of a national short-stay visa, the border authorities shall consult the VIS in accordance with point (a) of the second subparagraph of paragraph 4 when, for the first time after the creation of the individual file, the third-country national intends to cross the border of a Member State which applies the Schengen acquis in full and operates the EES.
Amendment rationale: CONTEXT OF THE PROPOSAL Reasons for and objectives of the proposal In September 2018, the Council and the European Parliament adopted two legislative acts, a Regulation establishing the European Travel Information and Authorisation System (‘ETIAS’) 1 and an amendment of the Europol Regulation for the purpose of establishing ETIAS 2 . Establishing ETIAS is among efforts undertaken in recent years at EU level to enhance the security of citizens and prevent irregular migration in an open Europe, securing and continuing to strengthen the management of external borders 3 , 4 . The context and the establishment of the system were announced in the 2016 State of the Union speech. President Juncker said: ‘ We will defend our borders […] with strict controls […] on everyone crossing them. Every time someone enters or exits the EU, there will be a record of when, where and why. In November [2016] we will propose a European travel information and authorisation system – an automated system to determine who will be allowed to travel to Europe. That way we will know who is travelling to Europe before they even get here ” . ETIAS will fill the information gap on travellers exempt from the requirement of being in possession of a visa when crossing the external borders. ETIAS will determine the eligibility of visa-exempt third-country nationals prior to their travel to the Schengen Area and whether such travel poses a security, irregular migration or high epidemic risk. ETIAS will also give travellers confidence that they would be able to cross the borders smoothly. If needed, ETIAS travel authorisation could be denied by ETIAS National Units. The assessment of such risks will involve automated processing of personal data provided in the applications for travel authorisation. The ETIAS Regulation establishes that personal data in the applications will be compared with the data present in records, files or alerts registered in EU information systems or databases (the ETIAS Central System, Schengen Information System (‘SIS’), the Visa Information System (‘VIS’), the Entry/Exit System ‘(EES’) or Eurodac), in Europol data or in the Interpol databases (the Interpol Stolen and Lost Travel Document database (‘SLTD’) or the Interpol Travel Documents Associated with Notices database (‘TDAWN’)) 5 . While the Regulation defines in its Article 20 which group of data from the ETIAS application files can be used to consult the other systems, not all those data are collected or recorded in the same way in the other EU information systems and Europol data. For instance in one of the systems, ‘country of issue of the travel document’ is collected while in another the same data is recorded in another way, e.g. as ‘three letter code of the issuing country of the travel document’. In other instances, a category of data is collected in one system but not in the other. For instance, ‘first names of parents of applicants’ are collected by ETIAS, but not in most of the other systems to be queried by ETIAS. Also at the time the ETIAS proposal 6 was adopted, the situation as regards the different EU information systems to be queried by ETIAS was different from today. At the time the ETIAS proposal was adopted, two other new EU information technology systems had been proposed to be set up: discussions were ongoing on the EES Regulation 7 while the Commission’s proposal on the European Criminal Records Information System – Third Country Nationals (‘ECRIS-TCN’) 8 was just about to be proposed. As regards existing information systems, the legal texts of the SIS were evolving due to the proposed revisions to the SIS legal framework in December 2016, finally adopted by co-legislators in November 2018 9 . The recast of the Eurodac Regulation 10 had also been proposed by the Commission as part of the reform of the Common European Asylum System, but had not yet been adopted by co-legislators 11 . The recast Eurodac Regulation still remains to be adopted by co-legislators today. Based on these considerations, the ETIAS Regulation stipulates, in its Article 11(2) that: “The amendments to the legal acts establishing the EU information systems that are necessary for establishing their interoperability with ETIAS as well as the addition of corresponding provisions in this Regulation shall be the subject of a separate legal instrument”. The present proposal therefore aims to set out the technical amendments necessary to fully set up the ETIAS system by amending the legal acts of the EU information technology systems ETIAS queries. The present proposal also sets out coresponding provisions and amends the ETIAS Regulation accordingly. First, the present initiative sets out amendments to the Regulation on ECRIS-TCN, on which recently, an ‘agreement in principle’ was found by the co-legislators. Thus, in line with the intention expressed by co-legislators in the ETIAS Regulation 12 it is now possible to include in ETIAS the necessary provisions on the relationship between ETIAS and ECRIS-TCN and to amend ECRIS-TCN accordingly. Secondly, the present initiative also aims to establish the relations between ETIAS and the SIS. The revised SIS legal framework has been adopted in November 2018. The present proposal includes consequential amendments resulting from the adoption of the new SIS Regulations. In line with the new SIS legal framework it is proposed to include the new alert category on inquiry checks 13 for the assessment of applications. It is not proposed to include the alert category on return decisions as such alerts are erased at the moment a return decision is implemented. This means that persons that apply for an ETIAS authorisation after having left the EU will – by definition – not have a return record in the SIS. Thirdly, the present initiative seeks to amend the EES Regulation to establish technically its relationship with ETIAS. Fourthly, the initiative also aims at amending the VIS Regulation in order to allow VIS to receive, process and answer ETIAS queries. Although in May 2018, the Commission presented a proposal to amend the VIS Regulation in order to upgrade that database, the present initiative puts forward amendments to the VIS Regulation currently in force, as the negotiations on the proposal for the upgraded VIS are not sufficiently advanced. However, if the proposal to amend the VIS Regulation were to be adopted first, it could become necessary to introduce some technical changes in the present proposal to align it with the amended version of the VIS Regulation. If the present proposal is adopted first, some technical changes could be required in the proposal amending the VIS Regulation before its adoption. In addition, following the adoption of both the EES Regulation and ETIAS Regulation, it is now required to align the way EES and ETIAS are working together on the way EES and VIS are integrated for the purpose of border control process and registration of border crossings in EES. This will rationalise and simplify the work of border guards through the implementation of a more uniform border control process for all third-country national entering for a short stay. The present initiative however does not include the amendments related to Eurodac, the EU asylum and irregular migration database, given that discussions have not yet been concluded on the May 2016 legislative proposal to strengthen Eurodac 14 . Furthermore, the data available in the current Eurodac are not sufficient for ETIAS purposes, given that the existing Eurodac only stores biometric data and a reference number, but no other personal data (e.g. name(s), age, date of birth) that would allow for contributing to the objectives of ETIAS. The May 2016 legislative proposal for a recast Eurodac Regulation seeks to extend the purpose of the database to the identification of illegally staying third-country nationals and those who have entered the EU irregularly. In particular, it provides for the storage of personal data such as the name(s), age, date of birth, nationality, and identity documents. These identity data are essential to ensure that Eurodac will be able to contribute to the objectives of ETIAS. Once the co-legislators reach political agreement on the recast Eurodac Regulation, the recast Eurodac Regulation will need to be supplemented with the necessary amendments to connect Eurodac to ETIAS. Additionally, once the co-legislators adopt the Commission’s legislative proposals 15 for the interoperability of information systems for security, border and migration management, and following political agreement on the proposal for a recast Eurodac Regulation, the Commission will apply the same approach with regards to the necessary amendments to make Eurodac part of the interoperability of information systems . Finally, in line with the April 2016 Communication on "Smarter Information Systems for borders and security", ETIAS is to be built based on a re-use of hardware and software components developed for the EES 16 . This is also the approach followed by the legislative proposals on the interoperability of information systems 17 . The technical development of the common identity repository and the European search portal as foreseen by the legislative proposals on the interoperability of information systems would be developed on the basis of the EES/ETIAS components. This proposal therefore presents amendments to the ETIAS Regulation to specify that the ETIAS Central System would build upon the EES Central System’s hardware and software components in order to establish a shared identity repository for the storage of the identity alphanumeric data of both ETIAS applicants and third-country nationals registered in EES. This shared identity repository would be the basis for the implementation of the common identity repository once the co-legislators adopt the legislative proposals on the interoperability of information systems. Moreover, during a transitional period, before the European search portal is available, the automated processing of ETIAS applications would rely on a tool, which would be used as the basis for the development and implementation of the European search portal. Due to the variable geometry in Member States' participation in EU policies in the area of freedom, security and justice, it is necessary to adopt two separate legal instruments which will nonetheless work seamlessly together to enable the comprehensive operation and use of the system. 
Revised version (Article 23 Use of data for verification at the borders at which the EES is operated):
1. Border authorities shall have access to the EES for verifying the identity and previous registration of the third-country national, for updating the EES data where necessary and for consulting the data to the extent required for the carrying out of border checks. 2. While performing the tasks referred to in paragraph 1 of this Article, the border authorities shall have access to search with the data referred to in points (a), (b) and (c) of Article 16(1) and point (a) of Article 17(1). If the verification of the facial image fails, the verification shall be carried out using fingerprints and vice versa. 2a. For the purpose of the verifications in accordance with paragraph 1 of this Article, the border authority shall launch a query by using the ESP to compare the data on the third-country national with the relevant data in the EES and the VIS. 3. If the search with the data set out in paragraph 2 indicates that data on the third-country national are recorded in the EES, the border authority shall be given access to consult the data of the individual file of that third-country national and the entry/exit record or records or refusal of entry record or records linked to it. 4. Where the search with the alphanumeric data set out in paragraph 2 of this Article indicates that data on the third-country national are not recorded in the EES, where a verification of the third-country national pursuant to paragraph 2 of this Article fails or where there are doubts as to the identity of the third-country national, the border authorities shall have access to data for identification in accordance with Article 27 in order to create or update an individual file in accordance with Article 14. In addition to the identification referred to in first subparagraph of this paragraph, the following provisions shall apply: (b) for third-country nationals who are not subject to a visa requirement and for whom no data are found in the EES further to the identification run in accordance with Article 27 of this Regulation, the VIS shall be consulted in accordance with Article 19a of Regulation (EC) No 767/2008. The border authority may launch a search from the EES to the VIS as provided for in Article 19a of Regulation (EC) No 767/2008. 5. For third-country nationals whose data are already recorded in the EES but whose individual file was created in the EES by a Member State which does not yet apply the Schengen acquis in full but operates the EES and whose data were entered in the EES on the basis of a national short-stay visa, the border authorities shall consult the VIS in accordance with point (a) of the second subparagraph of paragraph 4 when, for the first time after the creation of the individual file, the third-country national intends to cross the border of a Member State which applies the Schengen acquis in full and operates the EES.
Article 24 Use of the EES for examining and deciding on visas
1. Visa authorities shall consult the EES for examining visa applications and adopting decisions relating to those applications, including decisions to annul, revoke or extend the period of validity of an issued visa, in accordance with Regulation (EC) No 810/2009. In addition, visa authorities of a Member State which does not yet apply the Schengen acquis in full but operates the EES shall consult the EES when examining national short-stay visa applications and adopting decisions relating to those applications, including decisions to annul, revoke or extend the period of validity of an issued national short-stay visa. 2. Visa authorities shall be given access to search the EES directly from the VIS with one or several of the following data: (a) the data referred to in points (a), (b) and (c) of Article 16(1); (b) the short-stay visa sticker number, including the three letter code of the issuing Member State referred to in point (d) of Article 16(2); (c) the fingerprint data or the fingerprint data combined with the facial image. 3. If the search with the data set out in paragraph 2 indicates that data on the third-country national are recorded in the EES, visa authorities shall be given access to consult the data of the individual file of that third-country national and the entry/exit records, as well as any refusal of entry records linked to that individual file. Visa authorities shall be given access to consult the automated calculator in order to check the maximum remaining duration of an authorised stay. Visa authorities shall also be given access to consult the EES and the automated calculator when examining and taking decisions on new visa applications, so as to automatically establish the maximum duration of authorised stay. 4. Visa authorities of a Member State which does not yet apply the Schengen acquis in full but operates the EES shall be given access to search the EES with one or several of the data set out in paragraph 2. If the search indicates that data on the third-country national are recorded in the EES, they shall be given access to consult the data of the individual file of that third-country national and the entry/exit records, as well as any refusal of entry records linked to that individual file. Visa authorities of a Member State which does not yet apply the Schengen acquis in full but operates the EES shall be given access to consult the automated calculator in order to establish the maximum remaining duration of an authorised stay. Visa authorities shall also be given access to consult the EES and the automated calculator when examining and taking decisions on new visa applications, so as to establish the maximum duration of authorised stay.
Amendment rationale: CONTEXT OF THE PROPOSAL Reasons for and objectives of the proposal In September 2018, the Council and the European Parliament adopted two legislative acts, a Regulation establishing the European Travel Information and Authorisation System (‘ETIAS’) 1 and an amendment of the Europol Regulation for the purpose of establishing ETIAS 2 . Establishing ETIAS is among efforts undertaken in recent years at EU level to enhance the security of citizens and prevent irregular migration in an open Europe, securing and continuing to strengthen the management of external borders 3 , 4 . The context and the establishment of the system were announced in the 2016 State of the Union speech. President Juncker said: ‘ We will defend our borders […] with strict controls […] on everyone crossing them. Every time someone enters or exits the EU, there will be a record of when, where and why. In November [2016] we will propose a European travel information and authorisation system – an automated system to determine who will be allowed to travel to Europe. That way we will know who is travelling to Europe before they even get here ” . ETIAS will fill the information gap on travellers exempt from the requirement of being in possession of a visa when crossing the external borders. ETIAS will determine the eligibility of visa-exempt third-country nationals prior to their travel to the Schengen Area and whether such travel poses a security, irregular migration or high epidemic risk. ETIAS will also give travellers confidence that they would be able to cross the borders smoothly. If needed, ETIAS travel authorisation could be denied by ETIAS National Units. The assessment of such risks will involve automated processing of personal data provided in the applications for travel authorisation. The ETIAS Regulation establishes that personal data in the applications will be compared with the data present in records, files or alerts registered in EU information systems or databases (the ETIAS Central System, Schengen Information System (‘SIS’), the Visa Information System (‘VIS’), the Entry/Exit System ‘(EES’) or Eurodac), in Europol data or in the Interpol databases (the Interpol Stolen and Lost Travel Document database (‘SLTD’) or the Interpol Travel Documents Associated with Notices database (‘TDAWN’)) 5 . While the Regulation defines in its Article 20 which group of data from the ETIAS application files can be used to consult the other systems, not all those data are collected or recorded in the same way in the other EU information systems and Europol data. For instance in one of the systems, ‘country of issue of the travel document’ is collected while in another the same data is recorded in another way, e.g. as ‘three letter code of the issuing country of the travel document’. In other instances, a category of data is collected in one system but not in the other. For instance, ‘first names of parents of applicants’ are collected by ETIAS, but not in most of the other systems to be queried by ETIAS. Also at the time the ETIAS proposal 6 was adopted, the situation as regards the different EU information systems to be queried by ETIAS was different from today. At the time the ETIAS proposal was adopted, two other new EU information technology systems had been proposed to be set up: discussions were ongoing on the EES Regulation 7 while the Commission’s proposal on the European Criminal Records Information System – Third Country Nationals (‘ECRIS-TCN’) 8 was just about to be proposed. As regards existing information systems, the legal texts of the SIS were evolving due to the proposed revisions to the SIS legal framework in December 2016, finally adopted by co-legislators in November 2018 9 . The recast of the Eurodac Regulation 10 had also been proposed by the Commission as part of the reform of the Common European Asylum System, but had not yet been adopted by co-legislators 11 . The recast Eurodac Regulation still remains to be adopted by co-legislators today. Based on these considerations, the ETIAS Regulation stipulates, in its Article 11(2) that: “The amendments to the legal acts establishing the EU information systems that are necessary for establishing their interoperability with ETIAS as well as the addition of corresponding provisions in this Regulation shall be the subject of a separate legal instrument”. The present proposal therefore aims to set out the technical amendments necessary to fully set up the ETIAS system by amending the legal acts of the EU information technology systems ETIAS queries. The present proposal also sets out coresponding provisions and amends the ETIAS Regulation accordingly. First, the present initiative sets out amendments to the Regulation on ECRIS-TCN, on which recently, an ‘agreement in principle’ was found by the co-legislators. Thus, in line with the intention expressed by co-legislators in the ETIAS Regulation 12 it is now possible to include in ETIAS the necessary provisions on the relationship between ETIAS and ECRIS-TCN and to amend ECRIS-TCN accordingly. Secondly, the present initiative also aims to establish the relations between ETIAS and the SIS. The revised SIS legal framework has been adopted in November 2018. The present proposal includes consequential amendments resulting from the adoption of the new SIS Regulations. In line with the new SIS legal framework it is proposed to include the new alert category on inquiry checks 13 for the assessment of applications. It is not proposed to include the alert category on return decisions as such alerts are erased at the moment a return decision is implemented. This means that persons that apply for an ETIAS authorisation after having left the EU will – by definition – not have a return record in the SIS. Thirdly, the present initiative seeks to amend the EES Regulation to establish technically its relationship with ETIAS. Fourthly, the initiative also aims at amending the VIS Regulation in order to allow VIS to receive, process and answer ETIAS queries. Although in May 2018, the Commission presented a proposal to amend the VIS Regulation in order to upgrade that database, the present initiative puts forward amendments to the VIS Regulation currently in force, as the negotiations on the proposal for the upgraded VIS are not sufficiently advanced. However, if the proposal to amend the VIS Regulation were to be adopted first, it could become necessary to introduce some technical changes in the present proposal to align it with the amended version of the VIS Regulation. If the present proposal is adopted first, some technical changes could be required in the proposal amending the VIS Regulation before its adoption. In addition, following the adoption of both the EES Regulation and ETIAS Regulation, it is now required to align the way EES and ETIAS are working together on the way EES and VIS are integrated for the purpose of border control process and registration of border crossings in EES. This will rationalise and simplify the work of border guards through the implementation of a more uniform border control process for all third-country national entering for a short stay. The present initiative however does not include the amendments related to Eurodac, the EU asylum and irregular migration database, given that discussions have not yet been concluded on the May 2016 legislative proposal to strengthen Eurodac 14 . Furthermore, the data available in the current Eurodac are not sufficient for ETIAS purposes, given that the existing Eurodac only stores biometric data and a reference number, but no other personal data (e.g. name(s), age, date of birth) that would allow for contributing to the objectives of ETIAS. The May 2016 legislative proposal for a recast Eurodac Regulation seeks to extend the purpose of the database to the identification of illegally staying third-country nationals and those who have entered the EU irregularly. In particular, it provides for the storage of personal data such as the name(s), age, date of birth, nationality, and identity documents. These identity data are essential to ensure that Eurodac will be able to contribute to the objectives of ETIAS. Once the co-legislators reach political agreement on the recast Eurodac Regulation, the recast Eurodac Regulation will need to be supplemented with the necessary amendments to connect Eurodac to ETIAS. Additionally, once the co-legislators adopt the Commission’s legislative proposals 15 for the interoperability of information systems for security, border and migration management, and following political agreement on the proposal for a recast Eurodac Regulation, the Commission will apply the same approach with regards to the necessary amendments to make Eurodac part of the interoperability of information systems . Finally, in line with the April 2016 Communication on "Smarter Information Systems for borders and security", ETIAS is to be built based on a re-use of hardware and software components developed for the EES 16 . This is also the approach followed by the legislative proposals on the interoperability of information systems 17 . The technical development of the common identity repository and the European search portal as foreseen by the legislative proposals on the interoperability of information systems would be developed on the basis of the EES/ETIAS components. This proposal therefore presents amendments to the ETIAS Regulation to specify that the ETIAS Central System would build upon the EES Central System’s hardware and software components in order to establish a shared identity repository for the storage of the identity alphanumeric data of both ETIAS applicants and third-country nationals registered in EES. This shared identity repository would be the basis for the implementation of the common identity repository once the co-legislators adopt the legislative proposals on the interoperability of information systems. Moreover, during a transitional period, before the European search portal is available, the automated processing of ETIAS applications would rely on a tool, which would be used as the basis for the development and implementation of the European search portal. Due to the variable geometry in Member States' participation in EU policies in the area of freedom, security and justice, it is necessary to adopt two separate legal instruments which will nonetheless work seamlessly together to enable the comprehensive operation and use of the system. 
Revised version (Article 24 Use of the EES for examining and deciding on visas):
1. Visa authorities shall consult the EES for examining visa applications and adopting decisions relating to those applications, including decisions to annul, revoke or extend the period of validity of an issued visa, in accordance with Regulation (EC) No 810/2009. In addition, visa authorities of a Member State which does not yet apply the Schengen acquis in full but operates the EES shall consult the EES when examining national short-stay visa applications and adopting decisions relating to those applications, including decisions to annul, revoke or extend the period of validity of an issued national short-stay visa. Visa authorities shall be given access to search the EES directly from the VIS with one or several of the following data: the short-stay visa sticker number, including the three letter code of the issuing Member State referred to in point (d) of Article 16(2); (c) the fingerprint data or the fingerprint data combined with the facial image. 3. If the search with the data set out in paragraph 2 indicates that data on the third-country national are recorded in the EES, visa authorities shall be given access to consult the data of the individual file of that third-country national and the entry/exit records, as well as any refusal of entry records linked to that individual file. Visa authorities shall be given access to consult the automated calculator in order to check the maximum remaining duration of an authorised stay. Visa authorities shall also be given access to consult the EES and the automated calculator when examining and taking decisions on new visa applications, so as to automatically establish the maximum duration of authorised stay. 4. Visa authorities of a Member State which does not yet apply the Schengen acquis in full but operates the EES shall be given access to search the EES with one or several of the data set out in paragraph 2. If the search indicates that data on the third-country national are recorded in the EES, they shall be given access to consult the data of the individual file of that third-country national and the entry/exit records, as well as any refusal of entry records linked to that individual file. Visa authorities of a Member State which does not yet apply the Schengen acquis in full but operates the EES shall be given access to consult the automated calculator in order to establish the maximum remaining duration of an authorised stay. Visa authorities shall also be given access to consult the EES and the automated calculator when examining and taking decisions on new visa applications, so as to establish the maximum duration of authorised stay.
Article 25 Use of the EES for examining applications for access to national facilitation programmes
1. The competent authorities referred to in Article 8d of Regulation (EU) 2016/399 shall consult the EES for the purposes of the examination of applications for access to national facilitation programmes referred to in that Article and the adoption of decisions relating to those applications, including decisions to refuse, revoke or extend the period of validity of access to the national facilitation programmes in accordance with that Article. 2. The competent authorities shall be given access to search with one or several of the following: (a) the data referred to in points (a), (b) and (c) of Article 16(1) or the data referred to in point (a) of Article 17(1); (b) the fingerprint data or the fingerprint data combined with the facial image. 3. If the search with the data set out in paragraph 2 indicates that data on the third-country national are recorded in the EES, the competent authority shall be given access to consult the data of the individual file of that third-country national and the entry/exit records, as well as any refusal of entry records linked to that individual file.
Amendment rationale: CONTEXT OF THE PROPOSAL Reasons for and objectives of the proposal In September 2018, the Council and the European Parliament adopted two legislative acts, a Regulation establishing the European Travel Information and Authorisation System (‘ETIAS’) 1 and an amendment of the Europol Regulation for the purpose of establishing ETIAS 2 . Establishing ETIAS is among efforts undertaken in recent years at EU level to enhance the security of citizens and prevent irregular migration in an open Europe, securing and continuing to strengthen the management of external borders 3 , 4 . The context and the establishment of the system were announced in the 2016 State of the Union speech. President Juncker said: ‘ We will defend our borders […] with strict controls […] on everyone crossing them. Every time someone enters or exits the EU, there will be a record of when, where and why. In November [2016] we will propose a European travel information and authorisation system – an automated system to determine who will be allowed to travel to Europe. That way we will know who is travelling to Europe before they even get here ” . ETIAS will fill the information gap on travellers exempt from the requirement of being in possession of a visa when crossing the external borders. ETIAS will determine the eligibility of visa-exempt third-country nationals prior to their travel to the Schengen Area and whether such travel poses a security, irregular migration or high epidemic risk. ETIAS will also give travellers confidence that they would be able to cross the borders smoothly. If needed, ETIAS travel authorisation could be denied by ETIAS National Units. The assessment of such risks will involve automated processing of personal data provided in the applications for travel authorisation. The ETIAS Regulation establishes that personal data in the applications will be compared with the data present in records, files or alerts registered in EU information systems or databases (the ETIAS Central System, Schengen Information System (‘SIS’), the Visa Information System (‘VIS’), the Entry/Exit System ‘(EES’) or Eurodac), in Europol data or in the Interpol databases (the Interpol Stolen and Lost Travel Document database (‘SLTD’) or the Interpol Travel Documents Associated with Notices database (‘TDAWN’)) 5 . While the Regulation defines in its Article 20 which group of data from the ETIAS application files can be used to consult the other systems, not all those data are collected or recorded in the same way in the other EU information systems and Europol data. For instance in one of the systems, ‘country of issue of the travel document’ is collected while in another the same data is recorded in another way, e.g. as ‘three letter code of the issuing country of the travel document’. In other instances, a category of data is collected in one system but not in the other. For instance, ‘first names of parents of applicants’ are collected by ETIAS, but not in most of the other systems to be queried by ETIAS. Also at the time the ETIAS proposal 6 was adopted, the situation as regards the different EU information systems to be queried by ETIAS was different from today. At the time the ETIAS proposal was adopted, two other new EU information technology systems had been proposed to be set up: discussions were ongoing on the EES Regulation 7 while the Commission’s proposal on the European Criminal Records Information System – Third Country Nationals (‘ECRIS-TCN’) 8 was just about to be proposed. As regards existing information systems, the legal texts of the SIS were evolving due to the proposed revisions to the SIS legal framework in December 2016, finally adopted by co-legislators in November 2018 9 . The recast of the Eurodac Regulation 10 had also been proposed by the Commission as part of the reform of the Common European Asylum System, but had not yet been adopted by co-legislators 11 . The recast Eurodac Regulation still remains to be adopted by co-legislators today. Based on these considerations, the ETIAS Regulation stipulates, in its Article 11(2) that: “The amendments to the legal acts establishing the EU information systems that are necessary for establishing their interoperability with ETIAS as well as the addition of corresponding provisions in this Regulation shall be the subject of a separate legal instrument”. The present proposal therefore aims to set out the technical amendments necessary to fully set up the ETIAS system by amending the legal acts of the EU information technology systems ETIAS queries. The present proposal also sets out coresponding provisions and amends the ETIAS Regulation accordingly. First, the present initiative sets out amendments to the Regulation on ECRIS-TCN, on which recently, an ‘agreement in principle’ was found by the co-legislators. Thus, in line with the intention expressed by co-legislators in the ETIAS Regulation 12 it is now possible to include in ETIAS the necessary provisions on the relationship between ETIAS and ECRIS-TCN and to amend ECRIS-TCN accordingly. Secondly, the present initiative also aims to establish the relations between ETIAS and the SIS. The revised SIS legal framework has been adopted in November 2018. The present proposal includes consequential amendments resulting from the adoption of the new SIS Regulations. In line with the new SIS legal framework it is proposed to include the new alert category on inquiry checks 13 for the assessment of applications. It is not proposed to include the alert category on return decisions as such alerts are erased at the moment a return decision is implemented. This means that persons that apply for an ETIAS authorisation after having left the EU will – by definition – not have a return record in the SIS. Thirdly, the present initiative seeks to amend the EES Regulation to establish technically its relationship with ETIAS. Fourthly, the initiative also aims at amending the VIS Regulation in order to allow VIS to receive, process and answer ETIAS queries. Although in May 2018, the Commission presented a proposal to amend the VIS Regulation in order to upgrade that database, the present initiative puts forward amendments to the VIS Regulation currently in force, as the negotiations on the proposal for the upgraded VIS are not sufficiently advanced. However, if the proposal to amend the VIS Regulation were to be adopted first, it could become necessary to introduce some technical changes in the present proposal to align it with the amended version of the VIS Regulation. If the present proposal is adopted first, some technical changes could be required in the proposal amending the VIS Regulation before its adoption. In addition, following the adoption of both the EES Regulation and ETIAS Regulation, it is now required to align the way EES and ETIAS are working together on the way EES and VIS are integrated for the purpose of border control process and registration of border crossings in EES. This will rationalise and simplify the work of border guards through the implementation of a more uniform border control process for all third-country national entering for a short stay. The present initiative however does not include the amendments related to Eurodac, the EU asylum and irregular migration database, given that discussions have not yet been concluded on the May 2016 legislative proposal to strengthen Eurodac 14 . Furthermore, the data available in the current Eurodac are not sufficient for ETIAS purposes, given that the existing Eurodac only stores biometric data and a reference number, but no other personal data (e.g. name(s), age, date of birth) that would allow for contributing to the objectives of ETIAS. The May 2016 legislative proposal for a recast Eurodac Regulation seeks to extend the purpose of the database to the identification of illegally staying third-country nationals and those who have entered the EU irregularly. In particular, it provides for the storage of personal data such as the name(s), age, date of birth, nationality, and identity documents. These identity data are essential to ensure that Eurodac will be able to contribute to the objectives of ETIAS. Once the co-legislators reach political agreement on the recast Eurodac Regulation, the recast Eurodac Regulation will need to be supplemented with the necessary amendments to connect Eurodac to ETIAS. Additionally, once the co-legislators adopt the Commission’s legislative proposals 15 for the interoperability of information systems for security, border and migration management, and following political agreement on the proposal for a recast Eurodac Regulation, the Commission will apply the same approach with regards to the necessary amendments to make Eurodac part of the interoperability of information systems . Finally, in line with the April 2016 Communication on "Smarter Information Systems for borders and security", ETIAS is to be built based on a re-use of hardware and software components developed for the EES 16 . This is also the approach followed by the legislative proposals on the interoperability of information systems 17 . The technical development of the common identity repository and the European search portal as foreseen by the legislative proposals on the interoperability of information systems would be developed on the basis of the EES/ETIAS components. This proposal therefore presents amendments to the ETIAS Regulation to specify that the ETIAS Central System would build upon the EES Central System’s hardware and software components in order to establish a shared identity repository for the storage of the identity alphanumeric data of both ETIAS applicants and third-country nationals registered in EES. This shared identity repository would be the basis for the implementation of the common identity repository once the co-legislators adopt the legislative proposals on the interoperability of information systems. Moreover, during a transitional period, before the European search portal is available, the automated processing of ETIAS applications would rely on a tool, which would be used as the basis for the development and implementation of the European search portal. Due to the variable geometry in Member States' participation in EU policies in the area of freedom, security and justice, it is necessary to adopt two separate legal instruments which will nonetheless work seamlessly together to enable the comprehensive operation and use of the system. 
Revised version (Article 25 Use of the EES for examining applications for access to national facilitation programmes):
1. The competent authorities referred to in Article 8d of Regulation (EU) 2016/399 shall consult the EES for the purposes of the examination of applications for access to national facilitation programmes referred to in that Article and the adoption of decisions relating to those applications, including decisions to refuse, revoke or extend the period of validity of access to the national facilitation programmes in accordance with that Article. The competent authorities shall be given access to search with one or several of the following: (b) the fingerprint data or the fingerprint data combined with the facial image. 3. If the search with the data set out in paragraph 2 indicates that data on the third-country national are recorded in the EES, the competent authority shall be given access to consult the data of the individual file of that third-country national and the entry/exit records, as well as any refusal of entry records linked to that individual file.
Article 26 Access to data for verification within the territory of the Member States
1. For the purpose of verifying the identity of the third-country national, or checking or verifying whether the conditions for entry to, or stay on, the territory of the Member States are fulfilled, or both, the immigration authorities of the Member States shall have access to search with the data referred to in points (a), (b) and (c) of Article 16(1) and point (a) of Article 17(1). If the search indicates that data on the third-country national are recorded in the EES, the immigration authorities may: (a) compare the live facial image of the third-country national with the facial image referred to in point (d) of Article 16(1) and point (b) of Article 17(1) of this Regulation; or (b) verify the fingerprints of visa-exempt third-country nationals in the EES and of third-country nationals subject to a visa requirement in the VIS in accordance with Article 19 of Regulation (EC) No 767/2008. 2. If the search with the data set out in paragraph 1 indicates that data on the third-country national are recorded in the EES, the immigration authorities shall be given access to consult the automated calculator, the data of the individual file of that third-country national, the entry/exit record or records and any refusal of entry record linked to that individual file. 3. Where the search with the data set out in paragraph 1 of this Article indicates that data on the third-country national are not recorded in the EES, where verification of the third-country national fails or where there are doubts as to the identity of the third-country national, the immigration authorities shall have access to data for identification in accordance with Article 27.
Amendment rationale: CONTEXT OF THE PROPOSAL Reasons for and objectives of the proposal In September 2018, the Council and the European Parliament adopted two legislative acts, a Regulation establishing the European Travel Information and Authorisation System (‘ETIAS’) 1 and an amendment of the Europol Regulation for the purpose of establishing ETIAS 2 . Establishing ETIAS is among efforts undertaken in recent years at EU level to enhance the security of citizens and prevent irregular migration in an open Europe, securing and continuing to strengthen the management of external borders 3 , 4 . The context and the establishment of the system were announced in the 2016 State of the Union speech. President Juncker said: ‘ We will defend our borders […] with strict controls […] on everyone crossing them. Every time someone enters or exits the EU, there will be a record of when, where and why. In November [2016] we will propose a European travel information and authorisation system – an automated system to determine who will be allowed to travel to Europe. That way we will know who is travelling to Europe before they even get here ” . ETIAS will fill the information gap on travellers exempt from the requirement of being in possession of a visa when crossing the external borders. ETIAS will determine the eligibility of visa-exempt third-country nationals prior to their travel to the Schengen Area and whether such travel poses a security, irregular migration or high epidemic risk. ETIAS will also give travellers confidence that they would be able to cross the borders smoothly. If needed, ETIAS travel authorisation could be denied by ETIAS National Units. The assessment of such risks will involve automated processing of personal data provided in the applications for travel authorisation. The ETIAS Regulation establishes that personal data in the applications will be compared with the data present in records, files or alerts registered in EU information systems or databases (the ETIAS Central System, Schengen Information System (‘SIS’), the Visa Information System (‘VIS’), the Entry/Exit System ‘(EES’) or Eurodac), in Europol data or in the Interpol databases (the Interpol Stolen and Lost Travel Document database (‘SLTD’) or the Interpol Travel Documents Associated with Notices database (‘TDAWN’)) 5 . While the Regulation defines in its Article 20 which group of data from the ETIAS application files can be used to consult the other systems, not all those data are collected or recorded in the same way in the other EU information systems and Europol data. For instance in one of the systems, ‘country of issue of the travel document’ is collected while in another the same data is recorded in another way, e.g. as ‘three letter code of the issuing country of the travel document’. In other instances, a category of data is collected in one system but not in the other. For instance, ‘first names of parents of applicants’ are collected by ETIAS, but not in most of the other systems to be queried by ETIAS. Also at the time the ETIAS proposal 6 was adopted, the situation as regards the different EU information systems to be queried by ETIAS was different from today. At the time the ETIAS proposal was adopted, two other new EU information technology systems had been proposed to be set up: discussions were ongoing on the EES Regulation 7 while the Commission’s proposal on the European Criminal Records Information System – Third Country Nationals (‘ECRIS-TCN’) 8 was just about to be proposed. As regards existing information systems, the legal texts of the SIS were evolving due to the proposed revisions to the SIS legal framework in December 2016, finally adopted by co-legislators in November 2018 9 . The recast of the Eurodac Regulation 10 had also been proposed by the Commission as part of the reform of the Common European Asylum System, but had not yet been adopted by co-legislators 11 . The recast Eurodac Regulation still remains to be adopted by co-legislators today. Based on these considerations, the ETIAS Regulation stipulates, in its Article 11(2) that: “The amendments to the legal acts establishing the EU information systems that are necessary for establishing their interoperability with ETIAS as well as the addition of corresponding provisions in this Regulation shall be the subject of a separate legal instrument”. The present proposal therefore aims to set out the technical amendments necessary to fully set up the ETIAS system by amending the legal acts of the EU information technology systems ETIAS queries. The present proposal also sets out coresponding provisions and amends the ETIAS Regulation accordingly. First, the present initiative sets out amendments to the Regulation on ECRIS-TCN, on which recently, an ‘agreement in principle’ was found by the co-legislators. Thus, in line with the intention expressed by co-legislators in the ETIAS Regulation 12 it is now possible to include in ETIAS the necessary provisions on the relationship between ETIAS and ECRIS-TCN and to amend ECRIS-TCN accordingly. Secondly, the present initiative also aims to establish the relations between ETIAS and the SIS. The revised SIS legal framework has been adopted in November 2018. The present proposal includes consequential amendments resulting from the adoption of the new SIS Regulations. In line with the new SIS legal framework it is proposed to include the new alert category on inquiry checks 13 for the assessment of applications. It is not proposed to include the alert category on return decisions as such alerts are erased at the moment a return decision is implemented. This means that persons that apply for an ETIAS authorisation after having left the EU will – by definition – not have a return record in the SIS. Thirdly, the present initiative seeks to amend the EES Regulation to establish technically its relationship with ETIAS. Fourthly, the initiative also aims at amending the VIS Regulation in order to allow VIS to receive, process and answer ETIAS queries. Although in May 2018, the Commission presented a proposal to amend the VIS Regulation in order to upgrade that database, the present initiative puts forward amendments to the VIS Regulation currently in force, as the negotiations on the proposal for the upgraded VIS are not sufficiently advanced. However, if the proposal to amend the VIS Regulation were to be adopted first, it could become necessary to introduce some technical changes in the present proposal to align it with the amended version of the VIS Regulation. If the present proposal is adopted first, some technical changes could be required in the proposal amending the VIS Regulation before its adoption. In addition, following the adoption of both the EES Regulation and ETIAS Regulation, it is now required to align the way EES and ETIAS are working together on the way EES and VIS are integrated for the purpose of border control process and registration of border crossings in EES. This will rationalise and simplify the work of border guards through the implementation of a more uniform border control process for all third-country national entering for a short stay. The present initiative however does not include the amendments related to Eurodac, the EU asylum and irregular migration database, given that discussions have not yet been concluded on the May 2016 legislative proposal to strengthen Eurodac 14 . Furthermore, the data available in the current Eurodac are not sufficient for ETIAS purposes, given that the existing Eurodac only stores biometric data and a reference number, but no other personal data (e.g. name(s), age, date of birth) that would allow for contributing to the objectives of ETIAS. The May 2016 legislative proposal for a recast Eurodac Regulation seeks to extend the purpose of the database to the identification of illegally staying third-country nationals and those who have entered the EU irregularly. In particular, it provides for the storage of personal data such as the name(s), age, date of birth, nationality, and identity documents. These identity data are essential to ensure that Eurodac will be able to contribute to the objectives of ETIAS. Once the co-legislators reach political agreement on the recast Eurodac Regulation, the recast Eurodac Regulation will need to be supplemented with the necessary amendments to connect Eurodac to ETIAS. Additionally, once the co-legislators adopt the Commission’s legislative proposals 15 for the interoperability of information systems for security, border and migration management, and following political agreement on the proposal for a recast Eurodac Regulation, the Commission will apply the same approach with regards to the necessary amendments to make Eurodac part of the interoperability of information systems . Finally, in line with the April 2016 Communication on "Smarter Information Systems for borders and security", ETIAS is to be built based on a re-use of hardware and software components developed for the EES 16 . This is also the approach followed by the legislative proposals on the interoperability of information systems 17 . The technical development of the common identity repository and the European search portal as foreseen by the legislative proposals on the interoperability of information systems would be developed on the basis of the EES/ETIAS components. This proposal therefore presents amendments to the ETIAS Regulation to specify that the ETIAS Central System would build upon the EES Central System’s hardware and software components in order to establish a shared identity repository for the storage of the identity alphanumeric data of both ETIAS applicants and third-country nationals registered in EES. This shared identity repository would be the basis for the implementation of the common identity repository once the co-legislators adopt the legislative proposals on the interoperability of information systems. Moreover, during a transitional period, before the European search portal is available, the automated processing of ETIAS applications would rely on a tool, which would be used as the basis for the development and implementation of the European search portal. Due to the variable geometry in Member States' participation in EU policies in the area of freedom, security and justice, it is necessary to adopt two separate legal instruments which will nonetheless work seamlessly together to enable the comprehensive operation and use of the system. 
Revised version (Article 26 Access to data for verification within the territory of the Member States):
If the search indicates that data on the third-country national are recorded in the EES, the immigration authorities may: (b) verify the fingerprints of visa-exempt third-country nationals in the EES and of third-country nationals subject to a visa requirement in the VIS in accordance with Article 19 of Regulation (EC) No 767/2008. 2. If the search with the data set out in paragraph 1 indicates that data on the third-country national are recorded in the EES, the immigration authorities shall be given access to consult the automated calculator, the data of the individual file of that third-country national, the entry/exit record or records and any refusal of entry record linked to that individual file. 3. Where the search with the data set out in paragraph 1 of this Article indicates that data on the third-country national are not recorded in the EES, where verification of the third-country national fails or where there are doubts as to the identity of the third-country national, the immigration authorities shall have access to data for identification in accordance with Article 27.
Article 27 Access to data for identification
1. The border authorities or immigration authorities shall have access to search with the fingerprint data or the fingerprint data combined with the facial image, for the sole purpose of identifying any third-country national who may have been registered previously in the EES under a different identity or who does not fulfil or no longer fulfils the conditions for entry to, or for stay on, the territory of the Member States. Where the search with the fingerprint data or with the fingerprint data combined with the facial image indicates that data on that third-country national are not recorded in the EES, access to data for identification shall be carried out in the VIS in accordance with Article 20 of Regulation (EC) No 767/2008. At borders at which the EES is operated, prior to any identification against the VIS, the competent authorities shall first access the VIS in accordance with Articles 18 or 19a of Regulation (EC) No 767/2008. Where the fingerprints of that third-country national cannot be used or the search with the fingerprint data or with the fingerprint data combined with the facial image has failed, the search shall be carried out with all or some of the data referred to in points (a), (b) and (c) of Article 16(1) and point (a) of Article 17(1). 2. If the search with the data set out in paragraph 1 indicates that data on the third-country national are recorded in the EES, the competent authority shall be given access to consult the data of the individual file and the entry/exit records and refusal of entry records linked to it.
Article 28 Keeping of data retrieved from the EES
Data retrieved from the EES pursuant to this Chapter may be kept in national files only where necessary in an individual case, in accordance with the purpose for which they were retrieved and with relevant Union law, in particular on data protection, and for no longer than strictly necessary in that individual case.
Amendment rationale: CONTEXT OF THE PROPOSAL Reasons for and objectives of the proposal In September 2018, the Council and the European Parliament adopted two legislative acts, a Regulation establishing the European Travel Information and Authorisation System (‘ETIAS’) 1 and an amendment of the Europol Regulation for the purpose of establishing ETIAS 2 . Establishing ETIAS is among efforts undertaken in recent years at EU level to enhance the security of citizens and prevent irregular migration in an open Europe, securing and continuing to strengthen the management of external borders 3 , 4 . The context and the establishment of the system were announced in the 2016 State of the Union speech. President Juncker said: ‘ We will defend our borders […] with strict controls […] on everyone crossing them. Every time someone enters or exits the EU, there will be a record of when, where and why. In November [2016] we will propose a European travel information and authorisation system – an automated system to determine who will be allowed to travel to Europe. That way we will know who is travelling to Europe before they even get here ” . ETIAS will fill the information gap on travellers exempt from the requirement of being in possession of a visa when crossing the external borders. ETIAS will determine the eligibility of visa-exempt third-country nationals prior to their travel to the Schengen Area and whether such travel poses a security, irregular migration or high epidemic risk. ETIAS will also give travellers confidence that they would be able to cross the borders smoothly. If needed, ETIAS travel authorisation could be denied by ETIAS National Units. The assessment of such risks will involve automated processing of personal data provided in the applications for travel authorisation. The ETIAS Regulation establishes that personal data in the applications will be compared with the data present in records, files or alerts registered in EU information systems or databases (the ETIAS Central System, Schengen Information System (‘SIS’), the Visa Information System (‘VIS’), the Entry/Exit System ‘(EES’) or Eurodac), in Europol data or in the Interpol databases (the Interpol Stolen and Lost Travel Document database (‘SLTD’) or the Interpol Travel Documents Associated with Notices database (‘TDAWN’)) 5 . While the Regulation defines in its Article 20 which group of data from the ETIAS application files can be used to consult the other systems, not all those data are collected or recorded in the same way in the other EU information systems and Europol data. For instance in one of the systems, ‘country of issue of the travel document’ is collected while in another the same data is recorded in another way, e.g. as ‘three letter code of the issuing country of the travel document’. In other instances, a category of data is collected in one system but not in the other. For instance, ‘first names of parents of applicants’ are collected by ETIAS, but not in most of the other systems to be queried by ETIAS. Also at the time the ETIAS proposal 6 was adopted, the situation as regards the different EU information systems to be queried by ETIAS was different from today. At the time the ETIAS proposal was adopted, two other new EU information technology systems had been proposed to be set up: discussions were ongoing on the EES Regulation 7 while the Commission’s proposal on the European Criminal Records Information System – Third Country Nationals (‘ECRIS-TCN’) 8 was just about to be proposed. As regards existing information systems, the legal texts of the SIS were evolving due to the proposed revisions to the SIS legal framework in December 2016, finally adopted by co-legislators in November 2018 9 . The recast of the Eurodac Regulation 10 had also been proposed by the Commission as part of the reform of the Common European Asylum System, but had not yet been adopted by co-legislators 11 . The recast Eurodac Regulation still remains to be adopted by co-legislators today. Based on these considerations, the ETIAS Regulation stipulates, in its Article 11(2) that: “The amendments to the legal acts establishing the EU information systems that are necessary for establishing their interoperability with ETIAS as well as the addition of corresponding provisions in this Regulation shall be the subject of a separate legal instrument”. The present proposal therefore aims to set out the technical amendments necessary to fully set up the ETIAS system by amending the legal acts of the EU information technology systems ETIAS queries. The present proposal also sets out coresponding provisions and amends the ETIAS Regulation accordingly. First, the present initiative sets out amendments to the Regulation on ECRIS-TCN, on which recently, an ‘agreement in principle’ was found by the co-legislators. Thus, in line with the intention expressed by co-legislators in the ETIAS Regulation 12 it is now possible to include in ETIAS the necessary provisions on the relationship between ETIAS and ECRIS-TCN and to amend ECRIS-TCN accordingly. Secondly, the present initiative also aims to establish the relations between ETIAS and the SIS. The revised SIS legal framework has been adopted in November 2018. The present proposal includes consequential amendments resulting from the adoption of the new SIS Regulations. In line with the new SIS legal framework it is proposed to include the new alert category on inquiry checks 13 for the assessment of applications. It is not proposed to include the alert category on return decisions as such alerts are erased at the moment a return decision is implemented. This means that persons that apply for an ETIAS authorisation after having left the EU will – by definition – not have a return record in the SIS. Thirdly, the present initiative seeks to amend the EES Regulation to establish technically its relationship with ETIAS. Fourthly, the initiative also aims at amending the VIS Regulation in order to allow VIS to receive, process and answer ETIAS queries. Although in May 2018, the Commission presented a proposal to amend the VIS Regulation in order to upgrade that database, the present initiative puts forward amendments to the VIS Regulation currently in force, as the negotiations on the proposal for the upgraded VIS are not sufficiently advanced. However, if the proposal to amend the VIS Regulation were to be adopted first, it could become necessary to introduce some technical changes in the present proposal to align it with the amended version of the VIS Regulation. If the present proposal is adopted first, some technical changes could be required in the proposal amending the VIS Regulation before its adoption. In addition, following the adoption of both the EES Regulation and ETIAS Regulation, it is now required to align the way EES and ETIAS are working together on the way EES and VIS are integrated for the purpose of border control process and registration of border crossings in EES. This will rationalise and simplify the work of border guards through the implementation of a more uniform border control process for all third-country national entering for a short stay. The present initiative however does not include the amendments related to Eurodac, the EU asylum and irregular migration database, given that discussions have not yet been concluded on the May 2016 legislative proposal to strengthen Eurodac 14 . Furthermore, the data available in the current Eurodac are not sufficient for ETIAS purposes, given that the existing Eurodac only stores biometric data and a reference number, but no other personal data (e.g. name(s), age, date of birth) that would allow for contributing to the objectives of ETIAS. The May 2016 legislative proposal for a recast Eurodac Regulation seeks to extend the purpose of the database to the identification of illegally staying third-country nationals and those who have entered the EU irregularly. In particular, it provides for the storage of personal data such as the name(s), age, date of birth, nationality, and identity documents. These identity data are essential to ensure that Eurodac will be able to contribute to the objectives of ETIAS. Once the co-legislators reach political agreement on the recast Eurodac Regulation, the recast Eurodac Regulation will need to be supplemented with the necessary amendments to connect Eurodac to ETIAS. Additionally, once the co-legislators adopt the Commission’s legislative proposals 15 for the interoperability of information systems for security, border and migration management, and following political agreement on the proposal for a recast Eurodac Regulation, the Commission will apply the same approach with regards to the necessary amendments to make Eurodac part of the interoperability of information systems . Finally, in line with the April 2016 Communication on "Smarter Information Systems for borders and security", ETIAS is to be built based on a re-use of hardware and software components developed for the EES 16 . This is also the approach followed by the legislative proposals on the interoperability of information systems 17 . The technical development of the common identity repository and the European search portal as foreseen by the legislative proposals on the interoperability of information systems would be developed on the basis of the EES/ETIAS components. This proposal therefore presents amendments to the ETIAS Regulation to specify that the ETIAS Central System would build upon the EES Central System’s hardware and software components in order to establish a shared identity repository for the storage of the identity alphanumeric data of both ETIAS applicants and third-country nationals registered in EES. This shared identity repository would be the basis for the implementation of the common identity repository once the co-legislators adopt the legislative proposals on the interoperability of information systems. Moreover, during a transitional period, before the European search portal is available, the automated processing of ETIAS applications would rely on a tool, which would be used as the basis for the development and implementation of the European search portal. Due to the variable geometry in Member States' participation in EU policies in the area of freedom, security and justice, it is necessary to adopt two separate legal instruments which will nonetheless work seamlessly together to enable the comprehensive operation and use of the system. 
Revised version (Article 28 Keeping of data retrieved from the EES):
Data retrieved from the EES pursuant to Articles 24, 25, 26 and 27 may be kept in national files and data retrieved from the EES pursuant to Articles 25a and 25b may be kept in the ETIAS application files only where necessary in an individual case in accordance with the purpose for which they were retrieved and in accordance with relevant Union law, in particular on data protection, and for no longer than strictly necessary in that individual case.
Article 29 Member States’ designated authorities
1. Member States shall designate the authorities which are entitled to consult the EES data in order to prevent, detect and investigate terrorist offences or other serious criminal offences. 2. Each Member State shall keep a list of the designated authorities. Each Member State shall notify eu-LISA and the Commission of its designated authorities and may at any time amend or replace its notification. 3. Each Member State shall designate a central access point which shall have access to the EES. The central access point shall verify that the conditions to request access to the EES laid down in Article 32 are fulfilled. The designated authority and the central access point may be part of the same organisation if permitted under national law, but the central access point shall act fully independently of the designated authorities when performing its tasks under this Regulation. The central access point shall be separate from the designated authorities and shall not receive instructions from them as regards the outcome of the verification which it shall carry out independently. Member States may designate more than one central access point to reflect their organisational and administrative structures in the fulfilment of their constitutional or legal requirements. 4. Member States shall notify eu-LISA and the Commission of their central access points and may at any time amend or replace their notifications. 5. At national level, each Member State shall keep a list of the operating units within the designated authorities that are authorised to request access to EES data through the central access points. 6. Only duly empowered staff of the central access points shall be authorised to access the EES in accordance with Articles 31 and 32.
Article 30 Europol
1. Europol shall designate one of its operating units as the ‘Europol designated authority’ and shall authorise it to request access to the EES through the Europol central access point referred to in paragraph 2 in order to support and strengthen action by Member States in preventing, detecting and investigating terrorist offences or other serious criminal offences. 2. Europol shall designate a specialised unit with duly empowered Europol officials as the Europol central access point. The Europol central access point shall verify that the conditions to request access to the EES laid down in Article 33 are fulfilled. The Europol central access point shall act independently when performing its tasks under this Regulation and shall not receive instructions from the Europol designated authority as regards the outcome of the verification.
Article 31 Procedure for access to the EES for law enforcement purposes
1. An operating unit as referred to in Article 29(5) shall submit a reasoned electronic or written request to a central access point as referred to in Article 29(3) for access to EES data. Upon receipt of a request for access, such a central access point shall verify whether the conditions for access referred to in Article 32 are fulfilled. If the conditions for access are fulfilled, such a central access point shall process the request. The EES data accessed shall be transmitted to an operating unit as referred to in Article 29(5) in such a way that the security of the data is not compromised. 2. In a case of urgency, where there is a need to prevent an imminent danger to the life of a person associated with a terrorist offence or another serious criminal offence, a central access point as referred to in Article 29(3) shall process the request immediately and shall only verify ex post whether all the conditions referred to in Article 32 are fulfilled, including whether a case of urgency actually existed. The ex post verification shall take place without undue delay and in any event no later than seven working days after the processing of the request. 3. Where an ex post verification determines that the access to EES data was not justified, all the authorities that accessed such data shall erase the information accessed from the EES and shall inform the relevant central access point of the Member State in which the request was made of the erasure.
Article 32 Conditions for access to EES data by designated authorities
1. Designated authorities may access the EES for consultation where all of the following conditions are met: (a) access for consultation is necessary for the purpose of the prevention, detection or investigation of a terrorist offence or another serious criminal offence; (b) access for consultation is necessary and proportionate in a specific case; (c) evidence or reasonable grounds exist to consider that the consultation of the EES data will contribute to the prevention, detection or investigation of any of the criminal offences in question, in particular where there is a substantiated suspicion that the suspect, perpetrator or victim of a terrorist offence or other serious criminal offence falls under a category covered by this Regulation. 1a. In cases where the designated authorities have launched a query of the CIR in accordance with Article 22 of Regulation (EU) 2019/817, they may access the EES for consultation where the conditions laid down in this Article are met and where the reply received as referred to in Article 22(2) of Regulation (EU) 2019/817 reveals that data are stored in the EES. 2. Access to the EES as a tool for the purpose of identifying an unknown suspect, perpetrator or suspected victim of a terrorist offence or other serious criminal offence shall be allowed where, in addition to the conditions listed in paragraph 1, the following conditions are met: (a) a prior search has been conducted in national databases; and (b) in the case of searches with fingerprints, a prior search has been launched in the automated fingerprint identification system of the other Member States under Decision 2008/615/JHA where comparisons of fingerprints are technically available, and either that search has been fully carried out, or that search has not been fully carried out within two days of being launched. However, the additional conditions in points (a) and (b) of the first subparagraph shall not apply where there are reasonable grounds to believe that a comparison with the systems of the other Member States would not lead to the verification of the identity of the data subject or in a case of urgency where there is a need to prevent an imminent danger to the life of a person associated with a terrorist offence or another serious criminal offence. Those reasonable grounds shall be included in the electronic or written request sent by the operating unit of the designated authority to the central access point. A request for consultation of the VIS on the same data subject may be submitted in parallel to a request for consultation of the EES in accordance with the conditions laid down in Council Decision 2008/633/JHA ( 11 ). 3. Access to the EES as a tool to consult the travel history or the periods of stay on the territory of the Member States of a known suspect, perpetrator or suspected victim of a terrorist offence or other serious criminal offence shall be allowed when the conditions listed in paragraph 1 are met. 4. Consultation of the EES for the purpose of identification as referred to in paragraph 2 shall be limited to searching in the individual file with any of the following EES data: (a) fingerprints of visa-exempt third-country nationals or of holders of an FTD. In order to launch this consultation of the EES, latent fingerprints may be used and may therefore be compared with the fingerprints stored in the EES; (b) facial images. Consultation of the EES, in the event of a hit, shall give access to any other data taken from the individual file as listed in Article 16(1) and (6), Article 17(1) and Article 18(1). 5. Consultation of the EES for the travel history of the third-country national concerned shall be limited to searching with one or several of the following EES data in the individual file, in the entry/exit records or in the refusal of entry records: (a) surname (family name); first name or names (given names); date of birth; nationality or nationalities; sex; (b) type and number of travel document or documents, three letter code of the issuing country and date of expiry of the validity of the travel document; (c) visa sticker number and the date of expiry of the validity of the visa; (d) fingerprints, including latent fingerprints; (e) facial image; (f) date and time of entry, authority that authorised the entry and entry border crossing point; (g) date and time of exit and exit border crossing point. Consultation of the EES shall, in the event of a hit, give access to the data listed in the first subparagraph as well as to any other data taken from the individual file, the entry/exit records and refusal of entry records, including data related to the revocation or extension of an authorisation for short stay in accordance with Article 19.
Amendment rationale: CONTEXT OF THE PROPOSAL Reasons for and objectives of the proposal In September 2018, the Council and the European Parliament adopted two legislative acts, a Regulation establishing the European Travel Information and Authorisation System (‘ETIAS’) 1 and an amendment of the Europol Regulation for the purpose of establishing ETIAS 2 . Establishing ETIAS is among efforts undertaken in recent years at EU level to enhance the security of citizens and prevent irregular migration in an open Europe, securing and continuing to strengthen the management of external borders 3 , 4 . The context and the establishment of the system were announced in the 2016 State of the Union speech. President Juncker said: ‘ We will defend our borders […] with strict controls […] on everyone crossing them. Every time someone enters or exits the EU, there will be a record of when, where and why. In November [2016] we will propose a European travel information and authorisation system – an automated system to determine who will be allowed to travel to Europe. That way we will know who is travelling to Europe before they even get here ” . ETIAS will fill the information gap on travellers exempt from the requirement of being in possession of a visa when crossing the external borders. ETIAS will determine the eligibility of visa-exempt third-country nationals prior to their travel to the Schengen Area and whether such travel poses a security, irregular migration or high epidemic risk. ETIAS will also give travellers confidence that they would be able to cross the borders smoothly. If needed, ETIAS travel authorisation could be denied by ETIAS National Units. The assessment of such risks will involve automated processing of personal data provided in the applications for travel authorisation. The ETIAS Regulation establishes that personal data in the applications will be compared with the data present in records, files or alerts registered in EU information systems or databases (the ETIAS Central System, Schengen Information System (‘SIS’), the Visa Information System (‘VIS’), the Entry/Exit System ‘(EES’) or Eurodac), in Europol data or in the Interpol databases (the Interpol Stolen and Lost Travel Document database (‘SLTD’) or the Interpol Travel Documents Associated with Notices database (‘TDAWN’)) 5 . While the Regulation defines in its Article 20 which group of data from the ETIAS application files can be used to consult the other systems, not all those data are collected or recorded in the same way in the other EU information systems and Europol data. For instance in one of the systems, ‘country of issue of the travel document’ is collected while in another the same data is recorded in another way, e.g. as ‘three letter code of the issuing country of the travel document’. In other instances, a category of data is collected in one system but not in the other. For instance, ‘first names of parents of applicants’ are collected by ETIAS, but not in most of the other systems to be queried by ETIAS. Also at the time the ETIAS proposal 6 was adopted, the situation as regards the different EU information systems to be queried by ETIAS was different from today. At the time the ETIAS proposal was adopted, two other new EU information technology systems had been proposed to be set up: discussions were ongoing on the EES Regulation 7 while the Commission’s proposal on the European Criminal Records Information System – Third Country Nationals (‘ECRIS-TCN’) 8 was just about to be proposed. As regards existing information systems, the legal texts of the SIS were evolving due to the proposed revisions to the SIS legal framework in December 2016, finally adopted by co-legislators in November 2018 9 . The recast of the Eurodac Regulation 10 had also been proposed by the Commission as part of the reform of the Common European Asylum System, but had not yet been adopted by co-legislators 11 . The recast Eurodac Regulation still remains to be adopted by co-legislators today. Based on these considerations, the ETIAS Regulation stipulates, in its Article 11(2) that: “The amendments to the legal acts establishing the EU information systems that are necessary for establishing their interoperability with ETIAS as well as the addition of corresponding provisions in this Regulation shall be the subject of a separate legal instrument”. The present proposal therefore aims to set out the technical amendments necessary to fully set up the ETIAS system by amending the legal acts of the EU information technology systems ETIAS queries. The present proposal also sets out coresponding provisions and amends the ETIAS Regulation accordingly. First, the present initiative sets out amendments to the Regulation on ECRIS-TCN, on which recently, an ‘agreement in principle’ was found by the co-legislators. Thus, in line with the intention expressed by co-legislators in the ETIAS Regulation 12 it is now possible to include in ETIAS the necessary provisions on the relationship between ETIAS and ECRIS-TCN and to amend ECRIS-TCN accordingly. Secondly, the present initiative also aims to establish the relations between ETIAS and the SIS. The revised SIS legal framework has been adopted in November 2018. The present proposal includes consequential amendments resulting from the adoption of the new SIS Regulations. In line with the new SIS legal framework it is proposed to include the new alert category on inquiry checks 13 for the assessment of applications. It is not proposed to include the alert category on return decisions as such alerts are erased at the moment a return decision is implemented. This means that persons that apply for an ETIAS authorisation after having left the EU will – by definition – not have a return record in the SIS. Thirdly, the present initiative seeks to amend the EES Regulation to establish technically its relationship with ETIAS. Fourthly, the initiative also aims at amending the VIS Regulation in order to allow VIS to receive, process and answer ETIAS queries. Although in May 2018, the Commission presented a proposal to amend the VIS Regulation in order to upgrade that database, the present initiative puts forward amendments to the VIS Regulation currently in force, as the negotiations on the proposal for the upgraded VIS are not sufficiently advanced. However, if the proposal to amend the VIS Regulation were to be adopted first, it could become necessary to introduce some technical changes in the present proposal to align it with the amended version of the VIS Regulation. If the present proposal is adopted first, some technical changes could be required in the proposal amending the VIS Regulation before its adoption. In addition, following the adoption of both the EES Regulation and ETIAS Regulation, it is now required to align the way EES and ETIAS are working together on the way EES and VIS are integrated for the purpose of border control process and registration of border crossings in EES. This will rationalise and simplify the work of border guards through the implementation of a more uniform border control process for all third-country national entering for a short stay. The present initiative however does not include the amendments related to Eurodac, the EU asylum and irregular migration database, given that discussions have not yet been concluded on the May 2016 legislative proposal to strengthen Eurodac 14 . Furthermore, the data available in the current Eurodac are not sufficient for ETIAS purposes, given that the existing Eurodac only stores biometric data and a reference number, but no other personal data (e.g. name(s), age, date of birth) that would allow for contributing to the objectives of ETIAS. The May 2016 legislative proposal for a recast Eurodac Regulation seeks to extend the purpose of the database to the identification of illegally staying third-country nationals and those who have entered the EU irregularly. In particular, it provides for the storage of personal data such as the name(s), age, date of birth, nationality, and identity documents. These identity data are essential to ensure that Eurodac will be able to contribute to the objectives of ETIAS. Once the co-legislators reach political agreement on the recast Eurodac Regulation, the recast Eurodac Regulation will need to be supplemented with the necessary amendments to connect Eurodac to ETIAS. Additionally, once the co-legislators adopt the Commission’s legislative proposals 15 for the interoperability of information systems for security, border and migration management, and following political agreement on the proposal for a recast Eurodac Regulation, the Commission will apply the same approach with regards to the necessary amendments to make Eurodac part of the interoperability of information systems . Finally, in line with the April 2016 Communication on "Smarter Information Systems for borders and security", ETIAS is to be built based on a re-use of hardware and software components developed for the EES 16 . This is also the approach followed by the legislative proposals on the interoperability of information systems 17 . The technical development of the common identity repository and the European search portal as foreseen by the legislative proposals on the interoperability of information systems would be developed on the basis of the EES/ETIAS components. This proposal therefore presents amendments to the ETIAS Regulation to specify that the ETIAS Central System would build upon the EES Central System’s hardware and software components in order to establish a shared identity repository for the storage of the identity alphanumeric data of both ETIAS applicants and third-country nationals registered in EES. This shared identity repository would be the basis for the implementation of the common identity repository once the co-legislators adopt the legislative proposals on the interoperability of information systems. Moreover, during a transitional period, before the European search portal is available, the automated processing of ETIAS applications would rely on a tool, which would be used as the basis for the development and implementation of the European search portal. Due to the variable geometry in Member States' participation in EU policies in the area of freedom, security and justice, it is necessary to adopt two separate legal instruments which will nonetheless work seamlessly together to enable the comprehensive operation and use of the system. 
Revised version (Article 32 Conditions for access to EES data by designated authorities):
1. Designated authorities may access the EES for consultation where all of the following conditions are met: (a) access for consultation is necessary for the purpose of the prevention, detection or investigation of a terrorist offence or another serious criminal offence; (b) access for consultation is necessary and proportionate in a specific case; (c) evidence or reasonable grounds exist to consider that the consultation of the EES data will contribute to the prevention, detection or investigation of any of the criminal offences in question, in particular where there is a substantiated suspicion that the suspect, perpetrator or victim of a terrorist offence or other serious criminal offence falls under a category covered by this Regulation. 2. Access to the EES as a tool for the purpose of identifying an unknown suspect, perpetrator or suspected victim of a terrorist offence or other serious criminal offence shall be allowed where, in addition to the conditions listed in paragraph 1, the following conditions are met: (a) a prior search has been conducted in national databases; and (b) in the case of searches with fingerprints, a prior search has been launched in the automated fingerprint identification system of the other Member States under Decision 2008/615/JHA where comparisons of fingerprints are technically available, and either that search has been fully carried out, or that search has not been fully carried out within two days of being launched. Access to the EES as a tool for the purpose of identifying an unknown suspect, perpetrator or suspected victim of a terrorist offence or other serious criminal offence shall be allowed where, in addition to the conditions listed in paragraph 1, the following conditions are met: (a) a prior search has been conducted in national databases; and (b) in the case of searches with fingerprints, a prior search has been launched in the automated fingerprint identification system of the other Member States under Decision 2008/615/JHA where comparisons of fingerprints are technically available, and either that search has been fully carried out, or that search has not been fully carried out within two days of being launched. However, the additional conditions in points (a) and (b) of the first subparagraph shall not apply where there are reasonable grounds to believe that a comparison with the systems of the other Member States would not lead to the verification of the identity of the data subject or in a case of urgency where there is a need to prevent an imminent danger to the life of a person associated with a terrorist offence or another serious criminal offence. Those reasonable grounds shall be included in the electronic or written request sent by the operating unit of the designated authority to the central access point. A request for consultation of the VIS on the same data subject may be submitted in parallel to a request for consultation of the EES in accordance with the conditions laid down in Council Decision 2008/633/JHA ( 12 ). 3. Access to the EES as a tool to consult the travel history or the periods of stay on the territory of the Member States of a known suspect, perpetrator or suspected victim of a terrorist offence or other serious criminal offence shall be allowed when the conditions listed in paragraph 1 are met. 4. Consultation of the EES for the purpose of identification as referred to in paragraph 2 shall be limited to searching in the individual file with any of the following EES data: (a) fingerprints of visa-exempt third-country nationals or of holders of an FTD. In order to launch this consultation of the EES, latent fingerprints may be used and may therefore be compared with the fingerprints stored in the EES; (b) facial images. Consultation of the EES for the purpose of identification as referred to in paragraph 2 shall be limited to searching in the individual file with any of the following EES data: (a) fingerprints of visa-exempt third-country nationals or of holders of an FTD. In order to launch this consultation of the EES, latent fingerprints may be used and may therefore be compared with the fingerprints stored in the EES; (b) facial images. 5. Consultation of the EES for the travel history of the third-country national concerned shall be limited to searching with one or several of the following EES data in the individual file, in the entry/exit records or in the refusal of entry records: (a) surname (family name); first name or names (given names); date of birth; nationality or nationalities; sex; (b) type and number of travel document or documents, three letter code of the issuing country and date of expiry of the validity of the travel document; (c) visa sticker number and the date of expiry of the validity of the visa; (d) fingerprints, including latent fingerprints; (e) facial image; (f) date and time of entry, authority that authorised the entry and entry border crossing point; (g) date and time of exit and exit border crossing point. Consultation of the EES shall, in the event of a hit, give access to the data listed in the first subparagraph as well as to any other data taken from the individual file, the entry/exit records and refusal of entry records, including data related to the revocation or extension of an authorisation for short stay in accordance with Article 19.
Article 33 Procedure and conditions for access to EES data by Europol
1. Europol shall have access to consult the EES where all the following conditions are met: (a) the consultation is necessary to support and strengthen action by Member States in preventing, detecting or investigating terrorist offences or other serious criminal offences falling under Europol’s mandate; (b) the consultation is necessary and proportionate in a specific case; (c) evidence or reasonable grounds exist to consider that the consultation of the EES data will contribute to the prevention, detection or investigation of any of the criminal offences in question, in particular where there is a substantiated suspicion that the suspect, perpetrator or victim of a terrorist offence or other serious criminal offence falls under a category covered by this Regulation. 1a. In cases where Europol has launched a query of the CIR in accordance with Article 22 of Regulation (EU) 2019/817, it may access the EES for consultation where the conditions laid down in this Article are met and where the reply received as referred to in Article 22(2) of Regulation (EU) 2019/817 reveals that data are stored in the EES. 2. Access to the EES as a tool for the purpose of identifying an unknown suspect, perpetrator or suspected victim of a terrorist offence or other serious criminal offence shall be allowed where the conditions listed in paragraph 1 are met and the consultation, as a matter of priority, of the data stored in the databases that are technically and legally accessible by Europol has not made it possible to identify the person in question. A request for consultation of the VIS on the same data subject may be submitted in parallel to a request for consultation of the EES in accordance with the conditions laid down in Decision 2008/633/JHA. 3. The conditions laid down in Article 32(3), (4) and (5) shall apply accordingly. 4. The Europol designated authority may submit a reasoned electronic request for the consultation of all EES data or a specific set of EES data to the Europol central access point referred to in Article 30(2). Upon receipt of a request for access, the Europol central access point shall verify whether the conditions for access set out in paragraphs 1 and 2 of this Article are fulfilled. If all conditions for access are fulfilled, the duly authorised staff of the Europol central access point shall process the requests. The EES data accessed shall be transmitted to the Europol designated authority in such a way that the security of the data is not compromised. 5. Europol shall only process information obtained from a consultation of EES data subject to the authorisation of the Member State of origin. That authorisation shall be obtained via the Europol national unit of that Member State.
Article 34 Data retention period
1. Each entry/exit record or refusal of entry record linked to an individual file shall be stored in the CIR and in the EES Central System for three years following the date of the exit record or of the refusal of entry record, as applicable. 2. Each individual file together with the linked entry/exit record or records or refusal of entry records shall be stored in the CIR and in the EES Central System for three years and one day following the date of the last exit record or of the refusal of entry record if there is no entry record within three years from the date of the last exit record or refusal of entry record. 3. If there is no exit record following the date of expiry of the period of authorised stay, the data shall be stored for a period of five years following the date of expiry of the period of authorised stay. The EES shall automatically inform the Member States three months in advance of the scheduled erasure of data on overstayers in order to enable them to adopt the appropriate measures. 4. By way of derogation from paragraph 1, each entry/exit record registered for third-country nationals who have the status referred to in point (b) of Article 2(1) shall be stored in the EES for a maximum of one year after the exit of such third-country nationals. If there is no exit record the data shall be stored for a period of five years from the date of the last entry record. 5. Upon expiry of the retention period referred to in paragraphs 1 to 4, the data in question shall automatically be erased from the EES Central System and from the CIR .
Article 35 Amendment of data and advance data erasure
1. The Member State responsible shall have the right to amend data which it has entered in the EES by rectifying, completing or erasing the data. 2. If the Member State responsible has evidence to suggest that data recorded in the EES are factually inaccurate or incomplete or that data were processed in the EES in breach of this Regulation, it shall check the data concerned and shall, if necessary, rectify or complete them in, or erase them from, the EES without delay and, where applicable, from the list of identified persons referred to in Article 12(3). The data may also be checked and rectified, completed or erased at the request of the person concerned in accordance with Article 52. 3. By way of derogation from paragraphs 1 and 2 of this Article, where a Member State other than the Member State responsible has evidence to suggest that data recorded in the EES are factually inaccurate or incomplete or that data were processed in the EES in breach of this Regulation, it shall check the data concerned, provided it is possible to do so without consulting the Member State responsible and shall, if necessary, rectify or complete them in, or erase them from, the EES without delay and, where applicable, from the list of identified persons referred to in Article 12(3). Where it is not possible to check the data without consulting the Member State responsible, it shall contact the authorities of the Member State responsible within seven days, following which the Member State responsible shall check the accuracy of the data and the lawfulness of their processing within one month. The data may also be checked and rectified, completed or erased at the request of the third-country national concerned in accordance with Article 52. 4. Where a Member State has evidence to suggest that visa-related data recorded in the EES are factually inaccurate or incomplete or that such data were processed in the EES in breach of this Regulation, it shall first check the accuracy of those data against the VIS and shall, if necessary, rectify or complete them in, or erase them from, the EES. Where the data recorded in the VIS are the same as those recorded in the EES, it shall inform the Member State responsible for entering those data in the VIS immediately through the infrastructure of the VIS in accordance with Article 24(2) of Regulation (EC) No 767/2008. The Member State responsible for entering the data in the VIS shall check those data and shall, if necessary, immediately rectify or complete them in, or erase them from, the VIS and inform the Member State concerned which shall, if necessary, rectify or complete them in, or erase them from, the EES without delay and, where applicable, the list of identified persons referred to in Article 12(3). 5. The data of identified persons referred to in Article 12 shall be erased without delay from the list referred to in that Article and shall be rectified or completed in the EES where the third-country national concerned provides evidence, in accordance with the national law of the Member State responsible or of the Member State to which the request has been made, that he or she was forced to exceed the duration of authorised stay due to unforeseeable and serious events, that he or she has acquired a legal right to stay or in case of errors. Without prejudice to any available administrative or non-judicial remedy, that third-country national shall have access to an effective judicial remedy to ensure the data are rectified, completed or erased. 6. Where a third-country national has acquired the nationality of a Member State or has fallen under the scope of Article 2(3) before the expiry of the applicable period referred to in Article 34, the individual file and the entry/exit records linked to that individual file in accordance with Articles 16 and 17 and the refusal of entry records linked to that individual file in accordance with Article 18 shall, without delay, and in any event not later than five working days from the date on which that third-country national has acquired the nationality of a Member State or has fallen under the scope of Article 2(3) before the expiry of the period referred to in Article 34, be erased from the EES, as well as, where applicable, from the list of identified persons referred to in Article 12(3), by: (a) the Member State the nationality of which he or she has acquired; or (b) the Member State that issued the residence permit or card or long-stay visa. Where a third-country national has acquired the nationality of Andorra, Monaco or San Marino or where a third-country national is in possession of a passport issued by the Vatican City State or the Holy See, he or she shall inform the competent authorities of the Member State he or she next enters of that change. That Member State shall erase his or her data without delay from the EES. The third-country national in question shall have access to an effective judicial remedy to ensure that the data are erased. 7. The EES Central System and the CIR shall immediately inform all Member States of the erasure of EES or CIR data and where applicable remove them from the list of identified persons referred to in Article 12(3). 8. Where a Member State other than the Member State responsible has rectified, completed or erased data in accordance with this Regulation, that Member State shall become the Member State responsible for the rectification, completion or erasure. The EES shall record all rectifications, completions and erasures of data.
Amendment rationale: CONTEXT OF THE PROPOSAL Reasons for and objectives of the proposal In September 2018, the Council and the European Parliament adopted two legislative acts, a Regulation establishing the European Travel Information and Authorisation System (‘ETIAS’) 1 and an amendment of the Europol Regulation for the purpose of establishing ETIAS 2 . Establishing ETIAS is among efforts undertaken in recent years at EU level to enhance the security of citizens and prevent irregular migration in an open Europe, securing and continuing to strengthen the management of external borders 3 , 4 . The context and the establishment of the system were announced in the 2016 State of the Union speech. President Juncker said: ‘ We will defend our borders […] with strict controls […] on everyone crossing them. Every time someone enters or exits the EU, there will be a record of when, where and why. In November [2016] we will propose a European travel information and authorisation system – an automated system to determine who will be allowed to travel to Europe. That way we will know who is travelling to Europe before they even get here ” . ETIAS will fill the information gap on travellers exempt from the requirement of being in possession of a visa when crossing the external borders. ETIAS will determine the eligibility of visa-exempt third-country nationals prior to their travel to the Schengen Area and whether such travel poses a security, irregular migration or high epidemic risk. ETIAS will also give travellers confidence that they would be able to cross the borders smoothly. If needed, ETIAS travel authorisation could be denied by ETIAS National Units. The assessment of such risks will involve automated processing of personal data provided in the applications for travel authorisation. The ETIAS Regulation establishes that personal data in the applications will be compared with the data present in records, files or alerts registered in EU information systems or databases (the ETIAS Central System, Schengen Information System (‘SIS’), the Visa Information System (‘VIS’), the Entry/Exit System ‘(EES’) or Eurodac), in Europol data or in the Interpol databases (the Interpol Stolen and Lost Travel Document database (‘SLTD’) or the Interpol Travel Documents Associated with Notices database (‘TDAWN’)) 5 . While the Regulation defines in its Article 20 which group of data from the ETIAS application files can be used to consult the other systems, not all those data are collected or recorded in the same way in the other EU information systems and Europol data. For instance in one of the systems, ‘country of issue of the travel document’ is collected while in another the same data is recorded in another way, e.g. as ‘three letter code of the issuing country of the travel document’. In other instances, a category of data is collected in one system but not in the other. For instance, ‘first names of parents of applicants’ are collected by ETIAS, but not in most of the other systems to be queried by ETIAS. Also at the time the ETIAS proposal 6 was adopted, the situation as regards the different EU information systems to be queried by ETIAS was different from today. At the time the ETIAS proposal was adopted, two other new EU information technology systems had been proposed to be set up: discussions were ongoing on the EES Regulation 7 while the Commission’s proposal on the European Criminal Records Information System – Third Country Nationals (‘ECRIS-TCN’) 8 was just about to be proposed. As regards existing information systems, the legal texts of the SIS were evolving due to the proposed revisions to the SIS legal framework in December 2016, finally adopted by co-legislators in November 2018 9 . The recast of the Eurodac Regulation 10 had also been proposed by the Commission as part of the reform of the Common European Asylum System, but had not yet been adopted by co-legislators 11 . The recast Eurodac Regulation still remains to be adopted by co-legislators today. Based on these considerations, the ETIAS Regulation stipulates, in its Article 11(2) that: “The amendments to the legal acts establishing the EU information systems that are necessary for establishing their interoperability with ETIAS as well as the addition of corresponding provisions in this Regulation shall be the subject of a separate legal instrument”. The present proposal therefore aims to set out the technical amendments necessary to fully set up the ETIAS system by amending the legal acts of the EU information technology systems ETIAS queries. The present proposal also sets out coresponding provisions and amends the ETIAS Regulation accordingly. First, the present initiative sets out amendments to the Regulation on ECRIS-TCN, on which recently, an ‘agreement in principle’ was found by the co-legislators. Thus, in line with the intention expressed by co-legislators in the ETIAS Regulation 12 it is now possible to include in ETIAS the necessary provisions on the relationship between ETIAS and ECRIS-TCN and to amend ECRIS-TCN accordingly. Secondly, the present initiative also aims to establish the relations between ETIAS and the SIS. The revised SIS legal framework has been adopted in November 2018. The present proposal includes consequential amendments resulting from the adoption of the new SIS Regulations. In line with the new SIS legal framework it is proposed to include the new alert category on inquiry checks 13 for the assessment of applications. It is not proposed to include the alert category on return decisions as such alerts are erased at the moment a return decision is implemented. This means that persons that apply for an ETIAS authorisation after having left the EU will – by definition – not have a return record in the SIS. Thirdly, the present initiative seeks to amend the EES Regulation to establish technically its relationship with ETIAS. Fourthly, the initiative also aims at amending the VIS Regulation in order to allow VIS to receive, process and answer ETIAS queries. Although in May 2018, the Commission presented a proposal to amend the VIS Regulation in order to upgrade that database, the present initiative puts forward amendments to the VIS Regulation currently in force, as the negotiations on the proposal for the upgraded VIS are not sufficiently advanced. However, if the proposal to amend the VIS Regulation were to be adopted first, it could become necessary to introduce some technical changes in the present proposal to align it with the amended version of the VIS Regulation. If the present proposal is adopted first, some technical changes could be required in the proposal amending the VIS Regulation before its adoption. In addition, following the adoption of both the EES Regulation and ETIAS Regulation, it is now required to align the way EES and ETIAS are working together on the way EES and VIS are integrated for the purpose of border control process and registration of border crossings in EES. This will rationalise and simplify the work of border guards through the implementation of a more uniform border control process for all third-country national entering for a short stay. The present initiative however does not include the amendments related to Eurodac, the EU asylum and irregular migration database, given that discussions have not yet been concluded on the May 2016 legislative proposal to strengthen Eurodac 14 . Furthermore, the data available in the current Eurodac are not sufficient for ETIAS purposes, given that the existing Eurodac only stores biometric data and a reference number, but no other personal data (e.g. name(s), age, date of birth) that would allow for contributing to the objectives of ETIAS. The May 2016 legislative proposal for a recast Eurodac Regulation seeks to extend the purpose of the database to the identification of illegally staying third-country nationals and those who have entered the EU irregularly. In particular, it provides for the storage of personal data such as the name(s), age, date of birth, nationality, and identity documents. These identity data are essential to ensure that Eurodac will be able to contribute to the objectives of ETIAS. Once the co-legislators reach political agreement on the recast Eurodac Regulation, the recast Eurodac Regulation will need to be supplemented with the necessary amendments to connect Eurodac to ETIAS. Additionally, once the co-legislators adopt the Commission’s legislative proposals 15 for the interoperability of information systems for security, border and migration management, and following political agreement on the proposal for a recast Eurodac Regulation, the Commission will apply the same approach with regards to the necessary amendments to make Eurodac part of the interoperability of information systems . Finally, in line with the April 2016 Communication on "Smarter Information Systems for borders and security", ETIAS is to be built based on a re-use of hardware and software components developed for the EES 16 . This is also the approach followed by the legislative proposals on the interoperability of information systems 17 . The technical development of the common identity repository and the European search portal as foreseen by the legislative proposals on the interoperability of information systems would be developed on the basis of the EES/ETIAS components. This proposal therefore presents amendments to the ETIAS Regulation to specify that the ETIAS Central System would build upon the EES Central System’s hardware and software components in order to establish a shared identity repository for the storage of the identity alphanumeric data of both ETIAS applicants and third-country nationals registered in EES. This shared identity repository would be the basis for the implementation of the common identity repository once the co-legislators adopt the legislative proposals on the interoperability of information systems. Moreover, during a transitional period, before the European search portal is available, the automated processing of ETIAS applications would rely on a tool, which would be used as the basis for the development and implementation of the European search portal. Due to the variable geometry in Member States' participation in EU policies in the area of freedom, security and justice, it is necessary to adopt two separate legal instruments which will nonetheless work seamlessly together to enable the comprehensive operation and use of the system. 
Revised version (Article 35 Amendment of data and advance data erasure):
1. The Member State responsible shall have the right to amend data which it has entered in the EES by rectifying, completing or erasing the data. 2. If the Member State responsible has evidence to suggest that data recorded in the EES are factually inaccurate or incomplete or that data were processed in the EES in breach of this Regulation, it shall check the data concerned and shall, if necessary, rectify or complete them in, or erase them from, the EES without delay and, where applicable, from the list of identified persons referred to in Article 12(3). The data may also be checked and rectified, completed or erased at the request of the person concerned in accordance with Article 52. 3. By way of derogation from paragraphs 1 and 2 of this Article, where a Member State other than the Member State responsible has evidence to suggest that data recorded in the EES are factually inaccurate or incomplete or that data were processed in the EES in breach of this Regulation, it shall check the data concerned, provided it is possible to do so without consulting the Member State responsible and shall, if necessary, rectify or complete them in, or erase them from, the EES without delay and, where applicable, from the list of identified persons referred to in Article 12(3). Where it is not possible to check the data without consulting the Member State responsible, it shall contact the authorities of the Member State responsible within seven days, following which the Member State responsible shall check the accuracy of the data and the lawfulness of their processing within one month. The data may also be checked and rectified, completed or erased at the request of the third-country national concerned in accordance with Article 52. 5. The data of identified persons referred to in Article 12 shall be erased without delay from the list referred to in that Article and shall be rectified or completed in the EES where the third-country national concerned provides evidence, in accordance with the national law of the Member State responsible or of the Member State to which the request has been made, that he or she was forced to exceed the duration of authorised stay due to unforeseeable and serious events, that he or she has acquired a legal right to stay or in case of errors. Without prejudice to any available administrative or non-judicial remedy, that third-country national shall have access to an effective judicial remedy to ensure the data are rectified, completed or erased. (a) the Member State the nationality of which he or she has acquired; or (b) the Member State that issued the residence permit or card or long-stay visa. Where a third-country national has acquired the nationality of Andorra, Monaco or San Marino or where a third-country national is in possession of a passport issued by the Vatican City State or the Holy See, he or she shall inform the competent authorities of the Member State he or she next enters of that change. That Member State shall erase his or her data without delay from the EES. The third-country national in question shall have access to an effective judicial remedy to ensure that the data are erased. 7. The EES Central System and the CIR shall immediately inform all Member States of the erasure of EES or CIR data and where applicable remove them from the list of identified persons referred to in Article 12(3). 8. Where a Member State other than the Member State responsible has rectified, completed or erased data in accordance with this Regulation, that Member State shall become the Member State responsible for the rectification, completion or erasure. The EES shall record all rectifications, completions and erasures of data.
Article 36 Adoption of implementing acts by the Commission prior to development
The Commission shall adopt the implementing acts necessary for the development and technical implementation of the EES Central System and the CIR , the NUIs, the Communication Infrastructure, the web service referred to in Article 13 and the data repository referred to in Article 63(2), in particular measures for: (a) the specifications for the quality, resolution and use of fingerprints for biometric verification and identification in the EES; (b) the specifications for the quality, resolution and use of the facial image for biometric verification and identification in the EES, including where taken live or extracted electronically from the eMRTD; (c) entering the data in accordance with Articles 16 to 20; (d) accessing the data in accordance with Articles 23 to 33; (e) amending, erasing and advance erasure of data in accordance with Article 35; (f) keeping and accessing the logs in accordance with Article 46; (g) performance requirements, including the minimum specifications for technical equipment and requirements regarding the biometric performance of the EES, in particular in terms of the required False Positive Identification Rate, False Negative Identification Rate and Failure To Enrol Rate; (h) the specifications and conditions for the web service referred to in Article 13, including specific provisions for the protection of the data where provided by or to carriers; (i) the establishment and the high level design of interoperability as referred to in Article 8; (j) the specifications and conditions for the data repository referred in Article 63(2); (k) the establishment of the list of identified persons referred to in Article 12(3) and the procedure to make that list available to Member States; (l) the specifications for technical solutions to connect central access points in accordance with Articles 31, 32 and 33 and for a technical solution to collect the statistical data required pursuant to Article 72(8). Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 68(2). For the adoption of the implementing acts set out in point (i) of the first paragraph of this Article, the Committee set up by Article 68 of this Regulation shall consult the VIS Committee set up by Article 49 of Regulation (EC) No 767/2008.
Article 37 Development and operational management
1. eu-LISA shall be responsible for the development of the EES Central System and the CIR, the NUIs, the Communication Infrastructure and the Secure Communication Channel between the EES Central System and the VIS Central System. eu-LISA shall also be responsible for the development of the web service referred to in Article 13 in accordance with the detailed rules referred to in Article 13(7) and the specifications and conditions adopted pursuant to point (h) of the first paragraph of Article 36 and for the development of the data repository referred to in Article 63(2). eu-LISA shall define the design of the physical architecture of the EES including its Communication Infrastructure, as well as the technical specifications and their evolution regarding the EES Central System, the NUIs, the Communication Infrastructure, the Secure Communication Channel between the EES Central System and the VIS Central System, the web service referred to in Article 13 of this Regulation and the data repository referred to in Article 63(2) of this Regulation. Those technical specifications shall be adopted by eu-LISA’s Management Board, subject to a favourable opinion of the Commission. eu-LISA shall also implement any necessary adaptations to the VIS deriving from the establishment of interoperability with the EES as well as from the implementation of the amendments to Regulation (EC) No 767/2008 set out in Article 61 of this Regulation. eu-LISA shall develop and implement the EES Central System, the NUIs, the Communication Infrastructure, the Secure Communication Channel between the EES Central System and the VIS Central System, the web service referred to in Article 13 and the data repository referred to Article 63(2) as soon as possible after the adoption by the Commission of the measures provided for in Article 36. The development shall consist of the elaboration and implementation of the technical specifications, testing and overall project coordination. When developing, and when implementing, the EES Central System, the NUIs, the Communication Infrastructure, the Secure Communication Channel between the EES Central System and the VIS Central System, the web service referred to in Article 13 and the data repository referred to in Article 63(2), the tasks of eu–LISA shall also be to: (a) perform a security risk assessment; (b) follow the principles of privacy by design and by default during the entire lifecycle of the development of the EES; (c) conduct a security risk assessment regarding the interoperability with the VIS referred to in Article 8 and assess the required security measures needed for the implementation of the interoperability with the VIS. 2. During the designing and development phase, a Programme Management Board composed of a maximum of ten members shall be established. It shall be composed of seven members appointed by eu-LISA’s Management Board from among its members or alternate members, the Chair of the EES Advisory Group referred to in Article 69, a member representing eu-LISA appointed by its Executive Director and one member appointed by the Commission. The members appointed by eu-LISA’s Management Board shall be elected only from those Member States which are fully bound under Union law by the legislative instruments governing the development, establishment, operation and use of all the large-scale IT systems managed by eu-LISA and which comply with the conditions set out in Article 66(2). The Programme Management Board shall meet regularly and at least three times per quarter. It shall ensure the adequate management of the design and development phase of the EES and ensure the consistency between central and national EES projects. The Programme Management Board shall submit written reports every month to eu-LISA’s Management Board on the progress of the project. The Programme Management Board shall have no decision-making power nor any mandate to represent the members of eu-LISA’s Management Board. eu-LISA’s Management Board shall establish the rules of procedure of the Programme Management Board which shall include in particular rules on: (a) its chairmanship; (b) meeting venues; (c) the preparation of meetings; (d) the admission of experts to meetings; (e) communication plans ensuring full information to non-participating members of eu-LISA’s Management Board. The chairmanship of the Programme Management Board shall be held by a Member State which is fully bound under Union law by the legislative instruments governing the development, establishment, operation and use of all the large-scale IT systems managed by eu-LISA. All travel and subsistence expenses incurred by the members of the Programme Management Board shall be paid by eu-LISA and Article 10 of the eu-LISA Rules of Procedure shall apply mutatis mutandis . eu-LISA shall provide the Programme Management Board with a secretariat. During the designing and development phase, the EES Advisory Group referred to in Article 69 shall be composed of national EES project managers and chaired by eu-LISA. It shall meet regularly and at least three times per quarter until the start of operations of the EES. It shall report after each meeting to the Programme Management Board. It shall provide the technical expertise to support the tasks of the Programme Management Board and shall follow-up on the state of preparation of the Member States. 3. eu-LISA shall be responsible for the operational management of the EES Central System and the CIR, the NUIs and the Secure Communication Channel between the EES Central System and the VIS Central System. It shall ensure, in cooperation with the Member States, that at all times the best available technology, subject to a cost-benefit analysis, is used for the EES Central System and the CIR, the NUIs, the Communication Infrastructure, the Secure Communication Channel between the EES Central System and the VIS Central System, the web service referred to in Article 13 and the data repository referred to in Article 63(2). eu-LISA shall also be responsible for the operational management of the Communication Infrastructure between the EES Central System and the NUIs, for the web service referred to in Article 13 and the data repository referred to in Article 63(2). Operational management of the EES shall consist of all the tasks necessary to keep the EES functioning 24 hours a day, 7 days a week in accordance with this Regulation, in particular the maintenance work and technical developments necessary to ensure that the EES functions at a satisfactory level of operational quality, in particular as regards the response time for interrogation of the EES Central System by border authorities, in accordance with the technical specifications. 4. Without prejudice to Article 17 of the Staff Regulations of Officials of the European Union and the Conditions of Employment of Other Servants of the Union, laid down in Council Regulation (EEC, Euratom, ECSC) No 259/68 ( 12 ), eu-LISA shall ensure that those members of its staff who are required to work with EES data or with data stored in the EES apply appropriate rules of professional secrecy or other equivalent duties of confidentiality. That obligation shall also apply after such staff leave office or employment or after the termination of their activities.
Amendment rationale: CONTEXT OF THE PROPOSAL Reasons for and objectives of the proposal In September 2018, the Council and the European Parliament adopted two legislative acts, a Regulation establishing the European Travel Information and Authorisation System (‘ETIAS’) 1 and an amendment of the Europol Regulation for the purpose of establishing ETIAS 2 . Establishing ETIAS is among efforts undertaken in recent years at EU level to enhance the security of citizens and prevent irregular migration in an open Europe, securing and continuing to strengthen the management of external borders 3 , 4 . The context and the establishment of the system were announced in the 2016 State of the Union speech. President Juncker said: ‘ We will defend our borders […] with strict controls […] on everyone crossing them. Every time someone enters or exits the EU, there will be a record of when, where and why. In November [2016] we will propose a European travel information and authorisation system – an automated system to determine who will be allowed to travel to Europe. That way we will know who is travelling to Europe before they even get here ” . ETIAS will fill the information gap on travellers exempt from the requirement of being in possession of a visa when crossing the external borders. ETIAS will determine the eligibility of visa-exempt third-country nationals prior to their travel to the Schengen Area and whether such travel poses a security, irregular migration or high epidemic risk. ETIAS will also give travellers confidence that they would be able to cross the borders smoothly. If needed, ETIAS travel authorisation could be denied by ETIAS National Units. The assessment of such risks will involve automated processing of personal data provided in the applications for travel authorisation. The ETIAS Regulation establishes that personal data in the applications will be compared with the data present in records, files or alerts registered in EU information systems or databases (the ETIAS Central System, Schengen Information System (‘SIS’), the Visa Information System (‘VIS’), the Entry/Exit System ‘(EES’) or Eurodac), in Europol data or in the Interpol databases (the Interpol Stolen and Lost Travel Document database (‘SLTD’) or the Interpol Travel Documents Associated with Notices database (‘TDAWN’)) 5 . While the Regulation defines in its Article 20 which group of data from the ETIAS application files can be used to consult the other systems, not all those data are collected or recorded in the same way in the other EU information systems and Europol data. For instance in one of the systems, ‘country of issue of the travel document’ is collected while in another the same data is recorded in another way, e.g. as ‘three letter code of the issuing country of the travel document’. In other instances, a category of data is collected in one system but not in the other. For instance, ‘first names of parents of applicants’ are collected by ETIAS, but not in most of the other systems to be queried by ETIAS. Also at the time the ETIAS proposal 6 was adopted, the situation as regards the different EU information systems to be queried by ETIAS was different from today. At the time the ETIAS proposal was adopted, two other new EU information technology systems had been proposed to be set up: discussions were ongoing on the EES Regulation 7 while the Commission’s proposal on the European Criminal Records Information System – Third Country Nationals (‘ECRIS-TCN’) 8 was just about to be proposed. As regards existing information systems, the legal texts of the SIS were evolving due to the proposed revisions to the SIS legal framework in December 2016, finally adopted by co-legislators in November 2018 9 . The recast of the Eurodac Regulation 10 had also been proposed by the Commission as part of the reform of the Common European Asylum System, but had not yet been adopted by co-legislators 11 . The recast Eurodac Regulation still remains to be adopted by co-legislators today. Based on these considerations, the ETIAS Regulation stipulates, in its Article 11(2) that: “The amendments to the legal acts establishing the EU information systems that are necessary for establishing their interoperability with ETIAS as well as the addition of corresponding provisions in this Regulation shall be the subject of a separate legal instrument”. The present proposal therefore aims to set out the technical amendments necessary to fully set up the ETIAS system by amending the legal acts of the EU information technology systems ETIAS queries. The present proposal also sets out coresponding provisions and amends the ETIAS Regulation accordingly. First, the present initiative sets out amendments to the Regulation on ECRIS-TCN, on which recently, an ‘agreement in principle’ was found by the co-legislators. Thus, in line with the intention expressed by co-legislators in the ETIAS Regulation 12 it is now possible to include in ETIAS the necessary provisions on the relationship between ETIAS and ECRIS-TCN and to amend ECRIS-TCN accordingly. Secondly, the present initiative also aims to establish the relations between ETIAS and the SIS. The revised SIS legal framework has been adopted in November 2018. The present proposal includes consequential amendments resulting from the adoption of the new SIS Regulations. In line with the new SIS legal framework it is proposed to include the new alert category on inquiry checks 13 for the assessment of applications. It is not proposed to include the alert category on return decisions as such alerts are erased at the moment a return decision is implemented. This means that persons that apply for an ETIAS authorisation after having left the EU will – by definition – not have a return record in the SIS. Thirdly, the present initiative seeks to amend the EES Regulation to establish technically its relationship with ETIAS. Fourthly, the initiative also aims at amending the VIS Regulation in order to allow VIS to receive, process and answer ETIAS queries. Although in May 2018, the Commission presented a proposal to amend the VIS Regulation in order to upgrade that database, the present initiative puts forward amendments to the VIS Regulation currently in force, as the negotiations on the proposal for the upgraded VIS are not sufficiently advanced. However, if the proposal to amend the VIS Regulation were to be adopted first, it could become necessary to introduce some technical changes in the present proposal to align it with the amended version of the VIS Regulation. If the present proposal is adopted first, some technical changes could be required in the proposal amending the VIS Regulation before its adoption. In addition, following the adoption of both the EES Regulation and ETIAS Regulation, it is now required to align the way EES and ETIAS are working together on the way EES and VIS are integrated for the purpose of border control process and registration of border crossings in EES. This will rationalise and simplify the work of border guards through the implementation of a more uniform border control process for all third-country national entering for a short stay. The present initiative however does not include the amendments related to Eurodac, the EU asylum and irregular migration database, given that discussions have not yet been concluded on the May 2016 legislative proposal to strengthen Eurodac 14 . Furthermore, the data available in the current Eurodac are not sufficient for ETIAS purposes, given that the existing Eurodac only stores biometric data and a reference number, but no other personal data (e.g. name(s), age, date of birth) that would allow for contributing to the objectives of ETIAS. The May 2016 legislative proposal for a recast Eurodac Regulation seeks to extend the purpose of the database to the identification of illegally staying third-country nationals and those who have entered the EU irregularly. In particular, it provides for the storage of personal data such as the name(s), age, date of birth, nationality, and identity documents. These identity data are essential to ensure that Eurodac will be able to contribute to the objectives of ETIAS. Once the co-legislators reach political agreement on the recast Eurodac Regulation, the recast Eurodac Regulation will need to be supplemented with the necessary amendments to connect Eurodac to ETIAS. Additionally, once the co-legislators adopt the Commission’s legislative proposals 15 for the interoperability of information systems for security, border and migration management, and following political agreement on the proposal for a recast Eurodac Regulation, the Commission will apply the same approach with regards to the necessary amendments to make Eurodac part of the interoperability of information systems . Finally, in line with the April 2016 Communication on "Smarter Information Systems for borders and security", ETIAS is to be built based on a re-use of hardware and software components developed for the EES 16 . This is also the approach followed by the legislative proposals on the interoperability of information systems 17 . The technical development of the common identity repository and the European search portal as foreseen by the legislative proposals on the interoperability of information systems would be developed on the basis of the EES/ETIAS components. This proposal therefore presents amendments to the ETIAS Regulation to specify that the ETIAS Central System would build upon the EES Central System’s hardware and software components in order to establish a shared identity repository for the storage of the identity alphanumeric data of both ETIAS applicants and third-country nationals registered in EES. This shared identity repository would be the basis for the implementation of the common identity repository once the co-legislators adopt the legislative proposals on the interoperability of information systems. Moreover, during a transitional period, before the European search portal is available, the automated processing of ETIAS applications would rely on a tool, which would be used as the basis for the development and implementation of the European search portal. Due to the variable geometry in Member States' participation in EU policies in the area of freedom, security and justice, it is necessary to adopt two separate legal instruments which will nonetheless work seamlessly together to enable the comprehensive operation and use of the system. 
Revised version (Article 37 Development and operational management):
1. eu-LISA shall define the design of the physical architecture of the EES including its Communication Infrastructure, as well as the technical specifications and their evolution regarding the EES Central System, the NUIs, the Communication Infrastructure, the Secure Communication Channel between the EES Central System and the VIS Central System, the web service referred to in Article 13 of this Regulation and the data repository referred to in Article 63(2) of this Regulation. Those technical specifications shall be adopted by eu-LISA’s Management Board, subject to a favourable opinion of the Commission. eu-LISA shall also implement any necessary adaptations to the VIS deriving from the establishment of interoperability with the EES as well as from the implementation of the amendments to Regulation (EC) No 767/2008 set out in Article 61 of this Regulation. eu-LISA shall develop and implement the EES Central System, the NUIs, the Communication Infrastructure, the Secure Communication Channel between the EES Central System and the VIS Central System, the web service referred to in Article 13 and the data repository referred to Article 63(2) as soon as possible after the adoption by the Commission of the measures provided for in Article 36. The development shall consist of the elaboration and implementation of the technical specifications, testing and overall project coordination. When developing, and when implementing, the EES Central System, the NUIs, the Communication Infrastructure, the Secure Communication Channel between the EES Central System and the VIS Central System, the web service referred to in Article 13 and the data repository referred to in Article 63(2), the tasks of eu–LISA shall also be to: (a) perform a security risk assessment; (b) follow the principles of privacy by design and by default during the entire lifecycle of the development of the EES; (c) conduct a security risk assessment regarding the interoperability with the VIS referred to in Article 8 and assess the required security measures needed for the implementation of the interoperability with the VIS. 2. During the designing and development phase, a Programme Management Board composed of a maximum of ten members shall be established. It shall be composed of seven members appointed by eu-LISA’s Management Board from among its members or alternate members, the Chair of the EES Advisory Group referred to in Article 69, a member representing eu-LISA appointed by its Executive Director and one member appointed by the Commission. The members appointed by eu-LISA’s Management Board shall be elected only from those Member States which are fully bound under Union law by the legislative instruments governing the development, establishment, operation and use of all the large-scale IT systems managed by eu-LISA and which comply with the conditions set out in Article 66(2). The Programme Management Board shall meet regularly and at least three times per quarter. It shall ensure the adequate management of the design and development phase of the EES and ensure the consistency between central and national EES projects. The Programme Management Board shall submit written reports every month to eu-LISA’s Management Board on the progress of the project. The Programme Management Board shall have no decision-making power nor any mandate to represent the members of eu-LISA’s Management Board. eu-LISA’s Management Board shall establish the rules of procedure of the Programme Management Board which shall include in particular rules on: (a) its chairmanship; (b) meeting venues; (c) the preparation of meetings; (d) the admission of experts to meetings; (e) communication plans ensuring full information to non-participating members of eu-LISA’s Management Board. The chairmanship of the Programme Management Board shall be held by a Member State which is fully bound under Union law by the legislative instruments governing the development, establishment, operation and use of all the large-scale IT systems managed by eu-LISA. All travel and subsistence expenses incurred by the members of the Programme Management Board shall be paid by eu-LISA and Article 10 of the eu-LISA Rules of Procedure shall apply mutatis mutandis . eu-LISA shall provide the Programme Management Board with a secretariat. During the designing and development phase, the EES Advisory Group referred to in Article 69 shall be composed of national EES project managers and chaired by eu-LISA. It shall meet regularly and at least three times per quarter until the start of operations of the EES. It shall report after each meeting to the Programme Management Board. It shall provide the technical expertise to support the tasks of the Programme Management Board and shall follow-up on the state of preparation of the Member States. 3. eu-LISA shall be responsible for the operational management of the EES Central System and the CIR, the NUIs and the Secure Communication Channel between the EES Central System and the VIS Central System. It shall ensure, in cooperation with the Member States, that at all times the best available technology, subject to a cost-benefit analysis, is used for the EES Central System and the CIR, the NUIs, the Communication Infrastructure, the Secure Communication Channel between the EES Central System and the VIS Central System, the web service referred to in Article 13 and the data repository referred to in Article 63(2). eu-LISA shall also be responsible for the operational management of the Communication Infrastructure between the EES Central System and the NUIs, for the web service referred to in Article 13 and the data repository referred to in Article 63(2). Operational management of the EES shall consist of all the tasks necessary to keep the EES functioning 24 hours a day, 7 days a week in accordance with this Regulation, in particular the maintenance work and technical developments necessary to ensure that the EES functions at a satisfactory level of operational quality, in particular as regards the response time for interrogation of the EES Central System by border authorities, in accordance with the technical specifications. 4. Without prejudice to Article 17 of the Staff Regulations of Officials of the European Union and the Conditions of Employment of Other Servants of the Union, laid down in Council Regulation (EEC, Euratom, ECSC) No 259/68 ( 13 ), eu-LISA shall ensure that those members of its staff who are required to work with EES data or with data stored in the EES apply appropriate rules of professional secrecy or other equivalent duties of confidentiality. That obligation shall also apply after such staff leave office or employment or after the termination of their activities.
Article 38 Responsibilities of Member States and Europol
1. Each Member State shall be responsible for: (a) the integration of the existing national border infrastructure and its connection to the NUI; (b) the organisation, management, operation and maintenance of its existing national border infrastructure and of its connection to the EES for the purpose of Article 6 with the exception of Article 6(2); (c) the organisation of central access points and their connection to the NUI for the purpose of law enforcement; (d) the management of, and arrangements for, access by the duly authorised staff, and by the duly empowered staff, of the competent national authorities to the EES in accordance with this Regulation and the creation and regular update of a list of those staff and their profiles. 2. Each Member State shall designate a national authority, which shall provide the competent authorities referred to in Article 9(2) with access to the EES. Each Member State shall connect that national authority to the NUI. Each Member State shall connect their respective central access points referred to in Article 29 to the NUI. 3. Each Member State shall use automated procedures for processing EES data. 4. Member States shall ensure that the technical performance of the border control infrastructure, its availability, the duration of the border checks and the data quality are closely monitored in order to ensure that they meet the overall requirements for the proper functioning of the EES and an efficient border check procedure. 5. Before being authorised to process data stored in the EES, the staff of the authorities having a right to access the EES shall be given appropriate training on, in particular, data security and data protection rules, as well as on relevant fundamental rights. 6. Member States shall not process the data in or from the EES for purposes other than those laid down in this Regulation. 7. Europol shall assume the responsibilities provided for in point (d) of paragraph 1 and in paragraphs 3, 5 and 6. It shall connect, and be responsible for the connection of, the Europol central access point to the EES.