Article 62 Amendments to Regulation (EU) No 1077/2011
Regulation (EU) No 1077/2011 is amended as follows: (1) in Article 1, paragraph 2 is replaced by the following: ‘2. The Agency shall be responsible for the operational management of the second-generation Schengen Information System (SIS II), the Visa Information System (VIS), Eurodac and the Entry/Exit System established by Regulation (EU) 2017/2226 of the European Parliament and of the Council ( *5 ) (EES). (2) the following Article is inserted: 
‘Article 5a
Tasks relating to the EES
In relation to the EES, the Agency shall perform:
(a) the tasks conferred on it by Regulation (EU) 2017/2226;
(a) the tasks conferred on it by Regulation (EU) 2017/2226;
(b) tasks relating to training on the technical use of the EES.’;
(b) tasks relating to training on the technical use of the EES.’;
(3) in Article 7, paragraphs 5 and 6 are replaced by the following:
(3) in Article 7, paragraphs 5 and 6 are replaced by the following:
‘5. Tasks related to the operational management of the communication infrastructure may be entrusted to external private-sector entities or bodies in accordance with Regulation (EU, Euratom) No 966/2012 of the European Parliament and of the Council ( *6 ). In such a case, the network provider shall be bound by the security measures referred to in paragraph 4 of this Article and shall have no access to SIS II, VIS, Eurodac or EES operational data, or to the SIS II-related SIRENE exchange, by any means.
6. Without prejudice to the existing contracts on the network of SIS II, VIS, Eurodac and EES, the management of encryption keys shall remain within the competence of the Agency and shall not be outsourced to any external private-sector entity.
(4) in Article 8, paragraph 1 is replaced by the following:
(4) in Article 8, paragraph 1 is replaced by the following:
‘1. The Agency shall monitor the developments in research relevant for the operational management of SIS II, VIS, Eurodac, EES and other large-scale IT systems.’;
(5) in Article 12, paragraph 1 is amended as follows:
(5) in Article 12, paragraph 1 is amended as follows:
(a) the following point is inserted:
(a) the following point is inserted:
‘(sa) adopt the reports on the development of the EES pursuant to Article 72(2) of Regulation (EU) 2017/2226;’;
‘(sa) adopt the reports on the development of the EES pursuant to Article 72(2) of Regulation (EU) 2017/2226;’;
(b) point (t) is replaced by the following:
(b) point (t) is replaced by the following:
‘(t) adopt the reports on the technical functioning of SIS II pursuant to Article 50(4) of Regulation (EC) No 1987/2006 and Article 66(4) of Decision 2007/533/JHA, of VIS pursuant to Article 50(3) of Regulation (EC) No 767/2008 and Article 17(3) of Decision 2008/633/JHA and of EES pursuant to Article 72(4) of Regulation (EU) 2017/2226;’;
‘(t) adopt the reports on the technical functioning of SIS II pursuant to Article 50(4) of Regulation (EC) No 1987/2006 and Article 66(4) of Decision 2007/533/JHA, of VIS pursuant to Article 50(3) of Regulation (EC) No 767/2008 and Article 17(3) of Decision 2008/633/JHA and of EES pursuant to Article 72(4) of Regulation (EU) 2017/2226;’;
(c) point (v) is replaced by the following:
(c) point (v) is replaced by the following:
‘(v) make comments on the European Data Protection Supervisor’s reports on the audits pursuant to Article 45(2) of Regulation (EC) No 1987/2006, Article 42(2) of Regulation (EC) No 767/2008, Article 31(2) of Regulation (EU) No 603/2013 and Article 56(2) of Regulation (EU) 2017/2226 and ensure appropriate follow-up to those audits;’;
‘(v) make comments on the European Data Protection Supervisor’s reports on the audits pursuant to Article 45(2) of Regulation (EC) No 1987/2006, Article 42(2) of Regulation (EC) No 767/2008, Article 31(2) of Regulation (EU) No 603/2013 and Article 56(2) of Regulation (EU) 2017/2226 and ensure appropriate follow-up to those audits;’;
(d) the following point is inserted:
(d) the following point is inserted:
‘(xa) publish statistics related to the EES pursuant to Article 63 of Regulation (EU) 2017/2226;’;
‘(xa) publish statistics related to the EES pursuant to Article 63 of Regulation (EU) 2017/2226;’;
(e) the following point is inserted:
(e) the following point is inserted:
‘(za) ensure annual publication of the list of competent authorities pursuant to Article 65(2) of Regulation (EU) 2017/2226;’;
‘(za) ensure annual publication of the list of competent authorities pursuant to Article 65(2) of Regulation (EU) 2017/2226;’;
(6) in Article 15, paragraph 4 is replaced by the following:
(6) in Article 15, paragraph 4 is replaced by the following:
‘4. Europol and Eurojust may attend the meetings of the Management Board as observers when a question concerning SIS II, in relation to the application of Decision 2007/533/JHA, is on the agenda. Europol may also attend the meetings of the Management Board as an observer when a question concerning VIS, in relation to the application of Decision 2008/633/JHA, a question concerning Eurodac, in relation to the application of Regulation (EU) No 603/2013, or a question concerning the EES, in relation to the application of Regulation (EU) 2017/2226, is on the agenda.’;
(7) Article 17 is amended as follows:
(7) Article 17 is amended as follows:
(a) in paragraph 5, point (g) is replaced by the following:
(a) in paragraph 5, point (g) is replaced by the following:
‘(g) without prejudice to Article 17 of the Staff Regulations, establish confidentiality requirements in order to comply with Article 17 of Regulation (EC) No 1987/2006, Article 17 of Decision 2007/533/JHA, Article 26(9) of Regulation (EC) No 767/2008, Article 4(4) of Regulation (EU) No 603/2013 and Article 37(4) of Regulation (EU) 2017/2226;’;
‘(g) without prejudice to Article 17 of the Staff Regulations, establish confidentiality requirements in order to comply with Article 17 of Regulation (EC) No 1987/2006, Article 17 of Decision 2007/533/JHA, Article 26(9) of Regulation (EC) No 767/2008, Article 4(4) of Regulation (EU) No 603/2013 and Article 37(4) of Regulation (EU) 2017/2226;’;
(b) in paragraph 6, the following point is added:
(b) in paragraph 6, the following point is added:
‘(k) reports on the state of play of the development of the EES referred to in Article 72(2) of Regulation (EU) 2017/2226.’;
‘(k) reports on the state of play of the development of the EES referred to in Article 72(2) of Regulation (EU) 2017/2226.’;
(8) Article 19 is amended as follows:
(8) Article 19 is amended as follows:
(a) in paragraph 1, the following point is inserted:
(a) in paragraph 1, the following point is inserted:
‘(da) EES Advisory Group;’;
‘(da) EES Advisory Group;’;
(b) paragraph 3 is replaced by the following:
(b) paragraph 3 is replaced by the following:
‘Europol and Eurojust may each appoint a representative to the SIS II Advisory Group. Europol may also appoint a representative to the VIS, Eurodac and EES Advisory Groups.’.
FINAL PROVISIONS
Amendment rationale: CONTEXT OF THE PROPOSAL Reasons for and objectives of the proposal In September 2018, the Council and the European Parliament adopted two legislative acts, a Regulation establishing the European Travel Information and Authorisation System (‘ETIAS’) 1 and an amendment of the Europol Regulation for the purpose of establishing ETIAS 2 . Establishing ETIAS is among efforts undertaken in recent years at EU level to enhance the security of citizens and prevent irregular migration in an open Europe, securing and continuing to strengthen the management of external borders 3 , 4 . The context and the establishment of the system were announced in the 2016 State of the Union speech. President Juncker said: ‘ We will defend our borders […] with strict controls […] on everyone crossing them. Every time someone enters or exits the EU, there will be a record of when, where and why. In November [2016] we will propose a European travel information and authorisation system – an automated system to determine who will be allowed to travel to Europe. That way we will know who is travelling to Europe before they even get here ” . ETIAS will fill the information gap on travellers exempt from the requirement of being in possession of a visa when crossing the external borders. ETIAS will determine the eligibility of visa-exempt third-country nationals prior to their travel to the Schengen Area and whether such travel poses a security, irregular migration or high epidemic risk. ETIAS will also give travellers confidence that they would be able to cross the borders smoothly. If needed, ETIAS travel authorisation could be denied by ETIAS National Units. The assessment of such risks will involve automated processing of personal data provided in the applications for travel authorisation. The ETIAS Regulation establishes that personal data in the applications will be compared with the data present in records, files or alerts registered in EU information systems or databases (the ETIAS Central System, Schengen Information System (‘SIS’), the Visa Information System (‘VIS’), the Entry/Exit System ‘(EES’) or Eurodac), in Europol data or in the Interpol databases (the Interpol Stolen and Lost Travel Document database (‘SLTD’) or the Interpol Travel Documents Associated with Notices database (‘TDAWN’)) 5 . While the Regulation defines in its Article 20 which group of data from the ETIAS application files can be used to consult the other systems, not all those data are collected or recorded in the same way in the other EU information systems and Europol data. For instance in one of the systems, ‘country of issue of the travel document’ is collected while in another the same data is recorded in another way, e.g. as ‘three letter code of the issuing country of the travel document’. In other instances, a category of data is collected in one system but not in the other. For instance, ‘first names of parents of applicants’ are collected by ETIAS, but not in most of the other systems to be queried by ETIAS. Also at the time the ETIAS proposal 6 was adopted, the situation as regards the different EU information systems to be queried by ETIAS was different from today. At the time the ETIAS proposal was adopted, two other new EU information technology systems had been proposed to be set up: discussions were ongoing on the EES Regulation 7 while the Commission’s proposal on the European Criminal Records Information System – Third Country Nationals (‘ECRIS-TCN’) 8 was just about to be proposed. As regards existing information systems, the legal texts of the SIS were evolving due to the proposed revisions to the SIS legal framework in December 2016, finally adopted by co-legislators in November 2018 9 . The recast of the Eurodac Regulation 10 had also been proposed by the Commission as part of the reform of the Common European Asylum System, but had not yet been adopted by co-legislators 11 . The recast Eurodac Regulation still remains to be adopted by co-legislators today. Based on these considerations, the ETIAS Regulation stipulates, in its Article 11(2) that: “The amendments to the legal acts establishing the EU information systems that are necessary for establishing their interoperability with ETIAS as well as the addition of corresponding provisions in this Regulation shall be the subject of a separate legal instrument”. The present proposal therefore aims to set out the technical amendments necessary to fully set up the ETIAS system by amending the legal acts of the EU information technology systems ETIAS queries. The present proposal also sets out coresponding provisions and amends the ETIAS Regulation accordingly. First, the present initiative sets out amendments to the Regulation on ECRIS-TCN, on which recently, an ‘agreement in principle’ was found by the co-legislators. Thus, in line with the intention expressed by co-legislators in the ETIAS Regulation 12 it is now possible to include in ETIAS the necessary provisions on the relationship between ETIAS and ECRIS-TCN and to amend ECRIS-TCN accordingly. Secondly, the present initiative also aims to establish the relations between ETIAS and the SIS. The revised SIS legal framework has been adopted in November 2018. The present proposal includes consequential amendments resulting from the adoption of the new SIS Regulations. In line with the new SIS legal framework it is proposed to include the new alert category on inquiry checks 13 for the assessment of applications. It is not proposed to include the alert category on return decisions as such alerts are erased at the moment a return decision is implemented. This means that persons that apply for an ETIAS authorisation after having left the EU will – by definition – not have a return record in the SIS. Thirdly, the present initiative seeks to amend the EES Regulation to establish technically its relationship with ETIAS. Fourthly, the initiative also aims at amending the VIS Regulation in order to allow VIS to receive, process and answer ETIAS queries. Although in May 2018, the Commission presented a proposal to amend the VIS Regulation in order to upgrade that database, the present initiative puts forward amendments to the VIS Regulation currently in force, as the negotiations on the proposal for the upgraded VIS are not sufficiently advanced. However, if the proposal to amend the VIS Regulation were to be adopted first, it could become necessary to introduce some technical changes in the present proposal to align it with the amended version of the VIS Regulation. If the present proposal is adopted first, some technical changes could be required in the proposal amending the VIS Regulation before its adoption. In addition, following the adoption of both the EES Regulation and ETIAS Regulation, it is now required to align the way EES and ETIAS are working together on the way EES and VIS are integrated for the purpose of border control process and registration of border crossings in EES. This will rationalise and simplify the work of border guards through the implementation of a more uniform border control process for all third-country national entering for a short stay. The present initiative however does not include the amendments related to Eurodac, the EU asylum and irregular migration database, given that discussions have not yet been concluded on the May 2016 legislative proposal to strengthen Eurodac 14 . Furthermore, the data available in the current Eurodac are not sufficient for ETIAS purposes, given that the existing Eurodac only stores biometric data and a reference number, but no other personal data (e.g. name(s), age, date of birth) that would allow for contributing to the objectives of ETIAS. The May 2016 legislative proposal for a recast Eurodac Regulation seeks to extend the purpose of the database to the identification of illegally staying third-country nationals and those who have entered the EU irregularly. In particular, it provides for the storage of personal data such as the name(s), age, date of birth, nationality, and identity documents. These identity data are essential to ensure that Eurodac will be able to contribute to the objectives of ETIAS. Once the co-legislators reach political agreement on the recast Eurodac Regulation, the recast Eurodac Regulation will need to be supplemented with the necessary amendments to connect Eurodac to ETIAS. Additionally, once the co-legislators adopt the Commission’s legislative proposals 15 for the interoperability of information systems for security, border and migration management, and following political agreement on the proposal for a recast Eurodac Regulation, the Commission will apply the same approach with regards to the necessary amendments to make Eurodac part of the interoperability of information systems . Finally, in line with the April 2016 Communication on "Smarter Information Systems for borders and security", ETIAS is to be built based on a re-use of hardware and software components developed for the EES 16 . This is also the approach followed by the legislative proposals on the interoperability of information systems 17 . The technical development of the common identity repository and the European search portal as foreseen by the legislative proposals on the interoperability of information systems would be developed on the basis of the EES/ETIAS components. This proposal therefore presents amendments to the ETIAS Regulation to specify that the ETIAS Central System would build upon the EES Central System’s hardware and software components in order to establish a shared identity repository for the storage of the identity alphanumeric data of both ETIAS applicants and third-country nationals registered in EES. This shared identity repository would be the basis for the implementation of the common identity repository once the co-legislators adopt the legislative proposals on the interoperability of information systems. Moreover, during a transitional period, before the European search portal is available, the automated processing of ETIAS applications would rely on a tool, which would be used as the basis for the development and implementation of the European search portal. Due to the variable geometry in Member States' participation in EU policies in the area of freedom, security and justice, it is necessary to adopt two separate legal instruments which will nonetheless work seamlessly together to enable the comprehensive operation and use of the system. 
Revised version (Article 62 Amendments to Regulation (EU) No 1077/2011):
Regulation (EU) No 1077/2011 is amended as follows: in Article 1, paragraph 2 is replaced by the following: the following Article is inserted: 
‘Article 5a
Tasks relating to the EES
In relation to the EES, the Agency shall perform:
(a) the tasks conferred on it by Regulation (EU) 2017/2226;
(a)
the tasks conferred on it by Regulation (EU) 2017/2226;
the tasks conferred on it by Regulation (EU) 2017/2226;
(b) tasks relating to training on the technical use of the EES.’;
(b)
tasks relating to training on the technical use of the EES.’;
tasks relating to training on the technical use of the EES.’; (3) in Article 7, paragraphs 5 and 6 are replaced by the following: ‘5. Tasks related to the operational management of the communication infrastructure may be entrusted to external private-sector entities or bodies in accordance with Regulation (EU, Euratom) No 966/2012 of the European Parliament and of the Council ( *6 ). In such a case, the network provider shall be bound by the security measures referred to in paragraph 4 of this Article and shall have no access to SIS II, VIS, Eurodac or EES operational data, or to the SIS II-related SIRENE exchange, by any means. 6. Without prejudice to the existing contracts on the network of SIS II, VIS, Eurodac and EES, the management of encryption keys shall remain within the competence of the Agency and shall not be outsourced to any external private-sector entity. in Article 7, paragraphs 5 and 6 are replaced by the following: ‘5. Tasks related to the operational management of the communication infrastructure may be entrusted to external private-sector entities or bodies in accordance with Regulation (EU, Euratom) No 966/2012 of the European Parliament and of the Council ( *6 ). In such a case, the network provider shall be bound by the security measures referred to in paragraph 4 of this Article and shall have no access to SIS II, VIS, Eurodac or EES operational data, or to the SIS II-related SIRENE exchange, by any means. 6. Without prejudice to the existing contracts on the network of SIS II, VIS, Eurodac and EES, the management of encryption keys shall remain within the competence of the Agency and shall not be outsourced to any external private-sector entity. in Article 8, paragraph 1 is replaced by the following: ‘1. The Agency shall monitor the developments in research relevant for the operational management of SIS II, VIS, Eurodac, EES and other large-scale IT systems.’; in Article 12, paragraph 1 is amended as follows: the following point is inserted: ‘(sa) adopt the reports on the development of the EES pursuant to Article 72(2) of Regulation (EU) 2017/2226;’; point (t) is replaced by the following: ‘(t) point (v) is replaced by the following: ‘(v) ‘(xa) publish statistics related to the EES pursuant to Article 63 of Regulation (EU) 2017/2226;’; ‘(xa) ‘(za) ensure annual publication of the list of competent authorities pursuant to Article 65(2) of Regulation (EU) 2017/2226;’; in Article 15, paragraph 4 is replaced by the following: ‘4. Europol and Eurojust may attend the meetings of the Management Board as observers when a question concerning SIS II, in relation to the application of Decision 2007/533/JHA, is on the agenda. Europol may also attend the meetings of the Management Board as an observer when a question concerning VIS, in relation to the application of Decision 2008/633/JHA, a question concerning Eurodac, in relation to the application of Regulation (EU) No 603/2013, or a question concerning the EES, in relation to the application of Regulation (EU) 2017/2226, is on the agenda.’; Article 17 is amended as follows: in paragraph 5, point (g) is replaced by the following: ‘(g) in paragraph 6, the following point is added: ‘(k) reports on the state of play of the development of the EES referred to in Article 72(2) of Regulation (EU) 2017/2226.’; Article 19 is amended as follows: in paragraph 1, the following point is inserted: ‘(da) EES Advisory Group;’; ‘(da) paragraph 3 is replaced by the following: ‘Europol and Eurojust may each appoint a representative to the SIS II Advisory Group. Europol may also appoint a representative to the VIS, Eurodac and EES Advisory Groups.’.
Article 63 Use of data for reporting and statistics
1. The duly authorised staff of the competent authorities of Member States, the Commission and eu-LISA shall have access to consult the following data, solely for the purposes of reporting and statistics without allowing for individual identification and in accordance with the safeguards related to non-discrimination referred to in Article 10(2): (a) status information; (b) nationality, sex and year of birth of the third-country national; (c) date and border crossing point of the entry to a Member State and date and border crossing point of the exit from a Member State; (d) the type of the travel document and the three letter code of the issuing country; (e) the number of persons identified as overstayers referred to in Article 12, the nationalities of persons identified as overstayers and the border crossing point of entry; (f) the data entered in respect of any stay revoked or any stay whose validity is extended; (g) the three letter code of the Member State that issued the visa, if applicable; (h) the number of persons exempt from the requirement to give fingerprints pursuant to Article 17(3) and (4); (i) the number of third-country nationals refused entry, the nationalities of third-country nationals refused entry, the type of border (land, air or sea) of the border crossing point at which entry was refused and the reasons for which entry has been refused as referred to in point (d) of Article 18(6). The duly authorised staff of the European Border and Coast Guard Agency established by Regulation (EU) 2016/1624 of the European Parliament and of the Council ( 14 ) shall have access to consult the data referred to in the first subparagraph of this paragraph for the purpose of carrying out risk analyses and vulnerability assessments as referred to in Articles 11 and 13 of that Regulation. 2. For the purpose of paragraph 1 of this Article, eu-LISA shall store the data referred to in that paragraph in the central repository for reporting and statistics referred to in Article 39 of the Regulation (EU) 2019/817. 3. The procedures put in place by eu-LISA to monitor the development and the functioning of the EES referred to in Article 72(1) shall include the possibility to produce regular statistics for ensuring that monitoring. 4. Every quarter, eu-LISA shall publish statistics on the EES showing in particular the number, nationality, age, sex, duration of stay and border crossing point of entry of overstayers, of third-country nationals who were refused entry, including the grounds for refusal, and of third-country nationals whose authorisation for stay was revoked or extended, as well as the number of third-country nationals exempt from the requirement to give fingerprints. The daily statistics shall be stored in the central repository for reporting and statistics. 5. At the end of each year, statistical data shall be compiled in an annual report for that year. The statistics shall contain a breakdown of data for each Member State. The report shall be published and transmitted to the European Parliament, to the Council, to the Commission, to the European Border and Coast Guard Agency, to the European Data Protection Supervisor and to the national supervisory authorities. 6. At the request of the Commission, eu-LISA shall provide it with statistics on specific aspects related to the implementation of this Regulation as well as the statistics pursuant to paragraph 3.
Article 64 Costs
1. The costs incurred in connection with the establishment and operation of the EES Central System, the Communication Infrastructure, the NUI, the web service and the data repository referred to in Article 63(2) shall be borne by the general budget of the Union. 2. Costs incurred in connection with the integration of the existing national border infrastructure and its connection to the NUI as well as in connection with hosting the NUI shall be borne by the general budget of the Union. The following costs shall be excluded: (a) Member States’ project management office (meetings, missions, offices); (b) hosting of national IT systems (space, implementation, electricity, cooling); (c) operation of national IT systems (operators and support contracts); (d) customisation of existing border checks and policing systems for national entry-exit systems; (e) project management of national entry-exit systems; (f) design, development, implementation, operation and maintenance of national communication networks; (g) automated border control systems, self-service systems and e-gates. 3. The costs incurred by the central access points referred to in Articles 29 and 30 shall be borne, respectively, by each Member State and Europol. The costs for the connection of those central access points to the NUI and to the EES shall be borne by each Member State and Europol, respectively. 4. Each Member State and Europol shall set up and maintain at their expense the technical infrastructure necessary to implement Chapter IV and shall be responsible for bearing the costs resulting from access to the EES for that purpose. 5. Funding to be mobilised from the envelope referred to in point (b) of Article 5(5) of Regulation (EU) No 515/2014 to cover the costs referred to in paragraphs 1 to 4 of this Article shall be implemented under indirect management for the costs incurred by eu-LISA and under shared management for the costs incurred by the Member States.
Article 65 Notifications
1. Member States shall notify the Commission of the authority which is to be considered as controller as referred to in Article 39. 2. Member States shall notify the Commission and eu-LISA of the competent authorities referred to in Article 9(2) which have access to enter, rectify, complete, erase, consult or search data. Three months after the EES has started operations in accordance with Article 66, eu-LISA shall publish a consolidated list of those authorities in the Official Journal of the European Union . Member States shall also notify without delay any changes thereto. In the event of such changes, eu-LISA shall publish once a year an updated consolidated version of that information. 3. Member States shall notify the Commission and eu-LISA of their designated authorities and of their central access points referred to in Article 29 and shall notify without delay any amendments thereto. 4. Europol shall notify the Commission and eu-LISA of the authority it designates and its central access point referred to in Article 30 and shall notify without delay any amendments thereto. 5. eu-LISA shall notify the Commission of the successful completion of the test referred to in point (b) of Article 66(1). 6. The Commission shall publish the information referred to in paragraphs 1, 3 and 4 in the Official Journal of the European Union . In the event of changes thereto, the Commission shall publish once a year an updated consolidated version of that information. The Commission shall maintain a continuously updated public website containing that information.
Article 66 Start of operations
1. The Commission shall decide the date from which the EES is to start operations, after the following conditions are met: (a) the measures referred to in Article 36 and Article 50(4) and (5) have been adopted; (b) eu-LISA has declared the successful completion of a comprehensive test of the EES, which is to be conducted by eu-LISA in cooperation with the Member States; (c) the Member States have validated the technical and legal arrangements to collect and transmit the data referred to in Articles 16 to 20 to the EES and have notified them to the Commission; (d) the Member States have notified the Commission as referred to in Article 65(1), (2) and (3). 2. The EES shall be operated by: (a) the Member States which apply the Schengen acquis in full; and (b) the Member States which do not yet apply the Schengen acquis in full but for which all the following conditions are met: (i) the verification in accordance with applicable Schengen evaluation procedures has been successfully completed; (ii) the provisions of the Schengen acquis relating to the SIS have been put into effect in accordance with the relevant Act of Accession; and (iii) the provisions of the Schengen acquis relating to the VIS which are necessary for the operation of the EES as defined in this Regulation have been put into effect in accordance with the relevant Act of Accession. 3. A Member State which is not covered by paragraph 2 shall be connected to the EES as soon as the conditions referred to in points (b), (c) and (d) of paragraph 1 and point (b) of paragraph 2 are met. The Commission shall decide the date from which the EES is to start its operations in those Member States. 4. The Commission shall inform the European Parliament and the Council of the results of the test carried out pursuant to point (b) of paragraph 1. 5. The Commission decision referred to in paragraphs 1 and 3 shall be published in the Official Journal of the European Union . 6. The Member States and Europol shall start using the EES from the date determined by the Commission in accordance with paragraph 1 or, where applicable, with paragraph 3.
Amendment rationale: CONTEXT OF THE PROPOSAL Reasons for and objectives of the proposal In September 2018, the Council and the European Parliament adopted two legislative acts, a Regulation establishing the European Travel Information and Authorisation System (‘ETIAS’) 1 and an amendment of the Europol Regulation for the purpose of establishing ETIAS 2 . Establishing ETIAS is among efforts undertaken in recent years at EU level to enhance the security of citizens and prevent irregular migration in an open Europe, securing and continuing to strengthen the management of external borders 3 , 4 . The context and the establishment of the system were announced in the 2016 State of the Union speech. President Juncker said: ‘ We will defend our borders […] with strict controls […] on everyone crossing them. Every time someone enters or exits the EU, there will be a record of when, where and why. In November [2016] we will propose a European travel information and authorisation system – an automated system to determine who will be allowed to travel to Europe. That way we will know who is travelling to Europe before they even get here ” . ETIAS will fill the information gap on travellers exempt from the requirement of being in possession of a visa when crossing the external borders. ETIAS will determine the eligibility of visa-exempt third-country nationals prior to their travel to the Schengen Area and whether such travel poses a security, irregular migration or high epidemic risk. ETIAS will also give travellers confidence that they would be able to cross the borders smoothly. If needed, ETIAS travel authorisation could be denied by ETIAS National Units. The assessment of such risks will involve automated processing of personal data provided in the applications for travel authorisation. The ETIAS Regulation establishes that personal data in the applications will be compared with the data present in records, files or alerts registered in EU information systems or databases (the ETIAS Central System, Schengen Information System (‘SIS’), the Visa Information System (‘VIS’), the Entry/Exit System ‘(EES’) or Eurodac), in Europol data or in the Interpol databases (the Interpol Stolen and Lost Travel Document database (‘SLTD’) or the Interpol Travel Documents Associated with Notices database (‘TDAWN’)) 5 . While the Regulation defines in its Article 20 which group of data from the ETIAS application files can be used to consult the other systems, not all those data are collected or recorded in the same way in the other EU information systems and Europol data. For instance in one of the systems, ‘country of issue of the travel document’ is collected while in another the same data is recorded in another way, e.g. as ‘three letter code of the issuing country of the travel document’. In other instances, a category of data is collected in one system but not in the other. For instance, ‘first names of parents of applicants’ are collected by ETIAS, but not in most of the other systems to be queried by ETIAS. Also at the time the ETIAS proposal 6 was adopted, the situation as regards the different EU information systems to be queried by ETIAS was different from today. At the time the ETIAS proposal was adopted, two other new EU information technology systems had been proposed to be set up: discussions were ongoing on the EES Regulation 7 while the Commission’s proposal on the European Criminal Records Information System – Third Country Nationals (‘ECRIS-TCN’) 8 was just about to be proposed. As regards existing information systems, the legal texts of the SIS were evolving due to the proposed revisions to the SIS legal framework in December 2016, finally adopted by co-legislators in November 2018 9 . The recast of the Eurodac Regulation 10 had also been proposed by the Commission as part of the reform of the Common European Asylum System, but had not yet been adopted by co-legislators 11 . The recast Eurodac Regulation still remains to be adopted by co-legislators today. Based on these considerations, the ETIAS Regulation stipulates, in its Article 11(2) that: “The amendments to the legal acts establishing the EU information systems that are necessary for establishing their interoperability with ETIAS as well as the addition of corresponding provisions in this Regulation shall be the subject of a separate legal instrument”. The present proposal therefore aims to set out the technical amendments necessary to fully set up the ETIAS system by amending the legal acts of the EU information technology systems ETIAS queries. The present proposal also sets out coresponding provisions and amends the ETIAS Regulation accordingly. First, the present initiative sets out amendments to the Regulation on ECRIS-TCN, on which recently, an ‘agreement in principle’ was found by the co-legislators. Thus, in line with the intention expressed by co-legislators in the ETIAS Regulation 12 it is now possible to include in ETIAS the necessary provisions on the relationship between ETIAS and ECRIS-TCN and to amend ECRIS-TCN accordingly. Secondly, the present initiative also aims to establish the relations between ETIAS and the SIS. The revised SIS legal framework has been adopted in November 2018. The present proposal includes consequential amendments resulting from the adoption of the new SIS Regulations. In line with the new SIS legal framework it is proposed to include the new alert category on inquiry checks 13 for the assessment of applications. It is not proposed to include the alert category on return decisions as such alerts are erased at the moment a return decision is implemented. This means that persons that apply for an ETIAS authorisation after having left the EU will – by definition – not have a return record in the SIS. Thirdly, the present initiative seeks to amend the EES Regulation to establish technically its relationship with ETIAS. Fourthly, the initiative also aims at amending the VIS Regulation in order to allow VIS to receive, process and answer ETIAS queries. Although in May 2018, the Commission presented a proposal to amend the VIS Regulation in order to upgrade that database, the present initiative puts forward amendments to the VIS Regulation currently in force, as the negotiations on the proposal for the upgraded VIS are not sufficiently advanced. However, if the proposal to amend the VIS Regulation were to be adopted first, it could become necessary to introduce some technical changes in the present proposal to align it with the amended version of the VIS Regulation. If the present proposal is adopted first, some technical changes could be required in the proposal amending the VIS Regulation before its adoption. In addition, following the adoption of both the EES Regulation and ETIAS Regulation, it is now required to align the way EES and ETIAS are working together on the way EES and VIS are integrated for the purpose of border control process and registration of border crossings in EES. This will rationalise and simplify the work of border guards through the implementation of a more uniform border control process for all third-country national entering for a short stay. The present initiative however does not include the amendments related to Eurodac, the EU asylum and irregular migration database, given that discussions have not yet been concluded on the May 2016 legislative proposal to strengthen Eurodac 14 . Furthermore, the data available in the current Eurodac are not sufficient for ETIAS purposes, given that the existing Eurodac only stores biometric data and a reference number, but no other personal data (e.g. name(s), age, date of birth) that would allow for contributing to the objectives of ETIAS. The May 2016 legislative proposal for a recast Eurodac Regulation seeks to extend the purpose of the database to the identification of illegally staying third-country nationals and those who have entered the EU irregularly. In particular, it provides for the storage of personal data such as the name(s), age, date of birth, nationality, and identity documents. These identity data are essential to ensure that Eurodac will be able to contribute to the objectives of ETIAS. Once the co-legislators reach political agreement on the recast Eurodac Regulation, the recast Eurodac Regulation will need to be supplemented with the necessary amendments to connect Eurodac to ETIAS. Additionally, once the co-legislators adopt the Commission’s legislative proposals 15 for the interoperability of information systems for security, border and migration management, and following political agreement on the proposal for a recast Eurodac Regulation, the Commission will apply the same approach with regards to the necessary amendments to make Eurodac part of the interoperability of information systems . Finally, in line with the April 2016 Communication on "Smarter Information Systems for borders and security", ETIAS is to be built based on a re-use of hardware and software components developed for the EES 16 . This is also the approach followed by the legislative proposals on the interoperability of information systems 17 . The technical development of the common identity repository and the European search portal as foreseen by the legislative proposals on the interoperability of information systems would be developed on the basis of the EES/ETIAS components. This proposal therefore presents amendments to the ETIAS Regulation to specify that the ETIAS Central System would build upon the EES Central System’s hardware and software components in order to establish a shared identity repository for the storage of the identity alphanumeric data of both ETIAS applicants and third-country nationals registered in EES. This shared identity repository would be the basis for the implementation of the common identity repository once the co-legislators adopt the legislative proposals on the interoperability of information systems. Moreover, during a transitional period, before the European search portal is available, the automated processing of ETIAS applications would rely on a tool, which would be used as the basis for the development and implementation of the European search portal. Due to the variable geometry in Member States' participation in EU policies in the area of freedom, security and justice, it is necessary to adopt two separate legal instruments which will nonetheless work seamlessly together to enable the comprehensive operation and use of the system. 
Revised version (Article 66 Start of operations):
The Commission shall decide the date from which the EES is to start operations, after the following conditions are met: the measures referred to in Article 36 and Article 50(4) and (5) have been adopted; (b) eu-LISA has declared the successful completion of a comprehensive test of the EES, which is to be conducted by eu-LISA in cooperation with the Member States; (c) the Member States have validated the technical and legal arrangements to collect and transmit the data referred to in Articles 16 to 20 to the EES and have notified them to the Commission; The EES shall be operated by: (a) the Member States which apply the Schengen acquis in full; and the Member States which do not yet apply the Schengen acquis in full but for which all the following conditions are met: (i) the verification in accordance with applicable Schengen evaluation procedures has been successfully completed; (ii) the provisions of the Schengen acquis relating to the SIS have been put into effect in accordance with the relevant Act of Accession; and (iii) the provisions of the Schengen acquis relating to the VIS which are necessary for the operation of the EES as defined in this Regulation have been put into effect in accordance with the relevant Act of Accession. 3. A Member State which is not covered by paragraph 2 shall be connected to the EES as soon as the conditions referred to in points (b), (c) and (d) of paragraph 1 and point (b) of paragraph 2 are met. The Commission shall decide the date from which the EES is to start its operations in those Member States. 4. The Commission shall inform the European Parliament and the Council of the results of the test carried out pursuant to point (b) of paragraph 1. 5. The Commission decision referred to in paragraphs 1 and 3 shall be published in the Official Journal of the European Union . 6. The Member States and Europol shall start using the EES from the date determined by the Commission in accordance with paragraph 1 or, where applicable, with paragraph 3.
Article 67 Ceuta and Melilla
This Regulation shall not affect the special rules applying to the cities of Ceuta and Melilla, as defined in the Declaration of the Kingdom of Spain on the cities of Ceuta and Melilla in the Final Act to the Agreement on the Accession of the Kingdom of Spain to the Convention implementing the Schengen Agreement of 14 June 1985.
Article 68 Committee procedure
1. The Commission shall be assisted by a committee. That committee shall be a committee within the meaning of Regulation (EU) No 182/2011. 2. Where reference is made to this paragraph, Article 5 of Regulation (EU) No 182/2011 shall apply.
Article 69 Advisory Group
An Advisory Group shall be established by eu-LISA in order to provide it with the expertise related to the EES, in particular in the context of the preparation of its annual work programme and its annual activity report. During the design and development phase of the EES, Article 37(2) shall apply.
Article 70 Training
eu-LISA shall perform tasks related to provision of training on the technical use of the EES in accordance with Regulation (EU) No 1077/2011.
Article 71 Practical handbook
The Commission shall, in close cooperation with the Member States, eu-LISA and other relevant agencies, make available a practical handbook for the implementation and management of the EES. The practical handbook shall provide technical and operational guidelines, recommendations and best practices. The Commission shall adopt the practical handbook in the form of a recommendation.
Article 72 Monitoring and evaluation
1. eu-LISA shall ensure that procedures are in place to monitor the development of the EES in light of objectives relating to planning and costs and to monitor the functioning of the EES in light of objectives relating to the technical output, cost-effectiveness, security and quality of service. 2. By 30 June 2018, and every six months thereafter during the development phase of the EES, eu-LISA shall submit a report to the European Parliament and to the Council on the state of play of the development of the EES Central System, the Uniform Interfaces and the Communication Infrastructure between the EES Central System and the Uniform Interfaces. That report shall contain detailed information about the costs incurred and information as to any risks which may impact the overall costs of the EES to be borne by the general budget of the Union in accordance with Article 64(1) and the first subparagraph of Article 64(2). Following the development of the EES, eu-LISA shall submit a report to the European Parliament and to the Council explaining in detail how the objectives, in particular relating to planning and costs, were achieved, as well as justifying any divergences. 3. For the purposes of technical maintenance, eu-LISA shall have access to the necessary information relating to the data processing operations performed in the EES. 4. Two years after the start of operations of the EES and every two years thereafter, eu-LISA shall submit to the European Parliament, to the Council and to the Commission a report on the technical functioning of EES, including the security thereof. 5. Three years after the start of operations of the EES and every four years thereafter, the Commission shall produce an overall evaluation of the EES. This overall evaluation shall include: (a) an assessment of the application of this Regulation; (b) an examination of the results achieved against objectives and the impact on fundamental rights; (c) an assessment of the continuing validity of the underlying rationale of the EES; (d) an assessment of the adequacy of the biometric data used for the proper functioning of the EES; (e) an assessment of the use of stamps in the exceptional circumstances referred to in Article 21(2); (f) an assessment of the security of the EES; (g) an assessment of any implications, including any disproportionate impact on the flow of traffic at border crossing points and those with a budgetary impact on the Union budget. The evaluations shall include any necessary recommendations. The Commission shall transmit the evaluation report to the European Parliament, to the Council, to the European Data Protection Supervisor and to the European Union Agency for Fundamental Rights established by Council Regulation (EC) No 168/2007 ( 15 ). Those evaluations shall also include an assessment of the use made of the provisions referred to in Article 60 both in terms of frequency — number of third-country nationals making use of these provisions per Member State, their nationality and average duration of their stay — and practical implications, and shall take into account any related developments in the Union’s visa policy. The first evaluation report may include options in view of phasing out the provisions referred to in Article 60 and replacing them with a Union instrument. It shall be accompanied, where appropriate, by a legislative proposal amending the provisions referred to in Article 60. 6. The Member States and Europol shall provide eu-LISA and the Commission with the information necessary to draft the reports referred to in paragraphs 4 and 5 according to the quantitative indicators predefined by the Commission, eu-LISA, or both. This information shall not jeopardise working methods or include information that reveals sources, staff members or investigations of the designated authorities. 7. eu-LISA shall provide the Commission with the information necessary to produce the overall evaluations referred to in paragraph 5. 8. While respecting the provisions of national law on the publication of sensitive information, each Member State and Europol shall prepare annual reports on the effectiveness of access to EES data for law enforcement purposes containing information and statistics on: (a) whether the consultation was carried out for the purpose of identification or for entry/exit records, and the type of terrorist offence or serious criminal offence that led to the consultation; (b) the grounds given to substantiate the suspicion that the person concerned was covered by this Regulation; (c) the grounds given not to launch the consultation of other Member States’ automated fingerprint identification systems under Decision 2008/615/JHA in accordance with point (b) of Article 32(2) of this Regulation; (d) the number of requests for access to the EES for law enforcement purposes; (e) the number and type of cases in which access to the EES for law enforcement purposes led to successful identifications; (f) the number and type of cases in which the urgency procedures referred to in Article 31(2) and in the second subparagraph of Article 32(2) were used, including those cases where that urgency was not accepted by the ex post verification carried out by the central access point. A technical solution shall be made available to Member States in order to facilitate the collection of the data listed in the first subparagraph of this paragraph for the purpose of generating statistics referred to in this paragraph. The Commission shall adopt implementing acts concerning the specifications of the technical solution. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 68(2). Member States’ and Europol’s annual reports shall be transmitted to the Commission by 30 June of the subsequent year.
Article 73 Entry into force and applicability
This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union . This Regulation shall apply from the date decided by the Commission in accordance with Article 66(1) thereof, with the exception of the following provisions, which shall apply from 29 December 2017: Articles 5, 36, 37, 38, 43, 51 of this Regulation; point (5) of Article 61 of this Regulation, as regards Article 17a(5) of Regulation (EC) No 767/2008; point (10) of Article 61 of this Regulation, as regards Article 26(3a) of Regulation (EC) No 767/2008; and Articles 62, 64, 65, 66, 68, 69 and 70 and Article 72(2) of this Regulation. This Regulation shall be binding in its entirety and directly applicable in the Member States in accordance with the Treaties.
Amendment rationale: CONTEXT OF THE PROPOSAL Reasons for and objectives of the proposal In September 2018, the Council and the European Parliament adopted two legislative acts, a Regulation establishing the European Travel Information and Authorisation System (‘ETIAS’) 1 and an amendment of the Europol Regulation for the purpose of establishing ETIAS 2 . Establishing ETIAS is among efforts undertaken in recent years at EU level to enhance the security of citizens and prevent irregular migration in an open Europe, securing and continuing to strengthen the management of external borders 3 , 4 . The context and the establishment of the system were announced in the 2016 State of the Union speech. President Juncker said: ‘ We will defend our borders […] with strict controls […] on everyone crossing them. Every time someone enters or exits the EU, there will be a record of when, where and why. In November [2016] we will propose a European travel information and authorisation system – an automated system to determine who will be allowed to travel to Europe. That way we will know who is travelling to Europe before they even get here ” . ETIAS will fill the information gap on travellers exempt from the requirement of being in possession of a visa when crossing the external borders. ETIAS will determine the eligibility of visa-exempt third-country nationals prior to their travel to the Schengen Area and whether such travel poses a security, irregular migration or high epidemic risk. ETIAS will also give travellers confidence that they would be able to cross the borders smoothly. If needed, ETIAS travel authorisation could be denied by ETIAS National Units. The assessment of such risks will involve automated processing of personal data provided in the applications for travel authorisation. The ETIAS Regulation establishes that personal data in the applications will be compared with the data present in records, files or alerts registered in EU information systems or databases (the ETIAS Central System, Schengen Information System (‘SIS’), the Visa Information System (‘VIS’), the Entry/Exit System ‘(EES’) or Eurodac), in Europol data or in the Interpol databases (the Interpol Stolen and Lost Travel Document database (‘SLTD’) or the Interpol Travel Documents Associated with Notices database (‘TDAWN’)) 5 . While the Regulation defines in its Article 20 which group of data from the ETIAS application files can be used to consult the other systems, not all those data are collected or recorded in the same way in the other EU information systems and Europol data. For instance in one of the systems, ‘country of issue of the travel document’ is collected while in another the same data is recorded in another way, e.g. as ‘three letter code of the issuing country of the travel document’. In other instances, a category of data is collected in one system but not in the other. For instance, ‘first names of parents of applicants’ are collected by ETIAS, but not in most of the other systems to be queried by ETIAS. Also at the time the ETIAS proposal 6 was adopted, the situation as regards the different EU information systems to be queried by ETIAS was different from today. At the time the ETIAS proposal was adopted, two other new EU information technology systems had been proposed to be set up: discussions were ongoing on the EES Regulation 7 while the Commission’s proposal on the European Criminal Records Information System – Third Country Nationals (‘ECRIS-TCN’) 8 was just about to be proposed. As regards existing information systems, the legal texts of the SIS were evolving due to the proposed revisions to the SIS legal framework in December 2016, finally adopted by co-legislators in November 2018 9 . The recast of the Eurodac Regulation 10 had also been proposed by the Commission as part of the reform of the Common European Asylum System, but had not yet been adopted by co-legislators 11 . The recast Eurodac Regulation still remains to be adopted by co-legislators today. Based on these considerations, the ETIAS Regulation stipulates, in its Article 11(2) that: “The amendments to the legal acts establishing the EU information systems that are necessary for establishing their interoperability with ETIAS as well as the addition of corresponding provisions in this Regulation shall be the subject of a separate legal instrument”. The present proposal therefore aims to set out the technical amendments necessary to fully set up the ETIAS system by amending the legal acts of the EU information technology systems ETIAS queries. The present proposal also sets out coresponding provisions and amends the ETIAS Regulation accordingly. First, the present initiative sets out amendments to the Regulation on ECRIS-TCN, on which recently, an ‘agreement in principle’ was found by the co-legislators. Thus, in line with the intention expressed by co-legislators in the ETIAS Regulation 12 it is now possible to include in ETIAS the necessary provisions on the relationship between ETIAS and ECRIS-TCN and to amend ECRIS-TCN accordingly. Secondly, the present initiative also aims to establish the relations between ETIAS and the SIS. The revised SIS legal framework has been adopted in November 2018. The present proposal includes consequential amendments resulting from the adoption of the new SIS Regulations. In line with the new SIS legal framework it is proposed to include the new alert category on inquiry checks 13 for the assessment of applications. It is not proposed to include the alert category on return decisions as such alerts are erased at the moment a return decision is implemented. This means that persons that apply for an ETIAS authorisation after having left the EU will – by definition – not have a return record in the SIS. Thirdly, the present initiative seeks to amend the EES Regulation to establish technically its relationship with ETIAS. Fourthly, the initiative also aims at amending the VIS Regulation in order to allow VIS to receive, process and answer ETIAS queries. Although in May 2018, the Commission presented a proposal to amend the VIS Regulation in order to upgrade that database, the present initiative puts forward amendments to the VIS Regulation currently in force, as the negotiations on the proposal for the upgraded VIS are not sufficiently advanced. However, if the proposal to amend the VIS Regulation were to be adopted first, it could become necessary to introduce some technical changes in the present proposal to align it with the amended version of the VIS Regulation. If the present proposal is adopted first, some technical changes could be required in the proposal amending the VIS Regulation before its adoption. In addition, following the adoption of both the EES Regulation and ETIAS Regulation, it is now required to align the way EES and ETIAS are working together on the way EES and VIS are integrated for the purpose of border control process and registration of border crossings in EES. This will rationalise and simplify the work of border guards through the implementation of a more uniform border control process for all third-country national entering for a short stay. The present initiative however does not include the amendments related to Eurodac, the EU asylum and irregular migration database, given that discussions have not yet been concluded on the May 2016 legislative proposal to strengthen Eurodac 14 . Furthermore, the data available in the current Eurodac are not sufficient for ETIAS purposes, given that the existing Eurodac only stores biometric data and a reference number, but no other personal data (e.g. name(s), age, date of birth) that would allow for contributing to the objectives of ETIAS. The May 2016 legislative proposal for a recast Eurodac Regulation seeks to extend the purpose of the database to the identification of illegally staying third-country nationals and those who have entered the EU irregularly. In particular, it provides for the storage of personal data such as the name(s), age, date of birth, nationality, and identity documents. These identity data are essential to ensure that Eurodac will be able to contribute to the objectives of ETIAS. Once the co-legislators reach political agreement on the recast Eurodac Regulation, the recast Eurodac Regulation will need to be supplemented with the necessary amendments to connect Eurodac to ETIAS. Additionally, once the co-legislators adopt the Commission’s legislative proposals 15 for the interoperability of information systems for security, border and migration management, and following political agreement on the proposal for a recast Eurodac Regulation, the Commission will apply the same approach with regards to the necessary amendments to make Eurodac part of the interoperability of information systems . Finally, in line with the April 2016 Communication on "Smarter Information Systems for borders and security", ETIAS is to be built based on a re-use of hardware and software components developed for the EES 16 . This is also the approach followed by the legislative proposals on the interoperability of information systems 17 . The technical development of the common identity repository and the European search portal as foreseen by the legislative proposals on the interoperability of information systems would be developed on the basis of the EES/ETIAS components. This proposal therefore presents amendments to the ETIAS Regulation to specify that the ETIAS Central System would build upon the EES Central System’s hardware and software components in order to establish a shared identity repository for the storage of the identity alphanumeric data of both ETIAS applicants and third-country nationals registered in EES. This shared identity repository would be the basis for the implementation of the common identity repository once the co-legislators adopt the legislative proposals on the interoperability of information systems. Moreover, during a transitional period, before the European search portal is available, the automated processing of ETIAS applications would rely on a tool, which would be used as the basis for the development and implementation of the European search portal. Due to the variable geometry in Member States' participation in EU policies in the area of freedom, security and justice, it is necessary to adopt two separate legal instruments which will nonetheless work seamlessly together to enable the comprehensive operation and use of the system. 
Revised version (Article 73 Entry into force and applicability):
This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union . This Regulation shall be binding in its entirety and directly applicable in the Member States in accordance with the Treaties.