Skip to content
REPORT (COM(2024)0670 – C100124/2024 – 2024/0670(COD))

On the proposal for a regulation of the European Parliament and of the Council establishing an application for the electronic submission of travel data (“EU Digital Travel application”) and amending Regulations (EU) 2016/399 and (EU) 2018/1726 of the European Parliament and of the Council and Council Regulation (EC) No 2252/2004, as regards the use of digital travel credentials

A-10-2025-0258

Committee on Civil Liberties, Justice and Home Affairs · Rapporteur: Juan Fernando López Aguilar

Official HTML ↗ PDF DOCX
✦ In shortFull textProcedure & committee votes
✦ In short · AI summary of this text, generated 25 Sept 2026

Written by a language model from the full text only; every figure comes from the text. The paragraph links open the paragraph a statement rests on — check the text itself before relying on it.

Parliament's amended version of the Commission proposal sets up an EU Digital Travel application for submitting travel data electronically and a uniform standard for digital travel credentials. The application has a mobile app, a backend validation service and a Digital Travel Credential Router; its software is open-source licensed and it must be free, multilingual and accessible. Use is voluntary and consent-based for travellers over 16; travellers must still carry a physical document, and those who opt out must get comparable infrastructure at border crossing points. Travel data are limited to what is necessary, transmitted end-to-end encrypted, and deleted automatically after the border is crossed or 24 hours after the intended arrival or departure. eu-LISA develops and hosts the application, tests it no later than one year after entry into force, and the Commission evaluates it two years after operations start and every four years thereafter.

Committee position. The rapporteur welcomes the Commission proposal but seeks additional safeguards for privacy, data protection, non-discrimination and freedom of movement, including a higher age limit, deletion of travel data, detailed rules on the Router and mobile application, and information campaigns.

Key points

  1. The regulation establishes the EU Digital Travel application for creating, storing and submitting digital travel credentials and self-declared data.
  2. The application consists of a mobile application, a backend validation service and a Digital Travel Credential Router; the source code of its software components must be open-source licensed.
  3. The application applies to persons over 16 with a travel document or identity card issued under Union law or a compatible chipped travel document.
  4. Before creating a credential, the application must verify the chip's integrity and authenticity and match the user's live facial image to the image stored on the chip.
  5. Use of the application and creation of credentials are voluntary and based on consent; travellers may withdraw consent at any time and must still carry a physical travel document.
  6. Travellers who do not use the application or withdraw consent must be provided with infrastructure, including manual processing and e-gates, that is not disadvantageous.
  7. Self-declared data are limited to the intended date and time of arrival or departure and the Member State where the border is crossed, and must be submitted no earlier than 48 hours before.
  8. The Digital Travel Credential Router transmits travel data immediately, automatically and end-to-end encrypted to competent border authorities, without modifying content.
  9. Competent border authorities must delete travel data automatically after the traveller crosses the border, or 24 hours after the intended arrival or departure if the traveller does not cross.
  10. The mobile application may allow carriers access to the digital travel credential for advance passenger information purposes, with explicit user consent, but carriers may not collect biometric data.
  11. eu-LISA develops, hosts and manages the application, tests it no later than one year after entry into force, and conducts penetration tests and vulnerability assessments within two years of operations and every four years thereafter.
  12. The Commission evaluates the application two years after operations start and every four years thereafter, reporting to Parliament, the Council, the European Data Protection Supervisor and the Fundamental Rights Agency.

Who is affected

  • Travellers over 16, including third-country nationals, who may voluntarily create and use digital travel credentials.
  • Member States' border authorities, which receive and process travel data and must provide training and infrastructure.
  • eu-LISA, responsible for developing, hosting, operating and maintaining the application and the Router.
  • Carriers, which may access digital travel credentials with user consent but may not collect biometric data.
  • Vulnerable persons, including persons with disabilities, elderly people and those with limited digital skills, who must receive particular attention.

Figures and deadlines

  • Travellers must be over the age of 16 to use the application.
  • Travel data must be submitted no earlier than 48 hours before the intended arrival or departure.
  • Travel data must be deleted 24 hours after the intended date and time of arrival or departure if the traveller does not cross the border.
  • eu-LISA must test the application no later than one year after the entry into force of the regulation.
  • The Commission must evaluate the application two years after the start of operations and every four years thereafter.
  • The Commission must determine the start of operations no later than 6 months after successful completion of the test.
  • The delegation of power to amend the minimum age is conferred for a period of five years.
  • eu-LISA must conduct a penetration test and vulnerability assessment within two years after the start of operations and every four years thereafter.

Legal basis: Article 294(2) and Article 77(2)(b) and (d) of the Treaty on the Functioning of the European Union.