Article 64 Right of access to, of rectification, of completion, of erasure of personal data and of restriction of processing
1. Without prejudice to the right of information in Articles 11 and 12 of Regulation (EC) No 45/2001, applicants whose data are stored in the ETIAS Central System shall be informed, at the time their data are collected, of the procedures for exercising the rights under Articles 13 to 16 of Regulation (EC) No 45/2001 and Articles 15 to 18 of Regulation (EU) 2016/679. They shall also be provided with the contact details of the data protection officer of the European Border and Coast Guard Agency and of the European Data Protection Supervisor at the same time. 2. In order to exercise their rights under Articles 13 to 16 of Regulation (EC) No 45/2001 and Articles 15 to 18 of Regulation (EU) 2016/679, any applicant shall have the right to address him or herself to the ETIAS Central Unit or to the ETIAS National Unit responsible for his or her application. The unit that receives the request shall examine and reply to it as soon as possible, and at the latest within 30 days. Where in response to a request, it is found that the data stored in the ETIAS Central System are factually inaccurate or have been recorded unlawfully, the ETIAS Central Unit or the ETIAS National Unit of the Member State responsible shall rectify or erase those data in the ETIAS Central System without delay. Where in response to a request pursuant to this paragraph, a travel authorisation is amended by the ETIAS Central Unit or an ETIAS National Unit during its validity period, the ETIAS Central System shall carry out the automated processing laid down in Article 20 to determine whether the amended application file triggers a hit pursuant to Article 20(2) to (5). Where the automated processing does not report any hit, the ETIAS Central System shall issue an amended travel authorisation with the same validity period of the original and notify the applicant. Where the automated processing reports one or several hits, the ETIAS National Unit of the Member State responsible shall assess the security, illegal immigration or high epidemic risk in accordance with Article 26. It shall then decide whether to issue an amended travel authorisation or, where it concludes that the conditions for granting the travel authorisation are no longer met, revoke the travel authorisation. 3. Where the ETIAS Central Unit or the ETIAS National Unit of the Member State responsible for the application does not agree with the claim that data stored in the ETIAS Central System are factually inaccurate or have been recorded unlawfully, the ETIAS Central Unit or the ETIAS National Unit of the Member State responsible shall adopt without delay an administrative decision explaining in writing to the person concerned why it is not prepared to correct or delete data relating to him or her. 4. That decision shall also provide the person concerned with information explaining the possibility to challenge the decision taken in respect of the request referred to in paragraph 2 and, where relevant, information on how to bring an action or a complaint before the competent authorities or courts and any assistance available to the person, including from the competent national supervisory authorities. 5. Any request made pursuant to paragraph 2 shall contain the necessary information to identify the person concerned. That information shall be used exclusively to enable the exercise of the rights referred to in paragraph 2 and shall be erased immediately afterwards. 6. The ETIAS Central Unit or the ETIAS National Unit of the Member State responsible shall keep a record in the form of a written document that a request referred to in paragraph 2 was made and how it was addressed. It shall make that document available to the competent national data protection supervisory authorities without delay, and not later than seven days following the decision to rectify or erase data referred to in the second subparagraph of paragraph 2 or following the decision referred to in paragraph 3 respectively.
Amendment rationale: CONTEXT OF THE PROPOSAL Reasons for and objectives of the proposal In September 2018, the Council and the European Parliament adopted two legislative acts, a Regulation establishing the European Travel Information and Authorisation System (‘ETIAS’) 1 and an amendment of the Europol Regulation for the purpose of establishing ETIAS 2 . Establishing ETIAS is among efforts undertaken in recent years at EU level to enhance the security of citizens and prevent irregular migration in an open Europe, securing and continuing to strengthen the management of external borders 3 , 4 . The context and the establishment of the system were announced in the 2016 State of the Union speech. President Juncker said: ‘ We will defend our borders […] with strict controls […] on everyone crossing them. Every time someone enters or exits the EU, there will be a record of when, where and why. In November [2016] we will propose a European travel information and authorisation system – an automated system to determine who will be allowed to travel to Europe. That way we will know who is travelling to Europe before they even get here ” . ETIAS will fill the information gap on travellers exempt from the requirement of being in possession of a visa when crossing the external borders. ETIAS will determine the eligibility of visa-exempt third-country nationals prior to their travel to the Schengen Area and whether such travel poses a security, irregular migration or high epidemic risk. ETIAS will also give travellers confidence that they would be able to cross the borders smoothly. If needed, ETIAS travel authorisation could be denied by ETIAS National Units. The assessment of such risks will involve automated processing of personal data provided in the applications for travel authorisation. The ETIAS Regulation establishes that personal data in the applications will be compared with the data present in records, files or alerts registered in EU information systems or databases (the ETIAS Central System, Schengen Information System (‘SIS’), the Visa Information System (‘VIS’), the Entry/Exit System ‘(EES’) or Eurodac), in Europol data or in the Interpol databases (the Interpol Stolen and Lost Travel Document database (‘SLTD’) or the Interpol Travel Documents Associated with Notices database (‘TDAWN’)) 5 . While the Regulation defines in its Article 20 which group of data from the ETIAS application files can be used to consult the other systems, not all those data are collected or recorded in the same way in the other EU information systems and Europol data. For instance in one of the systems, ‘country of issue of the travel document’ is collected while in another the same data is recorded in another way, e.g. as ‘three letter code of the issuing country of the travel document’. In other instances, a category of data is collected in one system but not in the other. For instance, ‘first names of parents of applicants’ are collected by ETIAS, but not in most of the other systems to be queried by ETIAS. Also at the time the ETIAS proposal 6 was adopted, the situation as regards the different EU information systems to be queried by ETIAS was different from today. At the time the ETIAS proposal was adopted, two other new EU information technology systems had been proposed to be set up: discussions were ongoing on the EES Regulation 7 while the Commission’s proposal on the European Criminal Records Information System – Third Country Nationals (‘ECRIS-TCN’) 8 was just about to be proposed. As regards existing information systems, the legal texts of the SIS were evolving due to the proposed revisions to the SIS legal framework in December 2016, finally adopted by co-legislators in November 2018 9 . The recast of the Eurodac Regulation 10 had also been proposed by the Commission as part of the reform of the Common European Asylum System, but had not yet been adopted by co-legislators 11 . The recast Eurodac Regulation still remains to be adopted by co-legislators today. Based on these considerations, the ETIAS Regulation stipulates, in its Article 11(2) that: “The amendments to the legal acts establishing the EU information systems that are necessary for establishing their interoperability with ETIAS as well as the addition of corresponding provisions in this Regulation shall be the subject of a separate legal instrument”. The present proposal therefore aims to set out the technical amendments necessary to fully set up the ETIAS system by amending the legal acts of the EU information technology systems ETIAS queries. The present proposal also sets out coresponding provisions and amends the ETIAS Regulation accordingly. First, the present initiative sets out amendments to the Regulation on ECRIS-TCN, on which recently, an ‘agreement in principle’ was found by the co-legislators. Thus, in line with the intention expressed by co-legislators in the ETIAS Regulation 12 it is now possible to include in ETIAS the necessary provisions on the relationship between ETIAS and ECRIS-TCN and to amend ECRIS-TCN accordingly. Secondly, the present initiative also aims to establish the relations between ETIAS and the SIS. The revised SIS legal framework has been adopted in November 2018. The present proposal includes consequential amendments resulting from the adoption of the new SIS Regulations. In line with the new SIS legal framework it is proposed to include the new alert category on inquiry checks 13 for the assessment of applications. It is not proposed to include the alert category on return decisions as such alerts are erased at the moment a return decision is implemented. This means that persons that apply for an ETIAS authorisation after having left the EU will – by definition – not have a return record in the SIS. Thirdly, the present initiative seeks to amend the EES Regulation to establish technically its relationship with ETIAS. Fourthly, the initiative also aims at amending the VIS Regulation in order to allow VIS to receive, process and answer ETIAS queries. Although in May 2018, the Commission presented a proposal to amend the VIS Regulation in order to upgrade that database, the present initiative puts forward amendments to the VIS Regulation currently in force, as the negotiations on the proposal for the upgraded VIS are not sufficiently advanced. However, if the proposal to amend the VIS Regulation were to be adopted first, it could become necessary to introduce some technical changes in the present proposal to align it with the amended version of the VIS Regulation. If the present proposal is adopted first, some technical changes could be required in the proposal amending the VIS Regulation before its adoption. In addition, following the adoption of both the EES Regulation and ETIAS Regulation, it is now required to align the way EES and ETIAS are working together on the way EES and VIS are integrated for the purpose of border control process and registration of border crossings in EES. This will rationalise and simplify the work of border guards through the implementation of a more uniform border control process for all third-country national entering for a short stay. The present initiative however does not include the amendments related to Eurodac, the EU asylum and irregular migration database, given that discussions have not yet been concluded on the May 2016 legislative proposal to strengthen Eurodac 14 . Furthermore, the data available in the current Eurodac are not sufficient for ETIAS purposes, given that the existing Eurodac only stores biometric data and a reference number, but no other personal data (e.g. name(s), age, date of birth) that would allow for contributing to the objectives of ETIAS. The May 2016 legislative proposal for a recast Eurodac Regulation seeks to extend the purpose of the database to the identification of illegally staying third-country nationals and those who have entered the EU irregularly. In particular, it provides for the storage of personal data such as the name(s), age, date of birth, nationality, and identity documents. These identity data are essential to ensure that Eurodac will be able to contribute to the objectives of ETIAS. Once the co-legislators reach political agreement on the recast Eurodac Regulation, the recast Eurodac Regulation will need to be supplemented with the necessary amendments to connect Eurodac to ETIAS. Additionally, once the co-legislators adopt the Commission’s legislative proposals 15 for the interoperability of information systems for security, border and migration management, and following political agreement on the proposal for a recast Eurodac Regulation, the Commission will apply the same approach with regards to the necessary amendments to make Eurodac part of the interoperability of information systems . Finally, in line with the April 2016 Communication on "Smarter Information Systems for borders and security", ETIAS is to be built based on a re-use of hardware and software components developed for the EES 16 . This is also the approach followed by the legislative proposals on the interoperability of information systems 17 . The technical development of the common identity repository and the European search portal as foreseen by the legislative proposals on the interoperability of information systems would be developed on the basis of the EES/ETIAS components. This proposal therefore presents amendments to the ETIAS Regulation to specify that the ETIAS Central System would build upon the EES Central System’s hardware and software components in order to establish a shared identity repository for the storage of the identity alphanumeric data of both ETIAS applicants and third-country nationals registered in EES. This shared identity repository would be the basis for the implementation of the common identity repository once the co-legislators adopt the legislative proposals on the interoperability of information systems. Moreover, during a transitional period, before the European search portal is available, the automated processing of ETIAS applications would rely on a tool, which would be used as the basis for the development and implementation of the European search portal. Due to the variable geometry in Member States' participation in EU policies in the area of freedom, security and justice, it is necessary to adopt two separate legal instruments which will nonetheless work seamlessly together to enable the comprehensive operation and use of the system. 
Revised version (Article 64 Right of access to, of rectification, of completion, of erasure of personal data and of restriction of processing):
1. Without prejudice to the right of information in Articles 11 and 12 of Regulation (EC) No 45/2001, applicants whose data are stored in the ETIAS Central System shall be informed, at the time their data are collected, of the procedures for exercising the rights under Articles 13 to 16 of Regulation (EC) No 45/2001 and Articles 15 to 18 of Regulation (EU) 2016/679. They shall also be provided with the contact details of the data protection officer of the European Border and Coast Guard Agency and of the European Data Protection Supervisor at the same time. 2. In order to exercise their rights under Articles 13 to 16 of Regulation (EC) No 45/2001 and Articles 15 to 18 of Regulation (EU) 2016/679, any applicant shall have the right to address him or herself to the ETIAS Central Unit or to the ETIAS National Unit responsible for his or her application. The unit that receives the request shall examine and reply to it as soon as possible, and at the latest within 30 days. Where in response to a request, it is found that the data stored in the ETIAS Central System are factually inaccurate or have been recorded unlawfully, the ETIAS Central Unit or the ETIAS National Unit of the Member State responsible shall rectify or erase those data in the ETIAS Central System without delay. Where in response to a request pursuant to this paragraph, a travel authorisation is amended by the ETIAS Central Unit or an ETIAS National Unit during its validity period, the ETIAS Central System shall carry out the automated processing laid down in Article 20 to determine whether the amended application file triggers a hit pursuant to Article 20(2) to (5). Where the automated processing does not report any hit, the ETIAS Central System shall issue an amended travel authorisation with the same validity period of the original and notify the applicant. Where the automated processing reports one or several hits, the ETIAS National Unit of the Member State responsible shall assess the security, illegal immigration or high epidemic risk in accordance with Article 26. It shall then decide whether to issue an amended travel authorisation or, where it concludes that the conditions for granting the travel authorisation are no longer met, revoke the travel authorisation. 3. Where the ETIAS Central Unit or the ETIAS National Unit of the Member State responsible for the application does not agree with the claim that data stored in the ETIAS Central System are factually inaccurate or have been recorded unlawfully, the ETIAS Central Unit or the ETIAS National Unit of the Member State responsible shall adopt without delay an administrative decision explaining in writing to the person concerned why it is not prepared to correct or delete data relating to him or her. 4. That decision shall also provide the person concerned with information explaining the possibility to challenge the decision taken in respect of the request referred to in paragraph 2 and, where relevant, information on how to bring an action or a complaint before the competent authorities or courts and any assistance available to the person, including from the competent national supervisory authorities. 5. Any request made pursuant to paragraph 2 shall contain the necessary information to identify the person concerned. That information shall be used exclusively to enable the exercise of the rights referred to in paragraph 2 and shall be erased immediately afterwards. 6. The ETIAS Central Unit or the ETIAS National Unit of the Member State responsible shall keep a record in the form of a written document that a request referred to in paragraph 2 was made and how it was addressed. It shall make that document available to the competent national data protection supervisory authorities without delay, and not later than seven days following the decision to rectify or erase data referred to in the second subparagraph of paragraph 2 or following the decision referred to in paragraph 3 respectively. 7. The right of access to personal data under this Article is without prejudice to Article 53 of Regulation (EU) 2018/1861 and Article 67 of Regulation (EU) 2018/1862.
Article 65 Communication of personal data to third countries, international organisations and private parties
2. Personal data accessed from the ETIAS Central System by a Member State or by Europol for the purposes referred to in Article 1(2) shall not be transferred or made available to any third country, international organisation or private party. The prohibition shall also apply if those data are further processed at national level or between Member States. 3. By way of derogation from Article 49 of this Regulation, if necessary for the purpose of return, the immigration authorities may access the ETIAS Central System to retrieve data to be transferred to a third country in individual cases only where all of the following conditions are met: (a) a prior search has been conducted in the EES in accordance with Article 26 of Regulation (EU) 2017/2226; and (b) this search indicates that the EES does not contain data concerning the third-country national to be returned. By way of derogation from paragraph 1 of this Article, the data accessed from the ETIAS Central System by the immigration authorities may be transferred to a third country in individual cases if necessary in order to prove the identity of third-country nationals for the sole purpose of return, and only where one of the following conditions is satisfied: the Commission has adopted a decision on the adequate level of protection of personal data in that third country in accordance with Article 45(3) of Regulation (EU) 2016/679; (b) appropriate safeguards have been provided as referred to in Article 46 of Regulation (EU) 2016/679, such as through a readmission agreement which is in force between the Union or a Member State and the third country in question; (a) the transfer of the data is carried out in accordance with the relevant provisions of Union law, in particular provisions on data protection, including Chapter V of Regulation (EU) 2016/679, readmission agreements, and the national law of the Member State transferring the data; (b) the third country has agreed to process the data only for the purposes for which they were provided; and (c) a return decision adopted pursuant to Directive 2008/115/EC of the European Parliament and of the Council ( 10 ) has been issued in relation to the third-country national concerned, provided that the enforcement of such a return decision is not suspended and provided that no appeal has been lodged which may lead to the suspension of its enforcement. 4. Transfers of personal data to third countries pursuant to paragraph 3 shall not prejudice the rights of applicants for and beneficiaries of international protection, in particular as regards non-refoulement. 5. By way of derogation from paragraph 2 of this Article, the data from the ETIAS Central System referred to in Article 52(4) accessed by the designated authorities for the purposes referred to in Article 1(2) may be transferred or made available by the designated authority to a third country in individual cases, but only where all of the following conditions are met: there is an exceptional case of urgency where there is: (i) an imminent danger associated with a terrorist offence; or (ii) an imminent danger to the life of a person and that danger is associated with a serious criminal offence; there is an exceptional case of urgency where there is: (i) an imminent danger associated with a terrorist offence; or (ii) an imminent danger to the life of a person and that danger is associated with a serious criminal offence; (b) the transfer of data is necessary for the prevention, detection or investigation in the territory of the Member States or in the third country concerned of such a terrorist offence or serious criminal offence; (c) the designated authority has access to such data in accordance with the procedure and the conditions set out in Articles 51 and 52; (d) the transfer is carried out in accordance with the applicable conditions set out in Directive (EU) 2016/680, in particular Chapter V thereof; (e) a duly motivated written or electronic request from the third country has been submitted; (f) the reciprocal provision of any information in systems for travel authorisation held by the requesting third country to the Member States operating the ETIAS is ensured. Where a transfer is made pursuant to the first subparagraph of this paragraph, such a transfer shall be documented and the documentation shall, on request, be made available to the supervisory authority established in accordance with Article 41(1) of Directive (EU) 2016/680, including the date and time of the transfer, information about the receiving competent authority, the justification for the transfer and the personal data transferred.
Article 66 Supervision by the supervisory authority
1. Each Member State shall ensure that the supervisory authority established in accordance with Article 51(1) of Regulation (EU) 2016/679 independently monitors the lawfulness of the processing of personal data pursuant to this Regulation by the Member State concerned, including their transmission to and from ETIAS. 2. Each Member State shall ensure that the national laws, regulations and administrative provisions adopted pursuant to Directive (EU) 2016/680 are also applicable to the access to ETIAS by its national authorities in line with Chapter X of this Regulation, including in relation to the rights of the persons whose data are so accessed. 3. The supervisory authority established in accordance with Article 41(1) of Directive (EU) 2016/680 shall monitor the lawfulness of the access to personal data by Member States in accordance with Chapter X of this Regulation, including the transmission of data to and from ETIAS. Article 66(5) and (6) of this Regulation shall apply accordingly. 4. The supervisory authority or authorities established in accordance with Article 51(1) of Regulation (EU) 2016/679 shall ensure that an audit of the data processing operations by the ETIAS National Units is carried out in accordance with relevant international auditing standards at least every three years from the start of operations of ETIAS. The results of the audit may be taken into account in the evaluations conducted under the mechanism established by Council Regulation (EU) No 1053/2013 ( 11 ). The supervisory authority established in accordance with Article 51(1) of Regulation (EU) 2016/679 shall publish annually the number of requests for rectification, completion or erasure, or restriction of processing of data, the action subsequently taken and the number of rectifications, completions, erasures and restrictions of processing made in response to requests by the persons concerned. 5. Member States shall ensure that their supervisory authority established in accordance with Article 51(1) of Regulation (EU) 2016/679 has sufficient resources and expertise to fulfil the tasks entrusted to it under this Regulation. 6. Member States shall supply any information requested by the supervisory authority established in accordance with Article 51(1) of Regulation (EU) 2016/679. They shall, in particular, provide it with information on the activities carried out in accordance with their responsibilities as laid down in this Regulation. Member States shall grant the supervisory authority established in accordance with Article 51(1) of Regulation (EU) 2016/679 access to their logs and allow it access at all times to all their premises used for the purposes of ETIAS.
Article 67 Supervision by the European Data Protection Supervisor
1. The European Data Protection Supervisor shall be responsible for monitoring the personal data processing activities of eu-LISA, Europol and the European Border and Coast Guard Agency related to ETIAS and for ensuring that such activities are carried out in accordance with Regulation (EC) No 45/2001 and with this Regulation. 2. The European Data Protection Supervisor shall ensure that an audit of eu-LISA’s and the ETIAS Central Unit’s personal data processing activities is carried out in accordance with relevant international auditing standards at least every three years. A report of that audit shall be sent to the European Parliament, to the Council, to the Commission, to eu-LISA and to the supervisory authorities. eu-LISA and the European Border and Coast Guard Agency shall be given an opportunity to make comments before the report is adopted. 3. eu-LISA and the ETIAS Central Unit shall supply information requested by the European Data Protection Supervisor, give him or her access to all documents and to their logs, and allow him or her access to all their premises at any time.
Article 68 Cooperation between supervisory authorities and the European Data Protection Supervisor
1. The supervisory authorities and the European Data Protection Supervisor shall, each acting within the scope of their respective competences, cooperate actively within the framework of their respective responsibilities. They shall ensure coordinated supervision of ETIAS and of the national border infrastructures. 2. The supervisory authorities and the European Data Protection Supervisor shall exchange relevant information, assist each other in carrying out audits and inspections, examine any difficulties concerning the interpretation or application of this Regulation, assess problems in the exercise of independent supervision or in the exercise of the rights of the data subject, draw up harmonised proposals for joint solutions to any problems and promote awareness of data protection rights, as necessary. 3. For the purpose of paragraph 2, the supervisory authorities and the European Data Protection Supervisor shall meet at least twice a year within the framework of the European Data Protection Board established by Regulation (EU) 2016/679. The costs of those meetings shall be borne and their organisation shall be undertaken by that Board. Rules of procedure shall be adopted at the first meeting. Further working methods shall be developed jointly as necessary. 4. A joint report of activities shall be sent by the European Data Protection Board to the European Parliament, to the Council, to the Commission, to the European Border and Coast Guard Agency and to eu-LISA every two years. That report shall include a chapter on each Member State prepared by the supervisory authority of that Member State.
Article 69 Keeping of logs
1. eu-LISA shall keep logs of all data processing operations within the ETIAS Information System. Those logs shall include the following: (a) the purpose of the access; (b) the date and time of each operation; (c) the data used for the automated processing of the applications; where relevant, a reference to the use of the ESP to query the ETIAS Central System as referred to in Article 7(2) of Regulation (EU) 2019/817; (d) the hits triggered while carrying out the automated processing laid down in Article 20; (e) the data used for the verification of identity stored in the ETIAS Central System or other information systems and databases; (f) the results of the verification process referred to in Article 22; and (g) the staff member having performed it. 2. The ETIAS Central Unit shall keep records of the staff members duly authorised to perform the identity verifications. The ETIAS National Unit of the Member State responsible shall keep records of the staff member duly authorised to enter or retrieve the data. 3. eu-LISA shall keep logs of all data processing operations within the ETIAS Information System involving the access by border authorities referred to in Article 47 and the access by immigration authorities referred to in Article 49. Those logs shall show the date and time of each operation, the data used for launching the search, the data transmitted by the ETIAS Central System and the name of the border authorities and immigration authorities entering and retrieving the data. In addition, the competent authorities shall keep records of the staff members duly authorised to enter and retrieve the data. 4. Such logs may be used only for monitoring the admissibility of data processing and to ensure data security and integrity. The logs shall be protected by appropriate measures against unauthorised access. They shall be deleted one year after the retention period referred to in Article 54 has expired, if they are not required for monitoring procedures which have already begun. eu-LISA and the ETIAS National Units shall make the logs available to the European Data Protection Supervisor and to the competent supervisory authorities on request.
Article 70 Keeping of logs for requests for data consultation in order to prevent, detect and investigate terrorist offences or other serious criminal offences
1. eu-LISA shall keep logs of all data processing operations within the ETIAS Central System involving access by the central access points referred to in Article 50(2) for the purposes of Article 1(2). Those logs shall show the date and time of each operation, the data used for launching the search, the data transmitted by the ETIAS Central System and the name of the authorised staff of the central access points entering and retrieving the data. 2. In addition, each Member State and Europol shall keep logs of all data processing operations within the ETIAS Central System resulting from requests for consultation of data or from access to data stored in the ETIAS Central System for the purposes laid down in Article 1(2). 3. The logs referred to in paragraph 2 shall show: (a) the exact purpose of the request for consultation of or access to data stored in the ETIAS Central System, including the terrorist offence or other serious criminal offence concerned and, for Europol, the exact purpose of the request for consultation; (b) the decision taken with regard to the admissibility of the request; (c) the national file reference; (d) the date and exact time of the request for access made by the central access point to the ETIAS Central System; (e) where applicable, the use of the urgency procedure referred to in Article 51(4) and the outcome of the ex post verification; which of the data or set of data referred to in Article 52(2) and (3) have been used for consultation; and (g) in accordance with national rules or with Regulation (EU) 2016/794, the identifying mark of the official who carried out the search and of the official who ordered the search or transmission of data. 4. The logs referred to in paragraphs 1 and 2 of this Article shall be used only to check the admissibility of the request, monitor the lawfulness of data processing and to ensure data integrity and security. The logs shall be protected by appropriate measures against unauthorised access. They shall be deleted one year after the retention period referred to in Article 54 has expired, if they are not required for monitoring procedures which have already begun. The European Data Protection Supervisor and the competent supervisory authorities responsible for monitoring the lawfulness of the data processing and data integrity and security shall have access to the logs at their request for the purpose of fulfilling their duties. The authority responsible for checking the admissibility of the request shall also have access to the logs for that purpose. Other than for such purposes, personal data shall be erased in all national and Europol files after a period of one month, unless those data are required for the purposes of the specific ongoing criminal investigation for which they were requested by a Member State or by Europol. Only logs containing non-personal data may be used for the monitoring and evaluation referred to in Article 92.
Article 71 Information to the general public
After consulting the Commission and the European Data Protection Supervisor, the ETIAS Central Unit shall provide the general public with all relevant information in relation to applying for a travel authorisation. Such information shall be available on the public website and shall include: (a) the criteria, conditions and procedures for applying for a travel authorisation; (b) information concerning the website and the app for mobile devices where the application can be submitted; (c) information on the possibility that an application may be submitted by another person or a commercial intermediary; (d) information on the possibility to report abuses from commercial intermediaries using the form referred to in Article 15(5); (e) the deadlines for deciding on an application provided for in Article 32; (f) the fact that a travel authorisation is linked to the travel document indicated in the application form and that consequently the expiry and any modification of the travel document will result in the invalidity or non-recognition of the travel authorisation when crossing the border; (g) the fact that applicants are responsible for the authenticity, completeness, correctness and reliability of the data they submit and for the veracity and reliability of the statements they make; (h) the fact that decisions on applications must be notified to the applicant, that where a travel authorisation is refused, such decisions must state the grounds for the refusal and that applicants whose applications are refused have a right to appeal, with information regarding the procedure to be followed in the event of an appeal, including details of the competent authority, as well as the time limit for lodging an appeal; (i) the fact that applicants have the possibility to contact the ETIAS Central Unit indicating that the purpose of their travel is based on humanitarian grounds or is linked to international obligations and the conditions and procedures for doing so; (j) the entry conditions laid down in Article 6 of Regulation (EU) 2016/399 and the fact that a short stay is only possible for a duration of no more than 90 days in any 180-day period, except for third-country nationals benefiting from more favourable provisions of a bilateral agreement preexisting the Convention Implementing the Schengen Agreement; (k) the fact that the mere possession of a travel authorisation does not confer an automatic right of entry; (l) the fact that the border authorities may request supporting documents at external borders in order to verify the fulfilment of the conditions of entry; (m) the fact that the possession of a valid travel authorisation is a condition for stay that has to be fulfilled during the entire duration of a short stay on the territory of Member States; (n) a link to the web service referred to in Article 13 of Regulation (EU) 2017/2226 enabling third-country nationals to verify at any moment their remaining authorised stay; (o) the fact that the data entered into the ETIAS Information System are used for the purposes of border management, including for checks in databases, and that the data may be accessed by the Member States and Europol for the purposes of the prevention, detection and investigation of terrorist offences or of other serious criminal offences, under the procedures and conditions referred to in Chapter X; (p) the period for which data will be stored; (r) the possibility for travellers to obtain support as provided for in point (m) of Article 7(2).
Article 72 Information campaign
The Commission shall, in cooperation with the European External Action Service, the ETIAS Central Unit, and the Member States, including their consulates in the third countries concerned, accompany the start of operations by ETIAS with an information campaign to inform third-country nationals falling within the scope of this Regulation of the requirement for them to be in possession of a valid travel authorisation both to cross the external borders and for the entire duration of their short stay on the territory of Member States. That information campaign shall be conducted regularly and in at least one of the official languages of the countries whose nationals fall within the scope of this Regulation.
Article 73 Responsibilities of eu-LISA during the designing and development phase
1. The ETIAS Central System shall be hosted by eu-LISA in its technical sites and shall provide the functionalities laid down in this Regulation in accordance with the conditions of security, availability, quality and speed pursuant to paragraph 3 of this Article and to Article 74(1). 3. eu-LISA shall be responsible for the technical development of the ETIAS Information System, for any technical development required for establishing interoperability between the ETIAS Central System and the EU information systems referred to in Article 11 and for enabling querying of Interpol databases referred to in Article 12. eu-LISA shall define the design of the physical architecture of the system including its communication infrastructure as well as its technical specifications and their evolution and the NUIs. Those technical specifications shall be adopted by eu-LISA’s Management Board, subject to a favourable opinion from the Commission. eu-LISA shall also implement any necessary adaptations to the EES, SIS, Eurodac or VIS deriving from the establishment of interoperability with ETIAS. eu-LISA shall develop and implement the ETIAS Central System, including the ETIAS watchlist, the NUIs, and the communication infrastructure as soon as possible after the entry into force of this Regulation and the adoption by the Commission of: measures adopted in accordance with the examination procedure referred to in Article 90(2) necessary for the development and technical implementation of the ETIAS Central System, the NUIs, the communication infrastructure and the carrier gateway, in particular implementing acts for: (i) accessing the data in accordance with Articles 22 to 29 and Articles 33 to 53; (ii) amending, erasing and advance erasure of data in accordance with Article 55; (iii) keeping and accessing the logs in accordance with Article 45 and Article 69; (iv) performance requirements; (v) specifications for technical solutions to connect central access points in accordance with Articles 51 to 53. The development shall consist of the elaboration and implementation of the technical specifications, testing and overall project coordination. In this regard, the tasks of eu-LISA shall also be to: (a) perform a security risk assessment; (b) follow the principles of privacy by design and by default during the entire lifecycle of the development of ETIAS; and (c) conduct a security risk assessment regarding the interoperability of ETIAS with the EU information systems and Europol data referred to in Article 11. 4. During the design and development phase, a Programme Management Board composed of a maximum of 10 members shall be established. It shall be composed of six members appointed by eu-LISA’s Management Board from among its members or its alternates, the Chair of the EES-ETIAS Advisory Group referred to in Article 91, a member representing eu-LISA appointed by its Executive Director, a member representing the European Border and Coast Guard Agency appointed by its Executive Director and one member appointed by the Commission. The members appointed by eu-LISA’s Management Board shall be elected only from those Member States which are fully bound under Union law by the legislative instruments governing the development, establishment operation and use of all the large-scale IT systems managed by eu-LISA and which will participate in ETIAS. The Programme Management Board shall meet regularly and at least three times per quarter. It shall ensure the adequate management of the design and development phase of ETIAS. The Programme Management Board shall submit written reports every month to eu-LISA’s Management Board on progress of the project. It shall have no decision-making power nor any mandate to represent the members of eu-LISA’s Management Board. 5. eu-LISA’s Management Board shall establish the rules of procedure of the Programme Management Board which shall include in particular rules on: (a) chairmanship; (b) meeting venues; (c) preparation of meetings; (d) admission of experts to the meetings; (e) communication plans to ensure that non-participating members of eu-LISA’s Management Board are fully informed. The chairmanship shall be held by a Member State which is fully bound under Union law by the legislative instruments governing the development, establishment, operation and use of all the large-scale IT systems managed by eu-LISA. All travel and subsistence expenses incurred by the members of the Programme Management Board shall be paid by eu-LISA. Article 10 of the eu-LISA Rules of Procedure shall apply mutatis mutandis . The Programme Management Board’s secretariat shall be ensured by eu-LISA. The EES-ETIAS Advisory Group shall meet regularly until the start of operations by ETIAS. It shall report after each meeting to the Programme Management Board. It shall provide the technical expertise to support the tasks of the Programme Management Board and shall follow-up on the state of preparation of the Member States.
Amendment rationale: CONTEXT OF THE PROPOSAL Reasons for and objectives of the proposal In September 2018, the Council and the European Parliament adopted two legislative acts, a Regulation establishing the European Travel Information and Authorisation System (‘ETIAS’) 1 and an amendment of the Europol Regulation for the purpose of establishing ETIAS 2 . Establishing ETIAS is among efforts undertaken in recent years at EU level to enhance the security of citizens and prevent irregular migration in an open Europe, securing and continuing to strengthen the management of external borders 3 , 4 . The context and the establishment of the system were announced in the 2016 State of the Union speech. President Juncker said: ‘ We will defend our borders […] with strict controls […] on everyone crossing them. Every time someone enters or exits the EU, there will be a record of when, where and why. In November [2016] we will propose a European travel information and authorisation system – an automated system to determine who will be allowed to travel to Europe. That way we will know who is travelling to Europe before they even get here ” . ETIAS will fill the information gap on travellers exempt from the requirement of being in possession of a visa when crossing the external borders. ETIAS will determine the eligibility of visa-exempt third-country nationals prior to their travel to the Schengen Area and whether such travel poses a security, irregular migration or high epidemic risk. ETIAS will also give travellers confidence that they would be able to cross the borders smoothly. If needed, ETIAS travel authorisation could be denied by ETIAS National Units. The assessment of such risks will involve automated processing of personal data provided in the applications for travel authorisation. The ETIAS Regulation establishes that personal data in the applications will be compared with the data present in records, files or alerts registered in EU information systems or databases (the ETIAS Central System, Schengen Information System (‘SIS’), the Visa Information System (‘VIS’), the Entry/Exit System ‘(EES’) or Eurodac), in Europol data or in the Interpol databases (the Interpol Stolen and Lost Travel Document database (‘SLTD’) or the Interpol Travel Documents Associated with Notices database (‘TDAWN’)) 5 . While the Regulation defines in its Article 20 which group of data from the ETIAS application files can be used to consult the other systems, not all those data are collected or recorded in the same way in the other EU information systems and Europol data. For instance in one of the systems, ‘country of issue of the travel document’ is collected while in another the same data is recorded in another way, e.g. as ‘three letter code of the issuing country of the travel document’. In other instances, a category of data is collected in one system but not in the other. For instance, ‘first names of parents of applicants’ are collected by ETIAS, but not in most of the other systems to be queried by ETIAS. Also at the time the ETIAS proposal 6 was adopted, the situation as regards the different EU information systems to be queried by ETIAS was different from today. At the time the ETIAS proposal was adopted, two other new EU information technology systems had been proposed to be set up: discussions were ongoing on the EES Regulation 7 while the Commission’s proposal on the European Criminal Records Information System – Third Country Nationals (‘ECRIS-TCN’) 8 was just about to be proposed. As regards existing information systems, the legal texts of the SIS were evolving due to the proposed revisions to the SIS legal framework in December 2016, finally adopted by co-legislators in November 2018 9 . The recast of the Eurodac Regulation 10 had also been proposed by the Commission as part of the reform of the Common European Asylum System, but had not yet been adopted by co-legislators 11 . The recast Eurodac Regulation still remains to be adopted by co-legislators today. Based on these considerations, the ETIAS Regulation stipulates, in its Article 11(2) that: “The amendments to the legal acts establishing the EU information systems that are necessary for establishing their interoperability with ETIAS as well as the addition of corresponding provisions in this Regulation shall be the subject of a separate legal instrument”. The present proposal therefore aims to set out the technical amendments necessary to fully set up the ETIAS system by amending the legal acts of the EU information technology systems ETIAS queries. The present proposal also sets out coresponding provisions and amends the ETIAS Regulation accordingly. First, the present initiative sets out amendments to the Regulation on ECRIS-TCN, on which recently, an ‘agreement in principle’ was found by the co-legislators. Thus, in line with the intention expressed by co-legislators in the ETIAS Regulation 12 it is now possible to include in ETIAS the necessary provisions on the relationship between ETIAS and ECRIS-TCN and to amend ECRIS-TCN accordingly. Secondly, the present initiative also aims to establish the relations between ETIAS and the SIS. The revised SIS legal framework has been adopted in November 2018. The present proposal includes consequential amendments resulting from the adoption of the new SIS Regulations. In line with the new SIS legal framework it is proposed to include the new alert category on inquiry checks 13 for the assessment of applications. It is not proposed to include the alert category on return decisions as such alerts are erased at the moment a return decision is implemented. This means that persons that apply for an ETIAS authorisation after having left the EU will – by definition – not have a return record in the SIS. Thirdly, the present initiative seeks to amend the EES Regulation to establish technically its relationship with ETIAS. Fourthly, the initiative also aims at amending the VIS Regulation in order to allow VIS to receive, process and answer ETIAS queries. Although in May 2018, the Commission presented a proposal to amend the VIS Regulation in order to upgrade that database, the present initiative puts forward amendments to the VIS Regulation currently in force, as the negotiations on the proposal for the upgraded VIS are not sufficiently advanced. However, if the proposal to amend the VIS Regulation were to be adopted first, it could become necessary to introduce some technical changes in the present proposal to align it with the amended version of the VIS Regulation. If the present proposal is adopted first, some technical changes could be required in the proposal amending the VIS Regulation before its adoption. In addition, following the adoption of both the EES Regulation and ETIAS Regulation, it is now required to align the way EES and ETIAS are working together on the way EES and VIS are integrated for the purpose of border control process and registration of border crossings in EES. This will rationalise and simplify the work of border guards through the implementation of a more uniform border control process for all third-country national entering for a short stay. The present initiative however does not include the amendments related to Eurodac, the EU asylum and irregular migration database, given that discussions have not yet been concluded on the May 2016 legislative proposal to strengthen Eurodac 14 . Furthermore, the data available in the current Eurodac are not sufficient for ETIAS purposes, given that the existing Eurodac only stores biometric data and a reference number, but no other personal data (e.g. name(s), age, date of birth) that would allow for contributing to the objectives of ETIAS. The May 2016 legislative proposal for a recast Eurodac Regulation seeks to extend the purpose of the database to the identification of illegally staying third-country nationals and those who have entered the EU irregularly. In particular, it provides for the storage of personal data such as the name(s), age, date of birth, nationality, and identity documents. These identity data are essential to ensure that Eurodac will be able to contribute to the objectives of ETIAS. Once the co-legislators reach political agreement on the recast Eurodac Regulation, the recast Eurodac Regulation will need to be supplemented with the necessary amendments to connect Eurodac to ETIAS. Additionally, once the co-legislators adopt the Commission’s legislative proposals 15 for the interoperability of information systems for security, border and migration management, and following political agreement on the proposal for a recast Eurodac Regulation, the Commission will apply the same approach with regards to the necessary amendments to make Eurodac part of the interoperability of information systems . Finally, in line with the April 2016 Communication on "Smarter Information Systems for borders and security", ETIAS is to be built based on a re-use of hardware and software components developed for the EES 16 . This is also the approach followed by the legislative proposals on the interoperability of information systems 17 . The technical development of the common identity repository and the European search portal as foreseen by the legislative proposals on the interoperability of information systems would be developed on the basis of the EES/ETIAS components. This proposal therefore presents amendments to the ETIAS Regulation to specify that the ETIAS Central System would build upon the EES Central System’s hardware and software components in order to establish a shared identity repository for the storage of the identity alphanumeric data of both ETIAS applicants and third-country nationals registered in EES. This shared identity repository would be the basis for the implementation of the common identity repository once the co-legislators adopt the legislative proposals on the interoperability of information systems. Moreover, during a transitional period, before the European search portal is available, the automated processing of ETIAS applications would rely on a tool, which would be used as the basis for the development and implementation of the European search portal. Due to the variable geometry in Member States' participation in EU policies in the area of freedom, security and justice, it is necessary to adopt two separate legal instruments which will nonetheless work seamlessly together to enable the comprehensive operation and use of the system. 
Revised version (Article 73 Responsibilities of eu-LISA during the designing and development phase):
1. The ETIAS Central System shall be hosted by eu-LISA in its technical sites and shall provide the functionalities laid down in this Regulation in accordance with the conditions of security, availability, quality and speed pursuant to paragraph 3 of this Article and to Article 74(1). 3. eu-LISA shall be responsible for the technical development of the ETIAS Information System, for any technical development required for establishing interoperability between the ETIAS Central System and the EU information systems referred to in Article 11 and for enabling querying of Interpol databases referred to in Article 12. eu-LISA shall define the design of the physical architecture of the system including its communication infrastructure as well as its technical specifications and their evolution and the NUIs. Those technical specifications shall be adopted by eu-LISA’s Management Board, subject to a favourable opinion from the Commission. eu-LISA shall also implement any necessary adaptations to the EES, SIS, Eurodac or VIS deriving from the establishment of interoperability with ETIAS. eu-LISA shall develop and implement the ETIAS Central System, including the ETIAS watchlist, the NUIs, the communication infrastructure, and the secure communication channel between the ETIAS Central System and the EES Central System, as soon as possible after the entry into force of this Regulation and the adoption by the Commission of: the measures adopted in accordance with the examination procedure referred to in Article 90(2) necessary for the development and technical implementation of the ETIAS Central System, the NUIs, the communication infrastructure, the secure communication channel between the ETIAS Central System and the EES Central System and the carrier gateway, in particular implementing acts for: (i) accessing the data in accordance with Articles 22 to 29 and Articles 33 to 53; (ii) amending, erasing and advance erasure of data in accordance with Article 55; (iii) keeping and accessing the logs in accordance with Articles 45 and 69; (iv) performance requirements; (v) specifications for technical solutions to connect central access points in accordance with Articles 51, 52 and 53. The development shall consist of the elaboration and implementation of the technical specifications, testing and overall project coordination. In this regard, the tasks of eu-LISA shall also be to: (a) perform a security risk assessment; (b) follow the principles of privacy by design and by default during the entire lifecycle of the development of ETIAS; and (c) conduct a security risk assessment regarding the interoperability of ETIAS with the EU information systems and Europol data referred to in Article 11. 4. During the design and development phase, a Programme Management Board composed of a maximum of 10 members shall be established. It shall be composed of six members appointed by eu-LISA’s Management Board from among its members or its alternates, the Chair of the EES-ETIAS Advisory Group referred to in Article 91, a member representing eu-LISA appointed by its Executive Director, a member representing the European Border and Coast Guard Agency appointed by its Executive Director and one member appointed by the Commission. The members appointed by eu-LISA’s Management Board shall be elected only from those Member States which are fully bound under Union law by the legislative instruments governing the development, establishment operation and use of all the large-scale IT systems managed by eu-LISA and which will participate in ETIAS. The Programme Management Board shall meet regularly and at least three times per quarter. It shall ensure the adequate management of the design and development phase of ETIAS. The Programme Management Board shall submit written reports every month to eu-LISA’s Management Board on progress of the project. It shall have no decision-making power nor any mandate to represent the members of eu-LISA’s Management Board. 5. eu-LISA’s Management Board shall establish the rules of procedure of the Programme Management Board which shall include in particular rules on: (a) chairmanship; (b) meeting venues; (c) preparation of meetings; (d) admission of experts to the meetings; (e) communication plans to ensure that non-participating members of eu-LISA’s Management Board are fully informed. The chairmanship shall be held by a Member State which is fully bound under Union law by the legislative instruments governing the development, establishment, operation and use of all the large-scale IT systems managed by eu-LISA. All travel and subsistence expenses incurred by the members of the Programme Management Board shall be paid by eu-LISA. Article 10 of the eu-LISA Rules of Procedure shall apply mutatis mutandis . The Programme Management Board’s secretariat shall be ensured by eu-LISA. The EES-ETIAS Advisory Group shall meet regularly until the start of operations by ETIAS. It shall report after each meeting to the Programme Management Board. It shall provide the technical expertise to support the tasks of the Programme Management Board and shall follow-up on the state of preparation of the Member States.
Article 74 Responsibilities of eu-LISA following the entry into operations of ETIAS
1. Following the entry into operations of ETIAS, eu-LISA shall be responsible for the technical management of the ETIAS Central System and the NUIs. It shall also be responsible for any technical testing required for the establishment and update of the ETIAS screening rules. It shall ensure, in cooperation with the Member States that, at all times, the best available technology is used, subject to a cost-benefit analysis. eu-LISA shall also be responsible for the technical management of the communication infrastructure between the ETIAS Central System and the NUIs as well as for the public website, the app for mobile devices, the email service, the secure account service, the verification tool for applicants, the consent tool for applicants, the assessment tool for the ETIAS watchlist, the carrier gateway, the web service and the software to process the applications. Technical management of ETIAS shall consist of all the tasks necessary to keep the ETIAS Information System functioning 24 hours a day, 7 days a week in accordance with this Regulation, in particular the maintenance work and technical developments necessary to ensure that the system functions at a satisfactory level of technical quality, in particular as regards the response time for consultation of the ETIAS Central System in accordance with the technical specifications. 2. Without prejudice to Article 17 of the Staff Regulations of Officials of the European Union, laid down in Council Regulation (EEC, Euratom, ECSC) No 259/68 ( 12 ), eu-LISA shall apply appropriate rules of professional secrecy or other equivalent duties of confidentiality to its entire staff required to work with data stored in the ETIAS Central System. That obligation shall also apply after such staff leave office or employment or after the termination of their activities. 3. Where eu-LISA cooperates with external contractors in any ETIAS-related tasks, it shall closely monitor the activities of the contractors to ensure compliance with all provisions of this Regulation, including in particular security, confidentiality and data protection. 4. eu-LISA shall also perform tasks related to providing training on the technical use of the ETIAS Information System. 5. eu-LISA shall develop and maintain a mechanism and procedures for carrying out quality checks on the data in the ETIAS Central System and shall provide regular reports to the Member States and the ETIAS Central Unit. eu-LISA shall provide a regular report to the European Parliament, the Council and the Commission covering the issues encountered. The Commission shall, by means of implementing acts, lay down and develop that mechanism, the procedures and the appropriate requirements for data quality compliance. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 90(2).
Article 75 Responsibilities of the European Border and Coast Guard Agency
1. The European Border and Coast Guard Agency shall be responsible for: (a) the setting up and operation of the ETIAS Central Unit and ensuring the conditions for the secure management of data stored in ETIAS; (b) the automated processing of applications; and (c) the ETIAS screening rules. 2. Before being authorised to process data recorded in the ETIAS Central System, the staff of the ETIAS Central Unit having a right to access the ETIAS Central System shall be given appropriate training on data security and fundamental rights, in particular data protection. They shall also take part in training offered by eu-LISA on the technical use of the ETIAS Information System and on data quality.
Article 76 Responsibilities of Member States
1. Each Member State shall be responsible for: (a) the connection to the NUI; (b) the organisation, management, operation and maintenance of the ETIAS National Units for the manual processing of applications for travel authorisation where the automated processing has reported a hit, as referred to in Article 26; (c) the organisation of central access points and their connection to the NUI for the purposes of preventing, detecting and investigating terrorist offences or other serious criminal offences; (d) the management and arrangements for access of duly authorised staff of the competent national authorities to the ETIAS Information System in accordance with this Regulation and to establish and regularly update a list of such staff and their profiles; (e) the set up and operation of the ETIAS National Units; entering data into the ETIAS watchlist related to terrorist offences or other serious criminal offences pursuant to Article 34(2) and (3); and (g) ensuring that each of its authorities entitled to access the ETIAS Information System takes the measures necessary to comply with this Regulation, including those necessary to ensure the respect of fundamental rights and data security. 2. Each Member State shall use automated processes for querying the ETIAS Central System at the external borders. 3. Before being authorised to process data recorded in the ETIAS Central System, the staff of the ETIAS National Units having a right to access the ETIAS Information System shall be given appropriate training on data security and on fundamental rights, in particular data protection. They shall also take part in trainings offered by eu-LISA on the technical use of the ETIAS Information System and on data quality.
Article 77 Responsibilities of Europol
1. Europol shall ensure processing of the queries referred to in point (j) of Article 20(2) and in Article 20(4). It shall adapt its information system accordingly. 2. Europol shall have the responsibilities and tasks regarding the ETIAS watchlist laid down in Article 35(1) and (3) to (6). 3. Europol shall be responsible for providing a reasoned opinion following a consultation request pursuant to Article 29. 4. Pursuant to Article 34(2), Europol shall be responsible for entering data related to terrorist offences or other serious criminal offences obtained by Europol into the ETIAS watchlist. 5. Before being authorised to undertake any of the tasks referred to in Articles 34 and 35, the staff of Europol shall be given appropriate training on data security and on fundamental rights, in particular data protection. They shall also take part in training offered by eu-LISA on the technical use of the ETIAS Information System and on data quality.
Article 78 Amendment to Regulation (EU) No 1077/2011
The following article is inserted in Regulation (EU) No 1077/2011: 
‘Article 5b
Tasks relating to ETIAS
In relation to ETIAS, the Agency shall perform the tasks conferred on it by Article 73 of Regulation (EU) 2018/1240 of the European Parliament and of the Council ( *1 ).
Article 79 Amendment to Regulation (EU) No 515/2014
In Article 6 of Regulation (EU) No 515/2014, the following paragraph is inserted: ‘3a. During the development phase of the European Travel Information and Authorisation System (ETIAS), Member States shall receive an additional allocation of EUR 96,5 million to their basic allocation and shall devote this funding entirely to ETIAS to ensure its quick and effective development consistent with the implementation of the ETIAS Central System, as established in Regulation (EU) 2018/1240 of the European Parliament and of the Council ( *2 ).
Article 80 Amendments to Regulation (EU) 2016/399
Regulation (EU) 2016/399 is amended as follows: Article 6(1) is amended as follows: point (b) is replaced by the following: ‘(b) they are in a possession of a valid visa if required pursuant to Council Regulation (EC) No 539/2001 ( *3 ) or of a valid travel authorisation if required pursuant to Regulation (EU) 2018/1240 of the European Parliament and of the Council ( *4 ), except where they hold a valid residence permit or a valid long-stay visa; the following subparagraphs are added: Article 8(3) is amended as follows: in point (a), point (ii) is replaced by the following: ‘(ii) verification that the travel document is accompanied, where applicable, by the requisite visa, travel authorisation or residence permit;’ ‘(ii) the following point is inserted: In Annex V, Part B, in the standard form for refusal of entry at the border, point (C) in the list of reasons for refusal is replaced by the following: ‘(C) has no valid visa, travel authorisation or residence permit.’. ‘(C)
Article 81 Amendments to Regulation (EU) 2016/1624
Regulation (EU) 2016/1624 is amended as follows: In Article 8(1), the following point is inserted: ‘(qa) fulfil the tasks and obligations entrusted to the European Border and Coast Guard Agency referred to in Regulation (EU) 2018/1240 of the European Parliament and of the Council ( *5 ) and ensure the setting up and operation of the ETIAS Central Unit in accordance with Article 7 of that Regulation. In Chapter II, the following Section is added: ‘ Section 5
Article 82 Amendment to Regulation (EU) 2017/2226
In Article 64 of Regulation (EU) 2017/2226, the following paragraph is added: ‘5. Funding to be mobilised from the envelope referred to in point (b) of Article 5(5) of Regulation (EU) No 515/2014 to cover the costs referred to in paragraphs 1 to 4 of this Article shall be implemented under indirect management for the costs incurred by eu-LISA and under shared management for the costs incurred by the Member States.’.
Article 83 Transitional period and transitional measures
1. For a period of six months from the date on which ETIAS starts operations, the use of ETIAS shall be optional and the requirement to be in possession of a valid travel authorisation shall not apply. The Commission may adopt a delegated act in accordance with Article 89 to extend that period for a maximum of a further six months, renewable once. 2. During the period referred to in paragraph 1, Member States shall inform third-country nationals subject to the travel authorisation requirement crossing the external borders of the requirement to have a valid travel authorisation from the expiry of the six-month period. For this purpose, the Member States shall distribute a common leaflet to this category of travellers. The leaflet shall also be made available at the Member States’ consulates in the countries whose nationals fall within the scope of this Regulation. 3. A grace period of six months shall apply following the end of the period referred to in paragraph 1 of this Article. During the grace period, the requirement to be in possession of a valid travel authorisation shall apply. During the grace period the border authorities shall exceptionally allow third-country nationals subject to the travel authorisation requirement who are not in possession of a travel authorisation to cross the external borders where they fulfil all the remaining conditions of Article 6(1) of Regulation (EU) 2016/399, provided that they are crossing the external borders of the Member States for the first time since the end of the period referred to in paragraph 1 of this Article. The border authorities shall inform such third-country nationals of the requirement to be in possession of a valid travel authorisation in accordance with point (b) of Article 6(1) of Regulation (EU) 2016/399. For that purpose, the border authorities shall distribute to those travellers a common leaflet informing them that they are exceptionally allowed to cross the external borders while not fulfilling the obligation to be in possession of a valid travel authorisation and explaining that obligation. The Commission may adopt a delegated act in accordance with Article 89 of this Regulation to extend that period for a maximum of a further six months. During the period of grace, entries into the territories of the Member States not operating the EES shall not be taken into consideration. 4. The Commission shall, by means of implementing acts, draw up the two common leaflets referred to in paragraphs 2 and 3 of this Article, containing at a minimum the information referred to in Article 71. The leaflets shall be clear and simple and available in at least one of the official languages of each country whose nationals fall within the scope of this Regulation. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 90(2). 5. During the transitional period referred to in paragraphs 1 and 2 of this Article, the ETIAS Information System shall respond to the carriers’ query referred to in Article 45(2) by providing the carriers with an ‘OK’ answer. During the period of grace referred to in paragraph 3 of this Article, the response sent by the ETIAS Information System to the carriers’ query shall take into consideration whether the third-country national is crossing the external borders of the Member States for the first time since the end of the period referred to in paragraph 1 of this Article.
Article 84 Use of data for reporting and statistics
1. The duly authorised staff of the competent authorities of Member States, the Commission, eu-LISA and the ETIAS Central Unit shall have access to consult the following data, solely for the purposes of reporting and statistics, without allowing for individual identification and in accordance with the safeguards related to non-discrimination referred to in Article 14: (a) application status information; (b) nationalities, sex and year of birth of the applicant; (c) the country of residence; (d) education (primary, secondary, higher or none); (e) current occupation (job group); (f) the type of the travel document and three-letter code of the issuing country; (g) the type of travel authorisation and, for a travel authorisation with limited territorial validity as referred to in Article 44, a reference to the Member State(s) issuing the travel authorisation with limited territorial validity; (h) the validity period of the travel authorisation; and (i) the grounds for refusing, revoking or annulling a travel authorisation. 2. For the purpose of paragraph 1 of this Article, eu-LISA shall store the data referred to in that paragraph in the central repository for reporting and statistics referred to in Article 39 of Regulation (EU) 2019/817. In accordance with Article 39(1) of that Regulation, cross-system statistical data and analytical reporting shall allow the authorities listed in paragraph 1 of this Article to obtain customisable reports and statistics, to support the implementation of the ETIAS screening rules referred to in Article 33, to improve the assessment of the security, illegal immigration and high epidemic risks, to enhance the efficiency of border checks and to help the ETIAS Central Unit and the ETIAS National Units process travel authorisation applications. The Commission shall, by means of implementing acts, adopt detailed rules on the operation of the central repository and the data protection and security rules applicable to the repository. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 90(2). 3. The procedures put in place by eu-LISA to monitor the development and the functioning of the ETIAS Information System referred to in Article 92(1) shall include the possibility to produce regular statistics for ensuring that monitoring. 4. Every quarter, eu-LISA shall publish statistics on the ETIAS Information System showing in particular the number and nationality of applicants whose travel authorisation was issued or refused, including the grounds for refusal, and of third-country nationals whose travel authorisation was annulled or revoked. The daily statistics shall be stored in the central repository for reporting and statistics referred to in Article 39 of Regulation (EU) 2019/817. 5. At the end of each year, statistical data shall be compiled in an annual report for that year. The report shall be published and transmitted to the European Parliament, to the Council, to the Commission, to the European Data Protection Supervisor, to the European Border and Coast Guard Agency and to the national supervisory authorities. 6. At the request of the Commission, eu-LISA shall provide it with statistics on specific aspects related to the implementation of this Regulation as well as the statistics pursuant to paragraph 3.
Article 85 Costs
1. The costs incurred in connection with the development of the ETIAS Information System, with the integration of the existing national border infrastructure and the connection to the NUI, with the hosting of the NUI and with the establishment of the ETIAS Central Unit and the ETIAS National Units shall be borne by the general budget of the Union. eu-LISA shall pay particular attention to the risk of costs increases and ensure sufficient monitoring of contractors. 2. ETIAS’ operating costs shall be borne by the general budget of the Union. This shall include the operation and maintenance costs of the ETIAS Information System, including of the NUIs; the operating costs of the ETIAS Central Unit and the costs of staff and technical equipment (hardware and software) necessary for the fulfilment of the tasks of the ETIAS National Units; and translation costs incurred pursuant to Article 27(2) and (8). The following costs shall be excluded: (a) Member States’ project management office (meetings, missions, offices); (b) hosting of national IT systems (space, implementation, electricity, cooling); (c) operation of national IT systems (operators and support contracts); (d) design, development, implementation, operation and maintenance of national communication networks. 3. ETIAS’ operating costs shall also include financial support to Member States for expenses incurred to customise and automate border checks in order to implement ETIAS. The total amount of this financial support shall be limited to a maximum of EUR 15 million for the first year of operation, to a maximum of EUR 25 million for the second year of operation and to a maximum of EUR 50 million per year for the subsequent years of operation. The Commission shall adopt delegated acts in accordance with Article 89 to further define that financial support. 4. The European Border and Coast Guard Agency, eu-LISA and Europol shall receive appropriate additional funding and the staff necessary for the fulfilment of the tasks entrusted to them under this Regulation. 5. Funding to be mobilised from the envelope referred to in point (b) of Article 5(5) of Regulation (EU) No 515/2014 to cover the costs of implementation of this Regulation referred to in paragraphs 1 to 4 of this Article shall be implemented under indirect management for the costs incurred by eu-LISA and the European Border and Coast Guard Agency and under shared management for the costs incurred by the Member States.
Article 86 Revenues
The revenues generated by the ETIAS shall constitute internal assigned revenue in accordance with Article 21(4) of Regulation (EU, Euratom) No 966/2012 of the European Parliament and of the Council ( 13 ). They shall be assigned to cover the costs of the operation and maintenance of ETIAS. Any revenue remaining after covering these costs shall be assigned to the Union budget.
Article 87 Notifications
1. Member States shall notify the Commission of the authority which is to be considered as controller referred to in Article 57. 2. The ETIAS Central Unit and the Member States shall notify the Commission and eu-LISA of the competent authorities referred to in Article 13 which have access to the ETIAS Information System. Three months after ETIAS has started operations in accordance with Article 88, eu-LISA shall publish a consolidated list of those authorities in the Official Journal of the European Union . Member States shall also notify the Commission and eu-LISA of any changes of those authorities without delay. In the event of such changes, eu-LISA shall publish once a year an updated consolidated version of that information. eu-LISA shall maintain a continuously updated public website containing that information. 3. Member States shall notify the Commission and eu-LISA of their designated authorities and of their central access points referred to in Article 50 and shall notify any changes in that regard without delay. 4. eu-LISA shall notify the Commission of the successful completion of the test referred to in point (e) of Article 88(1). The Commission shall publish the information referred to in paragraphs 1 and 3 in the Official Journal of the European Union . In the event of changes to the information, the Commission shall publish once a year an updated consolidated version of it. The Commission shall maintain a continuously updated public website containing the information.
Article 88 Start of operations
1. The Commission shall determine the date from which ETIAS is to start operations once the following conditions have been met: (a) the necessary amendments to the legal acts establishing the EU information systems referred to in Article 11(2) with which interoperability shall be established with the ETIAS Information System have entered into force; (b) the Regulation entrusting eu-LISA with the operational management of ETIAS has entered into force; (c) the necessary amendments to the legal acts establishing the EU information systems referred to in Article 20(2) providing for an access to these databases for the ETIAS Central Unit have entered into force; (e) eu-LISA has declared the successful completion of a comprehensive test of ETIAS; (f) eu-LISA and the ETIAS Central Unit have validated the technical and legal arrangements to collect and transmit the data referred to in Article 17 to the ETIAS Central System and have notified them to the Commission; (g) the Member States and the ETIAS Central Unit have notified to the Commission the data concerning the various authorities referred to in Article 87(1) and (3). 2. The test of ETIAS referred to in point (e) of paragraph 1 shall be conducted by eu-LISA in cooperation with the Member States and the ETIAS Central Unit. 3. The Commission shall inform the European Parliament and the Council of the results of the test carried out pursuant to point (e) of paragraph 1. 4. The Commission decision referred to in paragraph 1 shall be published in the Official Journal of the European Union . 5. The Member States and the ETIAS Central Unit shall start using ETIAS from the date determined by the Commission in accordance with paragraph 1.
Amendment rationale: CONTEXT OF THE PROPOSAL Reasons for and objectives of the proposal In September 2018, the Council and the European Parliament adopted two legislative acts, a Regulation establishing the European Travel Information and Authorisation System (‘ETIAS’) 1 and an amendment of the Europol Regulation for the purpose of establishing ETIAS 2 . Establishing ETIAS is among efforts undertaken in recent years at EU level to enhance the security of citizens and prevent irregular migration in an open Europe, securing and continuing to strengthen the management of external borders 3 , 4 . The context and the establishment of the system were announced in the 2016 State of the Union speech. President Juncker said: ‘ We will defend our borders […] with strict controls […] on everyone crossing them. Every time someone enters or exits the EU, there will be a record of when, where and why. In November [2016] we will propose a European travel information and authorisation system – an automated system to determine who will be allowed to travel to Europe. That way we will know who is travelling to Europe before they even get here ” . ETIAS will fill the information gap on travellers exempt from the requirement of being in possession of a visa when crossing the external borders. ETIAS will determine the eligibility of visa-exempt third-country nationals prior to their travel to the Schengen Area and whether such travel poses a security, irregular migration or high epidemic risk. ETIAS will also give travellers confidence that they would be able to cross the borders smoothly. If needed, ETIAS travel authorisation could be denied by ETIAS National Units. The assessment of such risks will involve automated processing of personal data provided in the applications for travel authorisation. The ETIAS Regulation establishes that personal data in the applications will be compared with the data present in records, files or alerts registered in EU information systems or databases (the ETIAS Central System, Schengen Information System (‘SIS’), the Visa Information System (‘VIS’), the Entry/Exit System ‘(EES’) or Eurodac), in Europol data or in the Interpol databases (the Interpol Stolen and Lost Travel Document database (‘SLTD’) or the Interpol Travel Documents Associated with Notices database (‘TDAWN’)) 5 . While the Regulation defines in its Article 20 which group of data from the ETIAS application files can be used to consult the other systems, not all those data are collected or recorded in the same way in the other EU information systems and Europol data. For instance in one of the systems, ‘country of issue of the travel document’ is collected while in another the same data is recorded in another way, e.g. as ‘three letter code of the issuing country of the travel document’. In other instances, a category of data is collected in one system but not in the other. For instance, ‘first names of parents of applicants’ are collected by ETIAS, but not in most of the other systems to be queried by ETIAS. Also at the time the ETIAS proposal 6 was adopted, the situation as regards the different EU information systems to be queried by ETIAS was different from today. At the time the ETIAS proposal was adopted, two other new EU information technology systems had been proposed to be set up: discussions were ongoing on the EES Regulation 7 while the Commission’s proposal on the European Criminal Records Information System – Third Country Nationals (‘ECRIS-TCN’) 8 was just about to be proposed. As regards existing information systems, the legal texts of the SIS were evolving due to the proposed revisions to the SIS legal framework in December 2016, finally adopted by co-legislators in November 2018 9 . The recast of the Eurodac Regulation 10 had also been proposed by the Commission as part of the reform of the Common European Asylum System, but had not yet been adopted by co-legislators 11 . The recast Eurodac Regulation still remains to be adopted by co-legislators today. Based on these considerations, the ETIAS Regulation stipulates, in its Article 11(2) that: “The amendments to the legal acts establishing the EU information systems that are necessary for establishing their interoperability with ETIAS as well as the addition of corresponding provisions in this Regulation shall be the subject of a separate legal instrument”. The present proposal therefore aims to set out the technical amendments necessary to fully set up the ETIAS system by amending the legal acts of the EU information technology systems ETIAS queries. The present proposal also sets out coresponding provisions and amends the ETIAS Regulation accordingly. First, the present initiative sets out amendments to the Regulation on ECRIS-TCN, on which recently, an ‘agreement in principle’ was found by the co-legislators. Thus, in line with the intention expressed by co-legislators in the ETIAS Regulation 12 it is now possible to include in ETIAS the necessary provisions on the relationship between ETIAS and ECRIS-TCN and to amend ECRIS-TCN accordingly. Secondly, the present initiative also aims to establish the relations between ETIAS and the SIS. The revised SIS legal framework has been adopted in November 2018. The present proposal includes consequential amendments resulting from the adoption of the new SIS Regulations. In line with the new SIS legal framework it is proposed to include the new alert category on inquiry checks 13 for the assessment of applications. It is not proposed to include the alert category on return decisions as such alerts are erased at the moment a return decision is implemented. This means that persons that apply for an ETIAS authorisation after having left the EU will – by definition – not have a return record in the SIS. Thirdly, the present initiative seeks to amend the EES Regulation to establish technically its relationship with ETIAS. Fourthly, the initiative also aims at amending the VIS Regulation in order to allow VIS to receive, process and answer ETIAS queries. Although in May 2018, the Commission presented a proposal to amend the VIS Regulation in order to upgrade that database, the present initiative puts forward amendments to the VIS Regulation currently in force, as the negotiations on the proposal for the upgraded VIS are not sufficiently advanced. However, if the proposal to amend the VIS Regulation were to be adopted first, it could become necessary to introduce some technical changes in the present proposal to align it with the amended version of the VIS Regulation. If the present proposal is adopted first, some technical changes could be required in the proposal amending the VIS Regulation before its adoption. In addition, following the adoption of both the EES Regulation and ETIAS Regulation, it is now required to align the way EES and ETIAS are working together on the way EES and VIS are integrated for the purpose of border control process and registration of border crossings in EES. This will rationalise and simplify the work of border guards through the implementation of a more uniform border control process for all third-country national entering for a short stay. The present initiative however does not include the amendments related to Eurodac, the EU asylum and irregular migration database, given that discussions have not yet been concluded on the May 2016 legislative proposal to strengthen Eurodac 14 . Furthermore, the data available in the current Eurodac are not sufficient for ETIAS purposes, given that the existing Eurodac only stores biometric data and a reference number, but no other personal data (e.g. name(s), age, date of birth) that would allow for contributing to the objectives of ETIAS. The May 2016 legislative proposal for a recast Eurodac Regulation seeks to extend the purpose of the database to the identification of illegally staying third-country nationals and those who have entered the EU irregularly. In particular, it provides for the storage of personal data such as the name(s), age, date of birth, nationality, and identity documents. These identity data are essential to ensure that Eurodac will be able to contribute to the objectives of ETIAS. Once the co-legislators reach political agreement on the recast Eurodac Regulation, the recast Eurodac Regulation will need to be supplemented with the necessary amendments to connect Eurodac to ETIAS. Additionally, once the co-legislators adopt the Commission’s legislative proposals 15 for the interoperability of information systems for security, border and migration management, and following political agreement on the proposal for a recast Eurodac Regulation, the Commission will apply the same approach with regards to the necessary amendments to make Eurodac part of the interoperability of information systems . Finally, in line with the April 2016 Communication on "Smarter Information Systems for borders and security", ETIAS is to be built based on a re-use of hardware and software components developed for the EES 16 . This is also the approach followed by the legislative proposals on the interoperability of information systems 17 . The technical development of the common identity repository and the European search portal as foreseen by the legislative proposals on the interoperability of information systems would be developed on the basis of the EES/ETIAS components. This proposal therefore presents amendments to the ETIAS Regulation to specify that the ETIAS Central System would build upon the EES Central System’s hardware and software components in order to establish a shared identity repository for the storage of the identity alphanumeric data of both ETIAS applicants and third-country nationals registered in EES. This shared identity repository would be the basis for the implementation of the common identity repository once the co-legislators adopt the legislative proposals on the interoperability of information systems. Moreover, during a transitional period, before the European search portal is available, the automated processing of ETIAS applications would rely on a tool, which would be used as the basis for the development and implementation of the European search portal. Due to the variable geometry in Member States' participation in EU policies in the area of freedom, security and justice, it is necessary to adopt two separate legal instruments which will nonetheless work seamlessly together to enable the comprehensive operation and use of the system. 
Revised version (Article 88 Start of operations):
The Commission shall determine the date from which ETIAS is to start operations once the following conditions have been met: (a) the necessary amendments to the legal acts establishing the other EU information systems with which interoperability, within the meaning of Article 11 of this Regulation, is to be established with the ETIAS Information System have entered into force, with the exception of the recast of Regulation (EU) No 603/2013; (b) the Regulation entrusting eu-LISA with the operational management of ETIAS has entered into force; (c) the necessary amendments to the legal acts establishing the EU information systems referred to in Article 20(2) providing for an access to these databases for the ETIAS Central Unit have entered into force; (e) eu-LISA has declared the successful completion of a comprehensive test of ETIAS; (f) eu-LISA and the ETIAS Central Unit have validated the technical and legal arrangements to collect and transmit the data referred to in Article 17 to the ETIAS Central System and have notified them to the Commission; (g) the Member States and the ETIAS Central Unit have notified to the Commission the data concerning the various authorities referred to in Article 87(1) and (3). 2. The test of ETIAS referred to in point (e) of paragraph 1 shall be conducted by eu-LISA in cooperation with the Member States and the ETIAS Central Unit. 3. The Commission shall inform the European Parliament and the Council of the results of the test carried out pursuant to point (e) of paragraph 1. 4. The Commission decision referred to in paragraph 1 shall be published in the Official Journal of the European Union . 5. The Member States and the ETIAS Central Unit shall start using ETIAS from the date determined by the Commission in accordance with paragraph 1. 6. Interoperability, as referred to in Article 11, with ECRIS-TCN shall start when the CIR starts operations. ETIAS shall start operations regardless of whether that interoperability with ECRIS-TCN has been established. 7. ETIAS shall start operations regardless of whether it is possible to query the Interpol databases referred to in Article 12.
Article 89 Exercise of the delegation
1. The power to adopt delegated acts is conferred on the Commission subject to the conditions laid down in this Article. 2. The power to adopt delegated acts referred to in Article 6(4), Article 17(3), (5) and (6), Articles 18(4), 27(3), Article 31, Articles 33(2), 36(4), 39(2), 54(2), Article 83(1) and (3) and Article 85(3) shall be conferred on the Commission for a period of five years from 9 October 2018. The Commission shall draw up a report in respect of the delegation of power not later than nine months before the end of the five-year period. The delegation of power shall be tacitly extended for periods of an identical duration, unless the European Parliament or the Council opposes such extension not later than three months before the end of each period. 3. The delegation of power referred to in Article 6(4), Article 17(3), (5) and (6), Articles 18(4), 27(3), Article 31, Articles 33(2), 36(4), 39(2), 54(2), Article 83(1) and (3) and Article 85(3) may be revoked at any time by the European Parliament or by the Council. A decision to revoke shall put an end to the delegation of the power specified in that decision. It shall take effect the day following the publication of the decision in the Official Journal of the European Union or at a later date specified therein. It shall not affect the validity of any delegated acts already in force. 4. Before adopting a delegated act, the Commission shall consult experts designated by each Member State in accordance with the principles laid down in the Interinstitutional Agreement of 13 April 2016 on Better Law-Making. 5. As soon as it adopts a delegated act, the Commission shall notify it simultaneously to the European Parliament and to the Council. 6. A delegated act adopted pursuant to Article 6(4), Article 17(3), (5) or (6), Article 18(4), 27(3), Article 31, Article 33(2), 36(4), 39(2), 54(2), Article 83(1) or (3) or Article 85(3) shall enter into force only if no objection has been expressed either by the European Parliament or the Council within a period of two months of notification of that act to the European Parliament and to the Council or if, before the expiry of that period, the European Parliament and the Council have both informed the Commission that they will not object. That period shall be extended by two months at the initiative of the European Parliament or of the Council.
Article 90 Committee procedure
1. The Commission shall be assisted by a committee. That committee shall be a committee within the meaning of Regulation (EU) No 182/2011. 2. Where reference is made to this paragraph, Article 5 of Regulation (EU) No 182/2011 shall apply. Where the Committee delivers no opinion, the Commission shall not adopt the draft implementing act and the third subparagraph of Article 5(4) of Regulation (EU) No 182/2011 shall apply.
Amendment rationale: CONTEXT OF THE PROPOSAL Reasons for and objectives of the proposal In September 2018, the Council and the European Parliament adopted two legislative acts, a Regulation establishing the European Travel Information and Authorisation System (‘ETIAS’) 1 and an amendment of the Europol Regulation for the purpose of establishing ETIAS 2 . Establishing ETIAS is among efforts undertaken in recent years at EU level to enhance the security of citizens and prevent irregular migration in an open Europe, securing and continuing to strengthen the management of external borders 3 , 4 . The context and the establishment of the system were announced in the 2016 State of the Union speech. President Juncker said: ‘ We will defend our borders […] with strict controls […] on everyone crossing them. Every time someone enters or exits the EU, there will be a record of when, where and why. In November [2016] we will propose a European travel information and authorisation system – an automated system to determine who will be allowed to travel to Europe. That way we will know who is travelling to Europe before they even get here ” . ETIAS will fill the information gap on travellers exempt from the requirement of being in possession of a visa when crossing the external borders. ETIAS will determine the eligibility of visa-exempt third-country nationals prior to their travel to the Schengen Area and whether such travel poses a security, irregular migration or high epidemic risk. ETIAS will also give travellers confidence that they would be able to cross the borders smoothly. If needed, ETIAS travel authorisation could be denied by ETIAS National Units. The assessment of such risks will involve automated processing of personal data provided in the applications for travel authorisation. The ETIAS Regulation establishes that personal data in the applications will be compared with the data present in records, files or alerts registered in EU information systems or databases (the ETIAS Central System, Schengen Information System (‘SIS’), the Visa Information System (‘VIS’), the Entry/Exit System ‘(EES’) or Eurodac), in Europol data or in the Interpol databases (the Interpol Stolen and Lost Travel Document database (‘SLTD’) or the Interpol Travel Documents Associated with Notices database (‘TDAWN’)) 5 . While the Regulation defines in its Article 20 which group of data from the ETIAS application files can be used to consult the other systems, not all those data are collected or recorded in the same way in the other EU information systems and Europol data. For instance in one of the systems, ‘country of issue of the travel document’ is collected while in another the same data is recorded in another way, e.g. as ‘three letter code of the issuing country of the travel document’. In other instances, a category of data is collected in one system but not in the other. For instance, ‘first names of parents of applicants’ are collected by ETIAS, but not in most of the other systems to be queried by ETIAS. Also at the time the ETIAS proposal 6 was adopted, the situation as regards the different EU information systems to be queried by ETIAS was different from today. At the time the ETIAS proposal was adopted, two other new EU information technology systems had been proposed to be set up: discussions were ongoing on the EES Regulation 7 while the Commission’s proposal on the European Criminal Records Information System – Third Country Nationals (‘ECRIS-TCN’) 8 was just about to be proposed. As regards existing information systems, the legal texts of the SIS were evolving due to the proposed revisions to the SIS legal framework in December 2016, finally adopted by co-legislators in November 2018 9 . The recast of the Eurodac Regulation 10 had also been proposed by the Commission as part of the reform of the Common European Asylum System, but had not yet been adopted by co-legislators 11 . The recast Eurodac Regulation still remains to be adopted by co-legislators today. Based on these considerations, the ETIAS Regulation stipulates, in its Article 11(2) that: “The amendments to the legal acts establishing the EU information systems that are necessary for establishing their interoperability with ETIAS as well as the addition of corresponding provisions in this Regulation shall be the subject of a separate legal instrument”. The present proposal therefore aims to set out the technical amendments necessary to fully set up the ETIAS system by amending the legal acts of the EU information technology systems ETIAS queries. The present proposal also sets out coresponding provisions and amends the ETIAS Regulation accordingly. First, the present initiative sets out amendments to the Regulation on ECRIS-TCN, on which recently, an ‘agreement in principle’ was found by the co-legislators. Thus, in line with the intention expressed by co-legislators in the ETIAS Regulation 12 it is now possible to include in ETIAS the necessary provisions on the relationship between ETIAS and ECRIS-TCN and to amend ECRIS-TCN accordingly. Secondly, the present initiative also aims to establish the relations between ETIAS and the SIS. The revised SIS legal framework has been adopted in November 2018. The present proposal includes consequential amendments resulting from the adoption of the new SIS Regulations. In line with the new SIS legal framework it is proposed to include the new alert category on inquiry checks 13 for the assessment of applications. It is not proposed to include the alert category on return decisions as such alerts are erased at the moment a return decision is implemented. This means that persons that apply for an ETIAS authorisation after having left the EU will – by definition – not have a return record in the SIS. Thirdly, the present initiative seeks to amend the EES Regulation to establish technically its relationship with ETIAS. Fourthly, the initiative also aims at amending the VIS Regulation in order to allow VIS to receive, process and answer ETIAS queries. Although in May 2018, the Commission presented a proposal to amend the VIS Regulation in order to upgrade that database, the present initiative puts forward amendments to the VIS Regulation currently in force, as the negotiations on the proposal for the upgraded VIS are not sufficiently advanced. However, if the proposal to amend the VIS Regulation were to be adopted first, it could become necessary to introduce some technical changes in the present proposal to align it with the amended version of the VIS Regulation. If the present proposal is adopted first, some technical changes could be required in the proposal amending the VIS Regulation before its adoption. In addition, following the adoption of both the EES Regulation and ETIAS Regulation, it is now required to align the way EES and ETIAS are working together on the way EES and VIS are integrated for the purpose of border control process and registration of border crossings in EES. This will rationalise and simplify the work of border guards through the implementation of a more uniform border control process for all third-country national entering for a short stay. The present initiative however does not include the amendments related to Eurodac, the EU asylum and irregular migration database, given that discussions have not yet been concluded on the May 2016 legislative proposal to strengthen Eurodac 14 . Furthermore, the data available in the current Eurodac are not sufficient for ETIAS purposes, given that the existing Eurodac only stores biometric data and a reference number, but no other personal data (e.g. name(s), age, date of birth) that would allow for contributing to the objectives of ETIAS. The May 2016 legislative proposal for a recast Eurodac Regulation seeks to extend the purpose of the database to the identification of illegally staying third-country nationals and those who have entered the EU irregularly. In particular, it provides for the storage of personal data such as the name(s), age, date of birth, nationality, and identity documents. These identity data are essential to ensure that Eurodac will be able to contribute to the objectives of ETIAS. Once the co-legislators reach political agreement on the recast Eurodac Regulation, the recast Eurodac Regulation will need to be supplemented with the necessary amendments to connect Eurodac to ETIAS. Additionally, once the co-legislators adopt the Commission’s legislative proposals 15 for the interoperability of information systems for security, border and migration management, and following political agreement on the proposal for a recast Eurodac Regulation, the Commission will apply the same approach with regards to the necessary amendments to make Eurodac part of the interoperability of information systems . Finally, in line with the April 2016 Communication on "Smarter Information Systems for borders and security", ETIAS is to be built based on a re-use of hardware and software components developed for the EES 16 . This is also the approach followed by the legislative proposals on the interoperability of information systems 17 . The technical development of the common identity repository and the European search portal as foreseen by the legislative proposals on the interoperability of information systems would be developed on the basis of the EES/ETIAS components. This proposal therefore presents amendments to the ETIAS Regulation to specify that the ETIAS Central System would build upon the EES Central System’s hardware and software components in order to establish a shared identity repository for the storage of the identity alphanumeric data of both ETIAS applicants and third-country nationals registered in EES. This shared identity repository would be the basis for the implementation of the common identity repository once the co-legislators adopt the legislative proposals on the interoperability of information systems. Moreover, during a transitional period, before the European search portal is available, the automated processing of ETIAS applications would rely on a tool, which would be used as the basis for the development and implementation of the European search portal. Due to the variable geometry in Member States' participation in EU policies in the area of freedom, security and justice, it is necessary to adopt two separate legal instruments which will nonetheless work seamlessly together to enable the comprehensive operation and use of the system. 
Revised version (Article 90 Committee procedure):
1. The Commission shall be assisted by the committee established by Article 68 of Regulation (EU) 2017/2226. That committee shall be a committee within the meaning of Regulation (EU) No 182/2011. 2. Where reference is made to this paragraph, Article 5 of Regulation (EU) No 182/2011 shall apply. Where the Committee delivers no opinion, the Commission shall not adopt the draft implementing act and the third subparagraph of Article 5(4) of Regulation (EU) No 182/2011 shall apply.
Article 91 Advisory group
The responsibilities of eu-LISA’s EES Advisory Group shall be extended to cover ETIAS. That EES-ETIAS Advisory Group shall provide eu-LISA with expertise related to ETIAS in particular in the context of the preparation of its annual work programme and its annual activity report.
Article 92 Monitoring and evaluation
1. eu-LISA shall ensure that procedures are in place to monitor the development of the ETIAS Information System in light of objectives relating to planning and costs and to monitor the functioning of ETIAS in light of objectives relating to the technical output, cost-effectiveness, security and quality of service. 2. By 10 April 2019 and every six months thereafter during the development phase of the ETIAS Information System, eu-LISA shall submit a report to the European Parliament and to the Council on the state of play of the development of the ETIAS Central System, the NUIs and the communication infrastructure between the ETIAS Central System and the NUIs. That report shall contain detailed information about the costs incurred and information as to any risks which may impact the overall costs of the system to be borne by the general budget of the Union in accordance with Article 85. By 10 April 2019 and every six months thereafter during the development phase of the ETIAS Information System, Europol and the European Border and Coast Guard Agency shall submit a report to the European Parliament and to the Council on the state of preparation for the implementation of this Regulation including detailed information about the costs incurred and information as to any risks which may impact the overall costs of the system to be borne by the general budget of the Union in accordance with Article 85. Once the development is finalised, eu-LISA shall submit a report to the European Parliament and to the Council explaining in detail how the objectives, in particular relating to planning and costs, were achieved as well as justifying any divergences. 3. For the purposes of technical maintenance, eu-LISA shall have access to the necessary information relating to the data processing operations performed in the ETIAS Information System. 4. Two years after the start of operations of ETIAS and every two years thereafter, eu-LISA shall submit to the European Parliament, to the Council and to the Commission a report on the technical functioning of ETIAS Information System, including the security thereof, and statistical data concerning the ETIAS watchlist in accordance with the review procedure referred to in Article 35(5) and (6). 5. Three years after the start of operations of ETIAS and every four years thereafter, the Commission shall evaluate ETIAS and shall make any necessary recommendations to the European Parliament and to the Council. That evaluation shall include: (a) the querying of Interpol SLTD and TDAWN databases through ETIAS, including information on the number of hits against those Interpol databases, the number of travel authorisations refused following such hits and information on any problems encountered, as well as, if appropriate, an assessment of the need for a legislative proposal amending this Regulation; (b) the results achieved by ETIAS having regard to its objectives, mandate and tasks; (c) the impact, effectiveness and efficiency of ETIAS’ performance and its working practices in light of its objectives, mandate and tasks; (d) an assessment of the security of ETIAS; (e) the ETIAS screening rules used for the purpose of risk assessment; (f) the impact of the ETIAS watchlist including the number of travel authorisation applications which were refused for reasons that took into account a positive hit against the ETIAS watchlist; (g) the possible need to modify the mandate of the ETIAS Central Unit and the financial implications of any such modification; (h) the impact on fundamental rights; (i) the impact on diplomatic relations between the Union and the third countries involved; (j) the revenue generated through the travel authorisation fee, the costs incurred in connection with the development of ETIAS, the costs for the operation of ETIAS, the costs incurred by eu-LISA, Europol and the European Border and Coast Guard Agency in relation to their tasks pursuant to this Regulation, as well as any revenue allocated in accordance with Article 86; (k) the use of ETIAS for law enforcement purposes on the basis of the information referred to in paragraph 8 of this Article; (l) the number of applicants being invited for an interview and the percentage it represents of the total number of applicants, the reasons for requesting an interview, the number of remote interviews, the number of decisions where the travel authorisation has been granted, has been granted with a flag or has been refused, and the number of applicants invited to an interview who did not attend it, and if appropriate, an assessment of the need for a legislative proposal amending this Regulation. The Commission shall transmit the evaluation report to the European Parliament, the Council, the European Data Protection Supervisor and the European Agency for Fundamental Rights. 6. The Member States and Europol shall provide eu-LISA, the ETIAS Central Unit and the Commission with the information necessary to draft the reports referred to in paragraphs 4 and 5. This information shall not jeopardise working methods or include information that reveals sources, staff members or investigations of the designated authorities. 7. eu-LISA and the ETIAS Central Unit shall provide the Commission with the information necessary to produce the evaluations referred to in paragraph 5. 8. While respecting the provisions of national law on the publication of sensitive information, each Member State and Europol shall prepare annual reports on the effectiveness of access to data stored in the ETIAS Central System for law enforcement purposes containing information and statistics on: (a) the exact purpose of the consultation including the type of terrorist offence or other serious criminal offence; (b) reasonable grounds given for the substantiated suspicion that the suspect, perpetrator or victim is covered by this Regulation; (c) the number of requests for access to the ETIAS Central System for law enforcement purposes; (d) the number and type of cases which have resulted in hits; (e) the number and type of cases in which the urgency procedure referred to in Article 51(4) was used, including those cases where that urgency was not accepted by the ex post verification carried out by the central access point. A technical solution shall be made available to Member States in order to facilitate the collection of those data pursuant to Chapter X for the purpose of generating statistics referred to in this paragraph. The Commission shall, by means of implementing acts, adopt the specifications of the technical solution. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 90(2).
Amendment rationale: CONTEXT OF THE PROPOSAL Reasons for and objectives of the proposal In September 2018, the Council and the European Parliament adopted two legislative acts, a Regulation establishing the European Travel Information and Authorisation System (‘ETIAS’) 1 and an amendment of the Europol Regulation for the purpose of establishing ETIAS 2 . Establishing ETIAS is among efforts undertaken in recent years at EU level to enhance the security of citizens and prevent irregular migration in an open Europe, securing and continuing to strengthen the management of external borders 3 , 4 . The context and the establishment of the system were announced in the 2016 State of the Union speech. President Juncker said: ‘ We will defend our borders […] with strict controls […] on everyone crossing them. Every time someone enters or exits the EU, there will be a record of when, where and why. In November [2016] we will propose a European travel information and authorisation system – an automated system to determine who will be allowed to travel to Europe. That way we will know who is travelling to Europe before they even get here ” . ETIAS will fill the information gap on travellers exempt from the requirement of being in possession of a visa when crossing the external borders. ETIAS will determine the eligibility of visa-exempt third-country nationals prior to their travel to the Schengen Area and whether such travel poses a security, irregular migration or high epidemic risk. ETIAS will also give travellers confidence that they would be able to cross the borders smoothly. If needed, ETIAS travel authorisation could be denied by ETIAS National Units. The assessment of such risks will involve automated processing of personal data provided in the applications for travel authorisation. The ETIAS Regulation establishes that personal data in the applications will be compared with the data present in records, files or alerts registered in EU information systems or databases (the ETIAS Central System, Schengen Information System (‘SIS’), the Visa Information System (‘VIS’), the Entry/Exit System ‘(EES’) or Eurodac), in Europol data or in the Interpol databases (the Interpol Stolen and Lost Travel Document database (‘SLTD’) or the Interpol Travel Documents Associated with Notices database (‘TDAWN’)) 5 . While the Regulation defines in its Article 20 which group of data from the ETIAS application files can be used to consult the other systems, not all those data are collected or recorded in the same way in the other EU information systems and Europol data. For instance in one of the systems, ‘country of issue of the travel document’ is collected while in another the same data is recorded in another way, e.g. as ‘three letter code of the issuing country of the travel document’. In other instances, a category of data is collected in one system but not in the other. For instance, ‘first names of parents of applicants’ are collected by ETIAS, but not in most of the other systems to be queried by ETIAS. Also at the time the ETIAS proposal 6 was adopted, the situation as regards the different EU information systems to be queried by ETIAS was different from today. At the time the ETIAS proposal was adopted, two other new EU information technology systems had been proposed to be set up: discussions were ongoing on the EES Regulation 7 while the Commission’s proposal on the European Criminal Records Information System – Third Country Nationals (‘ECRIS-TCN’) 8 was just about to be proposed. As regards existing information systems, the legal texts of the SIS were evolving due to the proposed revisions to the SIS legal framework in December 2016, finally adopted by co-legislators in November 2018 9 . The recast of the Eurodac Regulation 10 had also been proposed by the Commission as part of the reform of the Common European Asylum System, but had not yet been adopted by co-legislators 11 . The recast Eurodac Regulation still remains to be adopted by co-legislators today. Based on these considerations, the ETIAS Regulation stipulates, in its Article 11(2) that: “The amendments to the legal acts establishing the EU information systems that are necessary for establishing their interoperability with ETIAS as well as the addition of corresponding provisions in this Regulation shall be the subject of a separate legal instrument”. The present proposal therefore aims to set out the technical amendments necessary to fully set up the ETIAS system by amending the legal acts of the EU information technology systems ETIAS queries. The present proposal also sets out coresponding provisions and amends the ETIAS Regulation accordingly. First, the present initiative sets out amendments to the Regulation on ECRIS-TCN, on which recently, an ‘agreement in principle’ was found by the co-legislators. Thus, in line with the intention expressed by co-legislators in the ETIAS Regulation 12 it is now possible to include in ETIAS the necessary provisions on the relationship between ETIAS and ECRIS-TCN and to amend ECRIS-TCN accordingly. Secondly, the present initiative also aims to establish the relations between ETIAS and the SIS. The revised SIS legal framework has been adopted in November 2018. The present proposal includes consequential amendments resulting from the adoption of the new SIS Regulations. In line with the new SIS legal framework it is proposed to include the new alert category on inquiry checks 13 for the assessment of applications. It is not proposed to include the alert category on return decisions as such alerts are erased at the moment a return decision is implemented. This means that persons that apply for an ETIAS authorisation after having left the EU will – by definition – not have a return record in the SIS. Thirdly, the present initiative seeks to amend the EES Regulation to establish technically its relationship with ETIAS. Fourthly, the initiative also aims at amending the VIS Regulation in order to allow VIS to receive, process and answer ETIAS queries. Although in May 2018, the Commission presented a proposal to amend the VIS Regulation in order to upgrade that database, the present initiative puts forward amendments to the VIS Regulation currently in force, as the negotiations on the proposal for the upgraded VIS are not sufficiently advanced. However, if the proposal to amend the VIS Regulation were to be adopted first, it could become necessary to introduce some technical changes in the present proposal to align it with the amended version of the VIS Regulation. If the present proposal is adopted first, some technical changes could be required in the proposal amending the VIS Regulation before its adoption. In addition, following the adoption of both the EES Regulation and ETIAS Regulation, it is now required to align the way EES and ETIAS are working together on the way EES and VIS are integrated for the purpose of border control process and registration of border crossings in EES. This will rationalise and simplify the work of border guards through the implementation of a more uniform border control process for all third-country national entering for a short stay. The present initiative however does not include the amendments related to Eurodac, the EU asylum and irregular migration database, given that discussions have not yet been concluded on the May 2016 legislative proposal to strengthen Eurodac 14 . Furthermore, the data available in the current Eurodac are not sufficient for ETIAS purposes, given that the existing Eurodac only stores biometric data and a reference number, but no other personal data (e.g. name(s), age, date of birth) that would allow for contributing to the objectives of ETIAS. The May 2016 legislative proposal for a recast Eurodac Regulation seeks to extend the purpose of the database to the identification of illegally staying third-country nationals and those who have entered the EU irregularly. In particular, it provides for the storage of personal data such as the name(s), age, date of birth, nationality, and identity documents. These identity data are essential to ensure that Eurodac will be able to contribute to the objectives of ETIAS. Once the co-legislators reach political agreement on the recast Eurodac Regulation, the recast Eurodac Regulation will need to be supplemented with the necessary amendments to connect Eurodac to ETIAS. Additionally, once the co-legislators adopt the Commission’s legislative proposals 15 for the interoperability of information systems for security, border and migration management, and following political agreement on the proposal for a recast Eurodac Regulation, the Commission will apply the same approach with regards to the necessary amendments to make Eurodac part of the interoperability of information systems . Finally, in line with the April 2016 Communication on "Smarter Information Systems for borders and security", ETIAS is to be built based on a re-use of hardware and software components developed for the EES 16 . This is also the approach followed by the legislative proposals on the interoperability of information systems 17 . The technical development of the common identity repository and the European search portal as foreseen by the legislative proposals on the interoperability of information systems would be developed on the basis of the EES/ETIAS components. This proposal therefore presents amendments to the ETIAS Regulation to specify that the ETIAS Central System would build upon the EES Central System’s hardware and software components in order to establish a shared identity repository for the storage of the identity alphanumeric data of both ETIAS applicants and third-country nationals registered in EES. This shared identity repository would be the basis for the implementation of the common identity repository once the co-legislators adopt the legislative proposals on the interoperability of information systems. Moreover, during a transitional period, before the European search portal is available, the automated processing of ETIAS applications would rely on a tool, which would be used as the basis for the development and implementation of the European search portal. Due to the variable geometry in Member States' participation in EU policies in the area of freedom, security and justice, it is necessary to adopt two separate legal instruments which will nonetheless work seamlessly together to enable the comprehensive operation and use of the system. 
Revised version (Article 92 Monitoring and evaluation):
1. eu-LISA shall ensure that procedures are in place to monitor the development of the ETIAS Information System in light of objectives relating to planning and costs and to monitor the functioning of ETIAS in light of objectives relating to the technical output, cost-effectiveness, security and quality of service. 2. By 10 April 2019 and every six months thereafter during the development phase of the ETIAS Information System, eu-LISA shall submit a report to the European Parliament and to the Council on the state of play of the development of the ETIAS Central System, the NUIs and the communication infrastructure between the ETIAS Central System and the NUIs. That report shall contain detailed information about the costs incurred and information as to any risks which may impact the overall costs of the system to be borne by the general budget of the Union in accordance with Article 85. By 10 April 2019 and every six months thereafter during the development phase of the ETIAS Information System, Europol and the European Border and Coast Guard Agency shall submit a report to the European Parliament and to the Council on the state of preparation for the implementation of this Regulation including detailed information about the costs incurred and information as to any risks which may impact the overall costs of the system to be borne by the general budget of the Union in accordance with Article 85. Once the development is finalised, eu-LISA shall submit a report to the European Parliament and to the Council explaining in detail how the objectives, in particular relating to planning and costs, were achieved as well as justifying any divergences. 3. For the purposes of technical maintenance, eu-LISA shall have access to the necessary information relating to the data processing operations performed in the ETIAS Information System. 4. Two years after the start of operations of ETIAS and every two years thereafter, eu-LISA shall submit to the European Parliament, to the Council and to the Commission a report on the technical functioning of ETIAS Information System, including the security thereof, and statistical data concerning the ETIAS watchlist in accordance with the review procedure referred to in Article 35(5) and (6). 5. Three years after the start of operations of ETIAS and every four years thereafter, the Commission shall evaluate ETIAS and shall make any necessary recommendations to the European Parliament and to the Council. That evaluation shall include: (a) the querying of Interpol SLTD and TDAWN databases through ETIAS, including information on the number of hits against those Interpol databases, the number of travel authorisations refused following such hits and information on any problems encountered, as well as, if appropriate, an assessment of the need for a legislative proposal amending this Regulation; (b) the results achieved by ETIAS having regard to its objectives, mandate and tasks; (c) the impact, effectiveness and efficiency of ETIAS’ performance and its working practices in light of its objectives, mandate and tasks; (d) an assessment of the security of ETIAS; (e) the ETIAS screening rules used for the purpose of risk assessment; (f) the impact of the ETIAS watchlist including the number of travel authorisation applications which were refused for reasons that took into account a positive hit against the ETIAS watchlist; (g) the possible need to modify the mandate of the ETIAS Central Unit and the financial implications of any such modification; (h) the impact on fundamental rights; (i) the impact on diplomatic relations between the Union and the third countries involved; (j) the revenue generated through the travel authorisation fee, the costs incurred in connection with the development of ETIAS, the costs for the operation of ETIAS, the costs incurred by eu-LISA, Europol and the European Border and Coast Guard Agency in relation to their tasks pursuant to this Regulation, as well as any revenue allocated in accordance with Article 86; (k) the use of ETIAS for law enforcement purposes on the basis of the information referred to in paragraph 8 of this Article; (l) the number of applicants being invited for an interview and the percentage it represents of the total number of applicants, the reasons for requesting an interview, the number of remote interviews, the number of decisions where the travel authorisation has been granted, has been granted with a flag or has been refused, and the number of applicants invited to an interview who did not attend it, and if appropriate, an assessment of the need for a legislative proposal amending this Regulation. The Commission shall transmit the evaluation report to the European Parliament, the Council, the European Data Protection Supervisor and the European Agency for Fundamental Rights. 5a. One year after the end of the transition period referred to in Article 83(1), and every four years thereafter, the Commission shall evaluate the querying of ECRIS-TCN through the ETIAS Central System. The Commission shall transmit those evaluations, together with the opinion of the ETIAS Fundamental Rights Guidance Board and any necessary recommendations, to the European Parliament and to the Council. In order to assess the extent to which the querying of ECRIS-TCN through the ETIAS Central System has contributed to the achievement of the objective of ETIAS, the evaluations referred to in the first subparagraph shall include the following: (a) a comparison of the number of simultaneous hits, for the same application, in ECRIS-TCN relating to convictions for terrorist offences as listed in the Annex to this Regulation and in SIS relating to alerts for refusal of entry and stay; (b) a comparison of the number of simultaneous hits, for the same application, in ECRIS-TCN relating to any other criminal offences as listed in the Annex to this Regulation and in SIS relating to alerts for refusal of entry and stay; (c) for applications where the only hit is in ECRIS-TCN, a comparison of the number of refusals of travel authorisations with the total number of hits reported by the query of ECRIS-TCN. The ETIAS Fundamental Rights Guidance Board shall provide opinions as regards the evaluations referred to in this paragraph. The evaluations may be accompanied, where necessary, by legislative proposals. 6. The Member States and Europol shall provide eu-LISA, the ETIAS Central Unit and the Commission with the information necessary to draft the reports referred to in paragraphs 4 and 5. This information shall not jeopardise working methods or include information that reveals sources, staff members or investigations of the designated authorities. 7. eu-LISA and the ETIAS Central Unit shall provide the Commission with the information necessary to produce the evaluations referred to in paragraph 5. 8. While respecting the provisions of national law on the publication of sensitive information, each Member State and Europol shall prepare annual reports on the effectiveness of access to data stored in the ETIAS Central System for law enforcement purposes containing information and statistics on: (a) the exact purpose of the consultation including the type of terrorist offence or other serious criminal offence; (b) reasonable grounds given for the substantiated suspicion that the suspect, perpetrator or victim is covered by this Regulation; (c) the number of requests for access to the ETIAS Central System for law enforcement purposes; (d) the number and type of cases which have resulted in hits; (e) the number and type of cases in which the urgency procedure referred to in Article 51(4) was used, including those cases where that urgency was not accepted by the ex post verification carried out by the central access point. A technical solution shall be made available to Member States in order to facilitate the collection of those data pursuant to Chapter X for the purpose of generating statistics referred to in this paragraph. The Commission shall, by means of implementing acts, adopt the specifications of the technical solution. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 90(2).
Article 93 Practical handbook
The Commission shall, in close cooperation with the Member States and the relevant Union agencies, make available a practical handbook, which shall contain guidelines, recommendations and best practices for the implementation of this Regulation. The practical handbook shall take into account relevant existing handbooks. The Commission shall adopt the practical handbook in the form of a recommendation.
Article 94 Ceuta and Melilla
This Regulation shall not affect the special rules applying to the cities of Ceuta and Melilla, as defined in the Declaration of the Kingdom of Spain on the cities of Ceuta and Melilla in the Final Act to the Agreement on the Accession of the Kingdom of Spain to the Convention implementing the Schengen Agreement of 14 June 1985.
Article 95 Financial contribution of the countries associated with the implementation, application and development of the Schengen acquis
Under the relevant provisions of their association agreements, arrangements shall be made in relation to the financial contributions of the countries associated with the implementation, application and development of the Schengen acquis .
Article 96 Entry into force and applicability
This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union . The provisions relating to the consultation of Eurodac shall apply from the date the recast of Regulation (EU) No 603/2013 of the European Parliament and of the Council ( 14 ) becomes applicable. This Regulation shall be binding in its entirety and directly applicable in the Member States in accordance with the Treaties.
Amendment rationale: CONTEXT OF THE PROPOSAL Reasons for and objectives of the proposal In September 2018, the Council and the European Parliament adopted two legislative acts, a Regulation establishing the European Travel Information and Authorisation System (‘ETIAS’) 1 and an amendment of the Europol Regulation for the purpose of establishing ETIAS 2 . Establishing ETIAS is among efforts undertaken in recent years at EU level to enhance the security of citizens and prevent irregular migration in an open Europe, securing and continuing to strengthen the management of external borders 3 , 4 . The context and the establishment of the system were announced in the 2016 State of the Union speech. President Juncker said: ‘ We will defend our borders […] with strict controls […] on everyone crossing them. Every time someone enters or exits the EU, there will be a record of when, where and why. In November [2016] we will propose a European travel information and authorisation system – an automated system to determine who will be allowed to travel to Europe. That way we will know who is travelling to Europe before they even get here ” . ETIAS will fill the information gap on travellers exempt from the requirement of being in possession of a visa when crossing the external borders. ETIAS will determine the eligibility of visa-exempt third-country nationals prior to their travel to the Schengen Area and whether such travel poses a security, irregular migration or high epidemic risk. ETIAS will also give travellers confidence that they would be able to cross the borders smoothly. If needed, ETIAS travel authorisation could be denied by ETIAS National Units. The assessment of such risks will involve automated processing of personal data provided in the applications for travel authorisation. The ETIAS Regulation establishes that personal data in the applications will be compared with the data present in records, files or alerts registered in EU information systems or databases (the ETIAS Central System, Schengen Information System (‘SIS’), the Visa Information System (‘VIS’), the Entry/Exit System ‘(EES’) or Eurodac), in Europol data or in the Interpol databases (the Interpol Stolen and Lost Travel Document database (‘SLTD’) or the Interpol Travel Documents Associated with Notices database (‘TDAWN’)) 5 . While the Regulation defines in its Article 20 which group of data from the ETIAS application files can be used to consult the other systems, not all those data are collected or recorded in the same way in the other EU information systems and Europol data. For instance in one of the systems, ‘country of issue of the travel document’ is collected while in another the same data is recorded in another way, e.g. as ‘three letter code of the issuing country of the travel document’. In other instances, a category of data is collected in one system but not in the other. For instance, ‘first names of parents of applicants’ are collected by ETIAS, but not in most of the other systems to be queried by ETIAS. Also at the time the ETIAS proposal 6 was adopted, the situation as regards the different EU information systems to be queried by ETIAS was different from today. At the time the ETIAS proposal was adopted, two other new EU information technology systems had been proposed to be set up: discussions were ongoing on the EES Regulation 7 while the Commission’s proposal on the European Criminal Records Information System – Third Country Nationals (‘ECRIS-TCN’) 8 was just about to be proposed. As regards existing information systems, the legal texts of the SIS were evolving due to the proposed revisions to the SIS legal framework in December 2016, finally adopted by co-legislators in November 2018 9 . The recast of the Eurodac Regulation 10 had also been proposed by the Commission as part of the reform of the Common European Asylum System, but had not yet been adopted by co-legislators 11 . The recast Eurodac Regulation still remains to be adopted by co-legislators today. Based on these considerations, the ETIAS Regulation stipulates, in its Article 11(2) that: “The amendments to the legal acts establishing the EU information systems that are necessary for establishing their interoperability with ETIAS as well as the addition of corresponding provisions in this Regulation shall be the subject of a separate legal instrument”. The present proposal therefore aims to set out the technical amendments necessary to fully set up the ETIAS system by amending the legal acts of the EU information technology systems ETIAS queries. The present proposal also sets out coresponding provisions and amends the ETIAS Regulation accordingly. First, the present initiative sets out amendments to the Regulation on ECRIS-TCN, on which recently, an ‘agreement in principle’ was found by the co-legislators. Thus, in line with the intention expressed by co-legislators in the ETIAS Regulation 12 it is now possible to include in ETIAS the necessary provisions on the relationship between ETIAS and ECRIS-TCN and to amend ECRIS-TCN accordingly. Secondly, the present initiative also aims to establish the relations between ETIAS and the SIS. The revised SIS legal framework has been adopted in November 2018. The present proposal includes consequential amendments resulting from the adoption of the new SIS Regulations. In line with the new SIS legal framework it is proposed to include the new alert category on inquiry checks 13 for the assessment of applications. It is not proposed to include the alert category on return decisions as such alerts are erased at the moment a return decision is implemented. This means that persons that apply for an ETIAS authorisation after having left the EU will – by definition – not have a return record in the SIS. Thirdly, the present initiative seeks to amend the EES Regulation to establish technically its relationship with ETIAS. Fourthly, the initiative also aims at amending the VIS Regulation in order to allow VIS to receive, process and answer ETIAS queries. Although in May 2018, the Commission presented a proposal to amend the VIS Regulation in order to upgrade that database, the present initiative puts forward amendments to the VIS Regulation currently in force, as the negotiations on the proposal for the upgraded VIS are not sufficiently advanced. However, if the proposal to amend the VIS Regulation were to be adopted first, it could become necessary to introduce some technical changes in the present proposal to align it with the amended version of the VIS Regulation. If the present proposal is adopted first, some technical changes could be required in the proposal amending the VIS Regulation before its adoption. In addition, following the adoption of both the EES Regulation and ETIAS Regulation, it is now required to align the way EES and ETIAS are working together on the way EES and VIS are integrated for the purpose of border control process and registration of border crossings in EES. This will rationalise and simplify the work of border guards through the implementation of a more uniform border control process for all third-country national entering for a short stay. The present initiative however does not include the amendments related to Eurodac, the EU asylum and irregular migration database, given that discussions have not yet been concluded on the May 2016 legislative proposal to strengthen Eurodac 14 . Furthermore, the data available in the current Eurodac are not sufficient for ETIAS purposes, given that the existing Eurodac only stores biometric data and a reference number, but no other personal data (e.g. name(s), age, date of birth) that would allow for contributing to the objectives of ETIAS. The May 2016 legislative proposal for a recast Eurodac Regulation seeks to extend the purpose of the database to the identification of illegally staying third-country nationals and those who have entered the EU irregularly. In particular, it provides for the storage of personal data such as the name(s), age, date of birth, nationality, and identity documents. These identity data are essential to ensure that Eurodac will be able to contribute to the objectives of ETIAS. Once the co-legislators reach political agreement on the recast Eurodac Regulation, the recast Eurodac Regulation will need to be supplemented with the necessary amendments to connect Eurodac to ETIAS. Additionally, once the co-legislators adopt the Commission’s legislative proposals 15 for the interoperability of information systems for security, border and migration management, and following political agreement on the proposal for a recast Eurodac Regulation, the Commission will apply the same approach with regards to the necessary amendments to make Eurodac part of the interoperability of information systems . Finally, in line with the April 2016 Communication on "Smarter Information Systems for borders and security", ETIAS is to be built based on a re-use of hardware and software components developed for the EES 16 . This is also the approach followed by the legislative proposals on the interoperability of information systems 17 . The technical development of the common identity repository and the European search portal as foreseen by the legislative proposals on the interoperability of information systems would be developed on the basis of the EES/ETIAS components. This proposal therefore presents amendments to the ETIAS Regulation to specify that the ETIAS Central System would build upon the EES Central System’s hardware and software components in order to establish a shared identity repository for the storage of the identity alphanumeric data of both ETIAS applicants and third-country nationals registered in EES. This shared identity repository would be the basis for the implementation of the common identity repository once the co-legislators adopt the legislative proposals on the interoperability of information systems. Moreover, during a transitional period, before the European search portal is available, the automated processing of ETIAS applications would rely on a tool, which would be used as the basis for the development and implementation of the European search portal. Due to the variable geometry in Member States' participation in EU policies in the area of freedom, security and justice, it is necessary to adopt two separate legal instruments which will nonetheless work seamlessly together to enable the comprehensive operation and use of the system. 
Revised version (Article 96 Entry into force and applicability):
This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union . Article 11b shall apply from 3 August 2021. The provisions relating to the consultation of Eurodac shall apply from the date the recast of Regulation (EU) No 603/2013 of the European Parliament and of the Council ( 21 ) becomes applicable. This Regulation shall be binding in its entirety and directly applicable in the Member States in accordance with the Treaties.