Sittings · Document

REPORT (COM(2022)0729 – C90428/2022 – 2022/0424(COD)) 2023-12-07

On the proposal for a regulation of the European Parliament and of the Council on the collection and transfer of advance passenger information (API) for enhancing and facilitating external border controls, amending Regulation (EU) 2019/817 and Regulation (EU) 2018/1726, and repealing Council Directive 2004/82/EC

Committee on Civil Liberties, Justice and Home Affairs · Rapporteur: JanChristoph Oetjen

DRAFT EUROPEAN PARLIAMENT LEGISLATIVE RESOLUTION

on the proposal for a regulation of the European Parliament and of the Council on the collection and transfer of advance passenger information (API) for enhancing and facilitating external border controls, amending Regulation (EU) 2019/817 and Regulation (EU) 2018/1726, and repealing Council Directive 2004/82/EC

(COM(2022)0729 – C90428/2022 – 2022/0424(COD))

(Ordinary legislative procedure: first reading)

The European Parliament,

– having regard to the Commission proposal to Parliament and the Council (COM(2022)0729),

– having regard to Article 294(2) and Articles 77(2), points (b) and (d) and 79(2), point (c) of the Treaty on the Functioning of the European Union, pursuant to which the Commission submitted the proposal to Parliament (C90428/2022),

– having regard to Article 294(3) of the Treaty on the Functioning of the European Union,

– having regard to the opinion of the European Economic and Social Committee of 27 April 2023,

– having regard to Rule 59 of its Rules of Procedure,

– having regard to the opinion of the Committee on Transport and Tourism,

– having regard to the report of the Committee on Civil Liberties, Justice and Home Affairs (A9-0409/2023),

1. Adopts its position at first reading hereinafter set out;

2. Calls on the Commission to refer the matter to Parliament again if it replaces, substantially amends or intends to substantially amend its proposal;

3. Instructs its President to forward its position to the Council, the Commission and the national parliaments.

Amendment 1

Proposal for a regulation

Recital 1

Text proposed by the Commission	Amendment
(1) The carrying-out of checks of persons at the external borders significantly contributes to guaranteeing the long-term security of the Union, Member States and its citizens and, as such, remains an important safeguard, especially in the area without internal border control (‘the Schengen area’). Efficient and effective external border controls, carried out in accordance with, in particular, Regulation (EU) 2016/399 of the European Parliament and of the Council32 where applicable, help combating illegal immigration and prevent threats to the Member States’ internal security, public policy, public health and international relations.	(1) The carrying-out of checks of persons at the external borders significantly contributes to guaranteeing the long-term security of the Union, Member States and its citizens and, as such, remains an important safeguard, especially in the area without internal border control (‘the Schengen area’). Border checks should be carried out according to in particular, Regulation (EU) 2016/399 of the European Parliament and of the Council32 where applicable, in order to help combat illegal immigration and prevent threats to the Member States’ internal security, public policy, public health and international relations. Such border checks should be carried out in such a way as to fully respect human dignity and be in full compliance with relevant Union law, including the Charter of Fundamental Rights of the European Union (‘the Charter’).
__________________	__________________
32 Regulation (EU) 2016/399 of the European Parliament and of the Council of 9 March 2016 on a Union Code on the rules governing the movement of persons across borders (Schengen Borders Code) (OJ L 77, 23.3.2016, p. 1).	32 Regulation (EU) 2016/399 of the European Parliament and of the Council of 9 March 2016 on a Union Code on the rules governing the movement of persons across borders (Schengen Borders Code) (OJ L 77, 23.3.2016, p. 1).

Amendment 2

Proposal for a regulation

Recital 2

Text proposed by the Commission	Amendment
(2) The use of traveller data and flight information transferred ahead of the arrival of travellers, known as advance passenger information (‘API’) data, contributes to speeding up the process of carrying out the required checks during the border-crossing process. For the purposes of this Regulation that process concerns, more specifically, the crossing of borders between a third country or a Member State not participating in this Regulation, on the one hand, and a Member State participating in this Regulation, on the other hand. Such use strengthens checks at those external borders by providing sufficient time to enable detailed and comprehensive checks to be carried out on all travellers, without having a disproportionate negative effect on persons travelling in good faith. Therefore, in the interest of the effectiveness and efficiency of checks at external borders, an appropriate legal framework should be provided for to ensure that Member States’ competent border authorities at such external border crossing points have access to API data prior to the arrival of travellers.	(2) The use of passenger data and flight information transferred ahead of the arrival of passengers, known as advance passenger information (‘API’) data, contributes to speeding up the process of carrying out the required checks during the border-crossing process. For the purposes of this Regulation that process concerns, more specifically, the crossing of borders between a third country or a Member State not participating in this Regulation, and, a Member State participating in this Regulation. Such use strengthens checks at those external borders by providing sufficient time to enable detailed and comprehensive checks to be carried out on all passengers, without having a disproportionate negative effect on persons travelling in good faith. Therefore, in the interest of the effectiveness and efficiency of checks at external borders, an appropriate legal framework should be provided for to ensure that Member States’ competent border authorities at such external border crossing points have access to API data prior to the arrival of passengers.

Amendment 3

Proposal for a regulation

Recital 3

Text proposed by the Commission	Amendment
(3) The existing legal framework on API data, which consists of Council Directive 2004/82/EC33 and national law transposing that Directive, has proven important in improving border controls, notably by setting up a framework for Member States to introduce provisions for laying down obligations on air carriers to transfer API data on passengers transported into their territory. However, divergences remain at national level. In particular, API data is not systematically requested from air carriers and air carriers are faced with different requirements regarding the type of information to be collected and the conditions under which the API data needs to be transferred to competent border authorities. Those divergences lead not only to unnecessary costs and complications for the air carriers, but they are also prejudicial to ensuring effective and efficient pre-checks of persons arriving at external borders.	(3) The existing legal framework on API data, which consists of Council Directive 2004/82/EC33 and national law transposing that Directive, has proven important in improving border checks, in particular by setting up a framework for Member States to introduce provisions for laying down obligations on air carriers to transfer API data on passengers transported into their territory. However, divergences remain at national level. In particular, API data is not systematically requested from air carriers and air carriers are faced with different requirements regarding the type of information to be collected and the conditions under which the API data needs to be transferred to competent border authorities. Those divergences lead not only to unnecessary costs and complications for the air carriers, but they are also prejudicial to ensuring effective and efficient pre-checks of persons arriving at external borders.
__________________	__________________
33 Council Directive 2004/82/EC of 29 April 2004 on the obligation of carriers to communicate passenger data (OJ L 261, 6.8.2004, p. 24).	33 Council Directive 2004/82/EC of 29 April 2004 on the obligation of carriers to communicate passenger data (OJ L 261, 6.8.2004, p. 24).

Amendment 4

Proposal for a regulation

Recital 5

Text proposed by the Commission	Amendment
(5) In order to ensure a consistent approach at international level as much as possible and in view of the rules on the collection of API data applicable at that level, the updated legal framework established by this Regulation should take into account the relevant practices internationally agreed with the air industry and in the context of the World Customs Organisation, International Aviation Transport Association and International Civil Aviation Organisation Guidelines on Advance Passenger Information.	(5) In order to ensure a consistent approach at both union and international level as much as possible and in view of the rules on the collection of API data applicable at that level, the updated legal framework established by this Regulation should take into account the relevant practices internationally agreed with the air industry, specifically in the context of the World Customs Organisation, International Aviation Transport Association and International Civil Aviation Organisation (ICAO) Guidelines on Advance Passenger Information.

Amendment 5

Proposal for a regulation

Recital 6

Text proposed by the Commission	Amendment
(6) The collection and transfer of API data affects the privacy of individuals and entails the processing of personal data. In order to fully respect fundamental rights, in particular the right of respect for private life and the right to the protection of personal data, in accordance with the Charter of Fundamental Rights of the European Union (‘Charter’), adequate limits and safeguards should be provided for. In particular, any processing of API data and, in particular, API data constituting personal data, should remain limited to what is necessary for and proportionate to achieving the objectives pursued by this Regulation. In addition, it should be ensured that the API collected and transferred under this Regulation do not lead to any form of discrimination precluded by the Charter.	(6) The collection and transfer of API data affects the privacy of individuals and entails the processing of their personal data. In order to fully respect their fundamental rights, in particular the right of respect for private life and the right to the protection of personal data, in accordance with the Charter, adequate limits and safeguards should be provided for. In particular, any processing of API data and, in particular, API data constituting personal data, should remain strictly limited to what is necessary for and proportionate to achieving the objectives pursued by this Regulation. In addition, it should be ensured that the processing of any API data collected and transferred under this Regulation do not lead to any form of discrimination precluded by the Charter.

Amendment 6

Proposal for a regulation

Recital 7

Text proposed by the Commission	Amendment
(7) In order to achieve its objectives, this Regulation should apply to all carriers conducting flights into the Union, as defined in this Regulation, covering both scheduled and non-scheduled flights, irrespective of the place of establishment of the air carriers conducting those flights.	(7) In order to achieve its objectives, this Regulation should apply to all commercial air carriers conducting flights into the Union, as defined in this Regulation, covering both scheduled and non-scheduled flights, irrespective of the place of establishment of the air carriers conducting those flights. In accordance with the relevant ICAO classifications, general aviation such as flight schools, military or medical flights, should be exempted from this Regulation;

Amendment 7

Proposal for a regulation

Recital 8

Text proposed by the Commission	Amendment
(8) In the interest of effectiveness and legal certainty, the items of information that jointly constitute the API data to be collected and subsequently transferred under this Regulation should be listed clearly and exhaustively, covering both information relating to each traveller and information on the flight of that traveller. Such flight information should cover information on the border crossing point of entry into the territory of the Member State concerned in all cases covered by this Regulation, but that information should be collected only where applicable under Regulation (EU) [API law enforcement], that is, not when the API data relate to intra-EU flights.	(8) In the interest of effectiveness and legal certainty, the items of information that jointly constitute the API data to be collected and subsequently transferred under this Regulation should be listed clearly and exhaustively, covering both information relating to each passenger and information on the flight taken by that passenger. Such flight information should cover information on the border crossing point of entry into the territory of the Member State concerned in all cases covered by this Regulation.

Amendment 8

Proposal for a regulation

Recital 9

Text proposed by the Commission	Amendment
(9) In order to allow for flexibility and innovation, it should in principle be left to each air carrier to determine how it meets its obligations regarding the collection of API data set out in this Regulation. However, considering that suitable technological solutions exist that allow collecting certain API data automatically while guaranteeing that the API data concerned is accurate, complete and up-to-date, and having regard the advantages of the use of such technology in terms of effectiveness and efficiency, air carriers should be required to collect that API data using automated means, by reading information from the machine-readable data of the travel document.	(9) In order to allow for flexibility and innovation, it should in principle be left to each air carrier to determine how it meets its obligations regarding the collection of API data set out in this Regulation. However, considering that suitable technological solutions exist that allow collecting certain API data automatically while guaranteeing that the API data concerned is accurate, complete and up-to-date, and having regard the advantages of the use of such technology in terms of effectiveness and efficiency, air carriers should be required to collect the API data using automated means, specifically by reading information from the machine-readable data of the travel document. Where the use of such automated means is however not possible, air carriers should collect the API data manually, either as part of the online check-in process, or as part of the check-in at the airport, in such a manner as to ensure compliance with their obligations under this Regulation.

Amendment 9

Proposal for a regulation

Recital 9 a (new)

Text proposed by the Commission	Amendment
	(9a) The collection of API data by automated means should be limited to the alphanumerical data contained in the travel document and should not lead to the collection of any biometric data from it.

Amendment 10

Proposal for a regulation

Recital 9 b (new)

Text proposed by the Commission	Amendment
	(9b) The requirements set out by this Regulation and by the corresponding delegated and implementing acts should lead to a uniform implementation by the airlines, thereby minimizing the cost of the interconnection of their respective systems. To facilitate a harmonized implementation of those requirements by the airlines, in particular as regards the data structure, format and transmission protocol, the Commission, based on its cooperation with the competent border authorities, other Member States authorities, air carriers, and relevant Union agencies, should ensure that the practical handbook to be prepared by the Commission provides all the necessary guidance and clarifications.

Amendment 11

Proposal for a regulation

Recital 9 c (new)

Text proposed by the Commission	Amendment
	(9c) In order to enhance data quality, the router should verify whether the API data transferred to it by the air carriers comply with the supported data formats. Where the router has verified that the data are not compliant with the supported data formats, the router should, immediately and in an automated manner, notify the air carrier concerned.

Amendment 12

Proposal for a regulation

Recital 9 d (new)

Text proposed by the Commission	Amendment
	(9d) The automatic data collection systems and other processes established under this Regulation should not negatively impact the employees in the aviation industry, who should benefit from upskilling and reskilling opportunities that would increase the efficiency and reliability of data collection and transfer as well as the working conditions in the sector.

Amendment 13

Proposal for a regulation

Recital 10

Text proposed by the Commission	Amendment
(10) Automated means enable travellers to provide certain API data themselves during an online check-in process. Such means could, for example, include a secure app on a travellers’ smartphone, computer or webcam with the capability to read the machine-readable data of the travel document. Where the travellers did not check-in online, air carriers should in practice provide them with the possibility to provide the machine-readable API data concerned during check-in at the airport with the assistance of a self-service kiosk or of airline staff at the counter.	(10) The passenger should be enabled to provide certain API data themselves during an online check-in process, in accordance with Article 5. Such means could, for example, include a secure app on a passengers’ smartphone, computer or webcam with the capability to read the machine-readable data of the travel document. Where the passengers did not check-in online, air carriers should provide them with the possibility to provide the required machine-readable API data concerned during check-in at the airport with the assistance of a self-service kiosk or of airline staff at the counter. The Commission should ensure that the obligations under this Regulation do not lead to disproportionate obstacles for passengers unable to use online means for automated check-in, such as additional airport check-in fees.

Amendment 14

Proposal for a regulation

Recital 10 a (new)

Text proposed by the Commission	Amendment
	(10a) With a view to guaranteeing the fulfilment of the rights provided for under the Charter and to ensuring accessible and inclusive travel options, especially for vulnerable groups and persons with disabilities, air carriers, supported by the Member States, should ensure that an offline alternative for the check-in and for the provision of the necessary data by the passengers is possible at all times.

Amendment 15

Proposal for a regulation

Recital 11

Text proposed by the Commission	Amendment
(11) The Commission should be empowered to adopt technical requirements and procedural rules that air carriers are to comply with in connection to the use of automated means for the collection of machine-readable API data under this Regulation, so as to increase clarity and legal certainty and contribute to ensuring data quality and the responsible use of the automated means.	(11) The Commission should be empowered to adopt technical requirements and procedural rules that air carriers should to comply with regarding the use of automated means for the collection of machine-readable API data under this Regulation, so as to increase clarity and legal certainty and contribute to ensuring data quality and the responsible use of the automated means.

Amendment 16

Proposal for a regulation

Recital 13

Text proposed by the Commission	Amendment
(13) In view of ensuring that the pre-checks carried out in advance by competent border authorities are effective and efficient, the API data transferred to those authorities should contain data of travellers that are effectively set to cross the external borders, that is, of travellers that are effectively on board of the aircraft. Therefore, the air carriers should transfer API data directly after flight closure. Moreover, API data helps the competent border authorities to distinguish legitimate travellers from travellers who may be of interest and therefore may require additional verifications, which would necessitate further coordination and preparation of follow-up measures to be taken upon arrival. That could occur, for example, in cases of unexpected number of travellers of interest whose physical checks at the borders could adversely affect the border checks and waiting times at the borders of other legitimate travellers. To provide the competent border authorities with an opportunity to prepare adequate and proportionate measures at the border, such as temporarily reinforcing or reaffecting staff, particularly for flights where the time between the flight closure and the arrival at the external borders is insufficient to allow the competent border authorities to prepare the most appropriate response, API data should also be transmitted prior to boarding, at the moment of check-in of each traveller.	(13) In view of ensuring that the pre-checks carried out in advance by competent border authorities are effective and efficient, the API data transferred to those authorities should contain data of passengers that are effectively set to cross the external borders, that is, of passengers that are effectively on board of the aircraft. Therefore, the air carriers should transfer API data directly after flight closure. Moreover, API data helps the competent border authorities to distinguish legitimate passengers from passengers who may be of interest and therefore may require additional verifications, which would necessitate further coordination and preparation of follow-up measures to be taken upon arrival. That could occur, for example, in cases of unexpected number of passengers of interest whose physical checks at the borders could adversely affect the border checks and waiting times at the borders of other legitimate passengers. To provide the competent border authorities with an opportunity to prepare adequate and proportionate measures at the border, such as temporarily reinforcing or reaffecting staff, particularly for flights where the time between the flight closure and the arrival at the external borders is insufficient to allow the competent border authorities to prepare the most appropriate response, API data should also be transmitted prior to boarding, at the moment of check-in of each passenger.

Amendment 17

Proposal for a regulation

Recital 15

Text proposed by the Commission	Amendment
(15) In order to avoid any risk of misuse and in line with the principle of purpose limitation, the competent border authorities should be expressly precluded from processing the API data that they receive under this Regulation for any other purpose than enhancing and facilitating the effectiveness and efficiency of border checks at external borders and combating illegal immigration.	(15) In order to avoid any risk of misuse and in line with the principle of purpose limitation, the competent border authorities should be expressly precluded from processing the API data that they receive under this Regulation for any other purpose than those explicitly provided for in this Regulation.

Amendment 18

Proposal for a regulation

Recital 16

Text proposed by the Commission	Amendment
(16) To ensure that competent border authorities have sufficient time to carry out pre-checks effectively on all travellers, including travellers on long-haul flights and those travelling on connecting flights, as well as sufficient time to ensure that the API data collected and transferred by the air carriers is complete, accurate and up-to-date, and where necessary to request additional clarifications, corrections or completions from the air carriers, the competent border authorities should store the API data that they received under this Regulation for a fixed time period that remains limited to what is strictly necessary for those purposes. Similarly, to be able to respond to such requests, air carriers should store the API data that they transferred under this Regulation for the same fixed and strictly necessary time period.	(16) To ensure that competent border authorities have sufficient time to carry out pre-checks effectively on all passengers, including passengers on long-haul flights and those travelling on connecting flights, as well as sufficient time to ensure that the API data collected and transferred by the air carriers is complete, accurate and up-to-date, and where necessary to request additional clarifications, corrections or completions from the air carriers, the competent border authorities should store the API data that they received under this Regulation for a fixed time period that remains limited to what is strictly necessary for those purposes. Similarly, to be able to respond to such requests, air carriers should store the API data that they transferred under this Regulation for the same fixed and strictly necessary time period. Beyond that, and with a view to enhance the travel experience of legitimate passengers, air carriers should be able to retain and use the API data where necessary for the normal course of their business in particular for travel facilitation, in compliance with the applicable law and in particular Regulation (EU) 2016/679.

Amendment 19

Proposal for a regulation

Recital 17

Text proposed by the Commission	Amendment
(17) In order to avoid that air carriers have to establish and maintain multiple connections with the competent border authorities of the Member States’ for the transfer of API data collected under this Regulation and the related inefficiencies and security risks, provision should be made for a single router, created and operated at Union level, that serves as a connection and distribution point for those transfers. In the interest of efficiency and cost effectiveness, the router should, to the extent technically possible and in full respect of the rules of this Regulation and Regulation (EU) [API law enforcement], rely on technical components from other relevant systems created under Union law.	(17) In order to avoid that air carriers have to establish and maintain multiple connections with the competent border authorities of the Member States’ for the transfer of API data collected under this Regulation and the related inefficiencies and security risks, provision should be made for a single router, created and operated at Union level, that serves as a connection and distribution point for those transfers. In the interest of efficiency and cost effectiveness, the router should, to the extent technically possible and in full respect of the rules of this Regulation and Regulation (EU) [API law enforcement], rely on technical components from other relevant systems created under Union law, in particular the web service referred to in Regulation (EU) 2017/2226, the carrier gateway referred to in Regulation (EU) 2018/1240 and the carrier gateway referred to in Regulation (EC) 767/2008. In order to reduce the impact on air carriers and ensure a harmonised approach towards air carriers, eu-LISA should design the router, to the extent technically and operationally possible, in a way that is coherent and consistent with the obligations put on air carriers by Regulation (EU) 2017/2226, Regulation (EU) 2018/1240 and Regulation (EC) 767/2008.

Amendment 20

Proposal for a regulation

Recital 17 a (new)

Text proposed by the Commission	Amendment
	(17a) In order to provide for the same level of clarity and certainty, the provisions related to the router, security and support tasks by eu-LISA should be mirrored in this Regulation and Regulation (EU) [API law enforcement], as eu-LISA should build and maintain only one router for the purposes of both Regulations.

Amendment 21

Proposal for a regulation

Recital 19

Text proposed by the Commission	Amendment
(19) The router should serve only to facilitate the transmission of API data from the air carriers to the competent border authorities in accordance with this Regulation and to PIUs in accordance with Regulation (EU) [API law enforcement], and should not be a repository of API data. Therefore, and in order to minimise any risk of unauthorised access or other misuse and in accordance with the principle of data minimisation, any storage of the API data on the router should remain limited to what is strictly necessary for technical purposes related to the transmission and the API data should be deleted from the router, immediately, permanently and in an automated manner, from the moment that the transmission has been completed or, where relevant under Regulation (EU) [API law enforcement], the API data is not to be transmitted at all.	(19) The router should serve only to facilitate the transmission of API data from the air carriers to the competent border authorities in accordance with this Regulation, and should not be a repository of API data. Therefore, and in order to minimise any risk of unauthorised access or other misuse and in accordance with the principle of data minimisation, no storage should take place unless strictly necessary for technical purposes related to the transmission and the API data should be deleted from the router, immediately, permanently and in an automated manner, from the moment that the transmission has been completed.

Amendment 22

Proposal for a regulation

Recital 20

Text proposed by the Commission	Amendment
(20) With a view to ensuring the proper functioning of the transmission of API data from router, the Commission should be empowered to lay down detailed technical and procedural rules on that transmission. Those rules should be such as to ensure that the transmission is secure, effective and swift and impacts passengers’ travel and air carriers no more than necessary.	(20) With a view to ensuring the proper functioning of the transmission of API data from router, the Commission should be empowered to lay down detailed technical and procedural rules on that transmission. Those rules should be such as to ensure that the transmission is secure, effective and swift and impacts passengers’ travel rights and air carriers no more than necessary.

Amendment 23

Proposal for a regulation

Recital 22

Text proposed by the Commission	Amendment
(22) The router to be created and operated under this Regulation should reduce and simplify the technical connections needed to transfer API data, limiting them to a single connection per air carrier and per competent border authority. Therefore, this Regulation provides for the obligation for the competent border authorities and air carriers to each establish such a connection to, and achieve the required integration with, the router, so as to ensure that the system for transferring API data established by this Regulation can function properly. To give effect to those obligations and to ensure the proper functioning of the system set up by this Regulation, they should be supplemented by detailed rules.	(22) The router to be created and operated under this Regulation and Regulation (EU) [API Law Enforcement] should reduce and simplify the technical connections needed to transfer API data, limiting them to a single connection per air carrier and per competent border authority. Therefore, this Regulation provides for the obligation for the competent border authorities and air carriers to each establish such a connection to, and achieve the required integration with, the router, so as to ensure that the system for transferring API data established by this Regulation can function properly. The design and development of the router by eu-LISA should enable the effective and efficient connection and integration of air carriers’ systems and infrastructure by providing for all relevant standards and technical requirements. To ensure the proper functioning of the system set up by this Regulation, detailed rules should be provided. When designing and developing the router, eu-LISA should ensure that API data transferred by air carriers and transmitted to competent border authorities is encrypted in transit.

Amendment 24

Proposal for a regulation

Recital 23

Text proposed by the Commission	Amendment
(23) In view of the Union interests at stake, the costs incurred by eu-LISA for the performance of its tasks under this Regulation and Regulation (EU) [API law enforcement] in respect of the router should be borne by the Union budget. The same should go for appropriate costs incurred by the Member States in relation to their connections to, and integration with, the router, as required under this Regulation and in accordance with the applicable legislation, subject to certain exceptions. The costs covered by those exceptions should be borne by each Member State concerned itself.	(23) In view of the Union interests at stake, the costs incurred by the European Data Protection Supervisor and eu-LISA for the performance of its tasks under this Regulation in respect of the router should be borne by the Union budget. The same should go for appropriate costs incurred by the Member States in relation to their connections to, and integration with, the router and costs related to the maintenance of those connections, as required under this Regulation and in accordance with the applicable legislation, subject to certain exceptions. The costs covered by those exceptions should be borne by each Member State concerned itself. The Union budget should also cover the support, such as training, by eu-LISA to air carriers and border authorities to enable effective transfer and transmission of API data through the router. The costs incurred by the independent national supervisory authorities in relation to the tasks entrusted to them under this Regulation shall be borne by the respective Member States as well.

Amendment 25

Proposal for a regulation

Recital 25

Text proposed by the Commission	Amendment
(25) In the interest of ensuring compliance with the fundamental right to protection of personal data, this Regulation should identify the controller and processor and set out rules on audits. In the interest of effective monitoring, ensuring adequate protection of personal data and minimising security risks, rules should also be provided for on logging, security of processing and self-monitoring. Where they relate to the processing of personal data, those provisions should be understood as complementing the generally applicable acts of Union law on the protection of personal data, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council34 and Regulation (EU) 2018/1725 of the European Parliament and the Council.35 Those acts, which also apply to the processing of personal data under this Regulation in accordance with the provisions thereof, should not be affected by this Regulation.	(25) In the interest of ensuring compliance with the fundamental right of the passengers to the protection of their personal data, this Regulation should identify the controller and processor and set out rules on audits. In the interest of effective monitoring, ensuring adequate protection of personal data and minimising security risks, rules should also be provided for on logging, security of processing and self-monitoring. Where they relate to the processing of personal data, those provisions should be understood as complementing the generally applicable acts of Union law on the protection of personal data, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council34 and Regulation (EU) 2018/1725 of the European Parliament and the Council.35 Those acts, which also apply to the processing of personal data under this Regulation in accordance with the provisions thereof, should not be affected by this Regulation.
__________________	__________________
34 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1).	34 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1).
35 Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39).	35 Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39).

Amendment 26

Proposal for a regulation

Recital 25 a (new)

Text proposed by the Commission	Amendment
	(25a) Taking into account the right of passengers to be informed of the processing of their personal data, Member States should ensure that passengers are provided with accurate information about the collection of API data, the transfer of that data to the competent border authorities and their rights as data subjects that is easily accessible and easy to understand, at the moment of booking and at the moment of check-in .

Amendment 27

Proposal for a regulation

Recital 28 a (new)

Text proposed by the Commission	Amendment
	(28a) When providing for the penalties applicable to air carriers under this Regulation, Member States should take into account the technical and operational feasibility of ensuring complete data accuracy. Additionally, when penalties are imposed, their application and value should be established taking into consideration the actions undertaken by the air carrier to mitigate the issue as well as its level of cooperation with national authorities.

Amendment 28

Proposal for a regulation

Recital 30

Text proposed by the Commission	Amendment
(30) As the router should be designed, developed, hosted and technically managed by the eu-LISA, established by Regulation (EU) 2018/1726 of the European Parliament and of the Council36 , it is necessary to amend that Regulation by adding that task to the tasks of eu-LISA. In order to store reports and statistics of the router on the Common Repository for Reporting and Statistics it is necessary to amend Regulation (EU) 2019/817 of the European Parliament and of the Council37 .	(30) As the router should be designed, developed, hosted and technically managed by the eu-LISA, established by Regulation (EU) 2018/1726 of the European Parliament and of the Council36 , it is necessary to amend that Regulation by adding that task to the tasks of eu-LISA. In order to store reports and statistics of the router on the Central Repository for Reporting and Statistics it is necessary to amend Regulation (EU) 2019/817 of the European Parliament and of the Council37. The Central Repository for Reporting and Statistics should only provide statistics based on API data for the implementation and effective supervision of this Regulation. The data that the router automatically transmits to the Common Repository for Reporting and Statistics to that end should not allow for the identification of the passengers concerned.
__________________	__________________
36 Regulation (EU) 2018/1726 of the European Parliament and of the Council of 14 November 2018 on the European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA), and amending Regulation (EC) No 1987/2006 and Council Decision 2007/533/JHA and repealing Regulation (EU) No 1077/2011 (OJ L 295, 21.11.2018, p. 99).	36 Regulation (EU) 2018/1726 of the European Parliament and of the Council of 14 November 2018 on the European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA), and amending Regulation (EC) No 1987/2006 and Council Decision 2007/533/JHA and repealing Regulation (EU) No 1077/2011 (OJ L 295, 21.11.2018, p. 99).
37 Regulation (EU) 2019/817 of the European Parliament and of the Council of 20 May 2019 on establishing a framework for interoperability between EU information systems in the field of borders and visa and amending Regulations (EC) No 767/2008, (EU) 2016/399, (EU) 2017/2226, (EU) 2018/1240, (EU) 2018/1726 and (EU) 2018/1861 of the European Parliament and of the Council and Council Decisions 2004/512/EC and 2008/633/JHA (OJ L 135, 22.5.2019, p. 27).	37 Regulation (EU) 2019/817 of the European Parliament and of the Council of 20 May 2019 on establishing a framework for interoperability between EU information systems in the field of borders and visa and amending Regulations (EC) No 767/2008, (EU) 2016/399, (EU) 2017/2226, (EU) 2018/1240, (EU) 2018/1726 and (EU) 2018/1861 of the European Parliament and of the Council and Council Decisions 2004/512/EC and 2008/633/JHA (OJ L 135, 22.5.2019, p. 27).

Amendment 29

Proposal for a regulation

Recital 31

Text proposed by the Commission	Amendment
(31) In order to adopt measures relating to the technical requirements and operational rules for the automated means for the collection of machine-readable API data, to the common protocols and formats to be used for the transfer of API data by air carriers, to the technical and procedural rules for the transmission of API data from the router to the competent border authorities and to the PIUs and to the PIU’s and air carriers’ connections to and integration with the router, the power to adopt acts in accordance with Article 290 of the Treaty on the Functioning of the European Union should be delegated to the Commission in respect of Articles 5, 6, 11, 20 and 21 respectively. It is of particular importance that the Commission carry out appropriate consultations during its preparatory work, including at expert level, and that those consultations be conducted in accordance with the principles laid down in the Interinstitutional Agreement on Better Law-Making of 13 April 201638 . In particular, to ensure equal participation in the preparation of delegated acts, the European Parliament and the Council receive all documents at the same time as Member States’ experts, and their experts systematically have access to meetings of Commission expert groups dealing with the preparation of delegated acts.	(31) In order to adopt measures relating to the technical requirements and operational rules for the automated means for the collection of machine-readable API data, to the common protocols and formats to be used for the transfer of API data by air carriers, to the technical and procedural rules for the transmission of API data from the router to the competent border authorities and to the PIUs and to the PIU’s and air carriers’ connections to and integration with the router, the power to adopt acts in accordance with Article 290 of the Treaty on the Functioning of the European Union should be delegated to the Commission in respect of Articles 5, 6, 11, 20 and 21 respectively. It is of particular importance that the Commission carry out appropriate consultations with relevant stakeholders, including air carriers, during its preparatory work, including at expert level, and that those consultations be conducted in accordance with the principles laid down in the Interinstitutional Agreement on Better Law-Making of 13 April 201638 . In particular, to ensure equal participation in the preparation of delegated acts, the European Parliament and the Council receive all documents at the same time as Member States’ experts, and their experts systematically have access to meetings of Commission expert groups dealing with the preparation of delegated acts. Taking into account the state of the art, these technical requirements and rules might change over time.
__________________	__________________
38 OJ L 123, 12.5.2016, p. 1.	38 OJ L 123, 12.5.2016, p. 1.

Amendment 30

Proposal for a regulation

Recital 31 a (new)

Text proposed by the Commission	Amendment
	(31a) It is important to collect reliable and useful statistics based on the implementation of this Regulation in order to support its objectives and inform the evaluations under this Regulation. Such statistics should not contain any personally identifiable data. All relevant stakeholders, including relevant Member State authorities, Europol and, where appropriate, air carriers, should have access to those statistics.

Amendment 31

Proposal for a regulation

Recital 34 a (new)

Text proposed by the Commission	Amendment
	(34a) This Regulation should be subject to regular evaluations to ensure the monitoring of its effective application. In particular, the collection of API data should not be to the detriment of the travel experience of legitimate passengers. Therefore, the Commission should include in its regular evaluation reports on the application of this Regulation an assessment of the impact of this Regulation on the travel experience of legitimate passengers.

Amendment 32

Proposal for a regulation

Recital 34 b (new)

Text proposed by the Commission	Amendment
	(34b) Given that this Regulation requires additional adjustment and administrative costs by the air carriers, the overall regulatory burden for the aviation sector should be kept under close review. Against this backdrop, the report evaluating the functioning of this Regulation should assess the extent to which the objectives of the Regulation have been met and to which extent it has impacted the competitiveness of the sector. Therefore, the Commission’s report should also conduct a holistic assessment and refer to the interaction of this Regulation with other relevant Union legislative acts, in particular Regulations (EU) 2017/2226, (EU) 2018/1240 and (EC) 767/2008. The report should assess the overall impact of related reporting obligations on air carriers, identifying provisions that could be updated and simplified, where appropriate, to mitigate the burden on air carriers, as well as actions and measures that have been or could be taken to reduce the total cost pressure on the aviation sector.

Amendment 33

Proposal for a regulation

Recital 35

Text proposed by the Commission	Amendment
(35) This Regulation should not affect the possibility for Member States to provide, under their national law, for a system of collecting API data from transportation providers other than those specified in this Regulation, provided that such national law complies with Union law.	deleted

Amendment 34

Proposal for a regulation

Article 1 – paragraph 1 – subparagraph 1 a (new)

Text proposed by the Commission	Amendment
	This Regulation is without prejudice to Regulations (EU) 2016/679 and (EU) 2018/1725.

Amendment 35

Proposal for a regulation

Article 3 – paragraph 1 – point e

Text proposed by the Commission	Amendment
(e) ‘scheduled flight’ means a flight that operates according to a fixed timetable, for which tickets can be purchased by the general public;	(e) ‘scheduled flight’ means a commercial flight that operates according to a fixed timetable, for which tickets can be purchased by the general public;

Amendment 36

Proposal for a regulation

Article 3 – paragraph 1 – point f

Text proposed by the Commission	Amendment
(f) ‘non-scheduled flight’ means a flight that does not operate according to a fixed timetable and that is not necessarily part of a regular or scheduled route;	(f) ‘non-scheduled flight’ means a commercial flight that does not operate according to a fixed timetable and that is not necessarily part of a regular or scheduled route;

Amendment 37

Proposal for a regulation

Article 3 – paragraph 1 – point h

Text proposed by the Commission	Amendment
(h) ‘passenger’ means any person, excluding members of the crew, carried or to be carried in an aircraft with the consent of the air carrier, such consent being manifested by that person's registration in the passengers list;	(h) ‘passenger’ means any person, excluding members of the crew unless they are off duty, carried or to be carried in an aircraft with the consent of the air carrier, such consent being manifested by that person's registration in the passengers list;

Amendment 38

Proposal for a regulation

Article 3 – paragraph 1 – point j

Text proposed by the Commission	Amendment
(j) ‘traveller’ means a passenger or crew member;	deleted

Amendment 39

Proposal for a regulation

Article 3 – paragraph 1 – point k

Text proposed by the Commission	Amendment
(k) ‘Advance Passenger Information data’ or ‘API data’ means the traveller data and the flight information referred to in Article 4(2) and (3) respectively;	(k) ‘Advance Passenger Information data’ or ‘API data’ means the passenger data and the flight information referred to in Article 4(2) and (3) respectively;

Amendment 40

Proposal for a regulation

Article 3 – paragraph 1 – point l

Text proposed by the Commission	Amendment
(l) ‘Passenger Information Unit’ or ‘PIU’ means the competent authority referred to in Article 3, point i, of Regulation (EU) [API law enforcement];	(l) ‘Passenger Information Unit’ or ‘PIU’ means the competent authority referred to in Article 3, point k, of Regulation (EU) [API law enforcement];

Amendment 41

Proposal for a regulation

Article 4 – paragraph 1

Text proposed by the Commission	Amendment
1. Air carriers shall collect API data of travellers, consisting of the traveller data and the flight information specified in paragraphs 2 and 3 of this Article, respectively, on the flights referred to in Article 2, for the purpose of transferring that API data to the router in accordance with Article 6.	1. Air carriers shall collect API data of passengers, consisting of the passenger data and the flight information specified in paragraphs 2 and 3 of this Article, respectively, on the flights referred to in Article 2, for the purpose of transferring that API data to the router in accordance with Article 6. Where the flight is code-shared between one or more air carriers, the obligation to transfer the API data shall be on the air carrier that operates the flight.

Amendment 42

Proposal for a regulation

Article 4 – paragraph 2 – introductory part

Text proposed by the Commission	Amendment
2. The API data shall consist of the following traveller data relating to each traveller on the flight:	2. The API data shall consist only of the following passenger data relating to each passenger on the flight:

Amendment 43

Proposal for a regulation

Article 4 – paragraph 2 – point e

Text proposed by the Commission	Amendment
(e) whether the traveller is a passenger or a crew member (traveller’s status);	deleted

Amendment 44

Proposal for a regulation

Article 4 – paragraph 2 – point g

Text proposed by the Commission	Amendment
(g) the seating information, such as the number of the seat in the aircraft assigned to a passenger, where the air carrier collects such information;	(g) the number of the seat in the aircraft assigned to a passenger, where the air carrier collects such information;

Amendment 45

Proposal for a regulation

Article 4 – paragraph 2 – point h

Text proposed by the Commission	Amendment
(h) baggage information, such as number of checked bags, where the air carrier collects such information.	(h) number and the weight of checked bags, where the air carrier collects such information.

Amendment 46

Proposal for a regulation

Article 4 – paragraph 3 – introductory part

Text proposed by the Commission	Amendment
3. The API data shall also consist of the following flight information relating to the flight of each traveller:	3. The API data shall also only consist of the following flight information relating to the flight of each passenger:

Amendment 47

Proposal for a regulation

Article 4 – paragraph 3 – point a

Text proposed by the Commission	Amendment
(a) the flight identification number or, if no such number exists, other clear and suitable means to identify the flight;	(a) the flight identification number or, where the flight is code-shared between one or more air carriers, the flight identification numbers, or, if no such number exists, other clear and suitable means to identify the flight;

Amendment 48

Proposal for a regulation

Article 5 – paragraph 1 – subparagraph 1 a (new)

Text proposed by the Commission	Amendment
	The collection of API data in accordance with the first subparagraph shall not include an obligation for air carriers to check the travel document at the moment of boarding the aircraft or an obligation for passengers to carry a travel document when travelling, without prejudice to acts of national law that are compatible with Union law.

Amendment 49

Proposal for a regulation

Article 5 – paragraph 2 – subparagraph 1

Text proposed by the Commission	Amendment
Air carriers shall collect the API data referred to Article 4(2), points (a) to (d), using automated means to collect the machine-readable data of the travel document of the traveller concerned. They shall do so in accordance with the detailed technical requirements and operational rules referred to in paragraph 4, where such rules have been adopted and are applicable.	Air carriers shall collect the API data referred to in Article 4(2), points (a) to (d), using automated means to collect the machine-readable data of the travel document of the passenger concerned. Air carriers shall collect that data during the check-in process, either as part of the online check-in or as part of the check-in at the airport. They shall do so in accordance with the detailed technical requirements and operational rules referred to in paragraph 4, once such rules have been adopted and are applicable, and, in particular, by using the most reliable automated means available to collect the machine-readable data of the respective travel document.

Amendment 50

Proposal for a regulation

Article 5 – paragraph 2 – subparagraph 1 a (new)

Text proposed by the Commission	Amendment
	The collection of API data by automated means shall not lead to the collection of any biometric data from the travel document.

Amendment 51

Proposal for a regulation

Article 5 – paragraph 2 – subparagraph 1 b (new)

Text proposed by the Commission	Amendment
	Where air carriers provide an online check-in process, they shall enable passengers to provide the API data referred to in Article 4(2), points (a) to (d), during the online check-in process, using automated means.

Amendment 52

Proposal for a regulation

Article 5 – paragraph 2 – subparagraph 2

Text proposed by the Commission	Amendment
However, where such use of automated means is not possible due to the travel document not containing machine-readable data, air carriers shall collect that data manually, in such a manner as to ensure compliance with paragraph 1.	However, where such use of automated means is not possible, air carriers shall collect that data manually either as part of the online check-in or as part of the check-in at the airport, in such a manner as to ensure compliance with paragraph 1.

Amendment 53

Proposal for a regulation

Article 5 – paragraph 3

Text proposed by the Commission	Amendment
3. Any automated means used by air carriers to collect API data under this Regulation shall be reliable, secure and up-to-date.	3. Any automated means used by air carriers to collect API data under this Regulation shall be reliable, secure and up-to-date. Air carriers shall ensure that API data is encrypted during the transmission of the data from the passenger to the air carriers.

Amendment 54

Proposal for a regulation

Article 5 – paragraph 4

Text proposed by the Commission	Amendment
4. The Commission is empowered to adopt delegated acts in accordance with Article 37 to supplement this Regulation by laying down detailed technical requirements and operational rules for the collection of the API data referred to in Article 4(2), points (a) to (d), using automated means in accordance with paragraph 2 and 3 of this Article.	4. The Commission is empowered to adopt delegated acts in accordance with Article 37 to supplement this Regulation by laying down detailed technical requirements and operational rules for the collection of the API data referred to in Article 4(2), points (a) to (d), using automated means in accordance with paragraph 2 and 3 of this Article, including on requirements for data security.

Amendment 55

Proposal for a regulation

Article 6 – paragraph 1

Text proposed by the Commission	Amendment
1. Air carriers shall transfer the API data to the router by electronic means. They shall do so in accordance with the detailed rules referred to in paragraph 3, where such rules have been adopted and are applicable.	1. Air carriers shall transfer the encrypted API data to the router by electronic means. They shall do so in accordance with the detailed rules referred to in paragraph 3, once such rules have been adopted and are applicable.

Amendment 56

Proposal for a regulation

Article 6 – paragraph 2

Text proposed by the Commission	Amendment
2. Air carriers shall transfer the API data both at the moment of check-in and immediately after flight closure, that is, once the passengers have boarded the aircraft in preparation for departure and it is no longer possible for passengers to board or to leave the aircraft.	2. Air carriers shall transfer the API data both at the moment of check-in and immediately after flight closure, that is, once the passengers have boarded the aircraft in preparation for departure and it is no longer possible for passengers to board or to leave the aircraft. At the moment of check-in, air carriers shall transfer the API data in accordance with this Regulation and relevant international standards. Air carriers shall receive an acknowledgement of receipt of the transfer of the API data.

Amendment 57

Proposal for a regulation

Article 6 – paragraph 3

Text proposed by the Commission	Amendment
3. The Commission is empowered to adopt delegated acts in accordance with Article 37 to supplement this Regulation by laying down the necessary detailed rules on the common protocols and supported data formats to be used for the transfers of API data to the router referred to in paragraph 1.	3. The Commission is empowered to adopt delegated acts in accordance with Article 37 to supplement this Regulation by laying down the necessary detailed rules on the common protocols and supported data formats to be used for the encrypted transfers of API data to the router referred to in paragraph 1, including the transfer of API data at the moment of check-in, the meaningful reply and requirements for data security. Such detailed rules shall ensure that airlines transmit API data using the same structure and content.

Amendment 58

Proposal for a regulation

Article 6 – paragraph 4

Text proposed by the Commission	Amendment
4. Where an air carrier becomes aware, after having transferred data to the router, that the API data is inaccurate, incomplete, no longer up-to-date or was processed unlawfully, or that the data does not constitute API data, it shall immediately inform the European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA). Upon receiving such information, eu-LISA shall immediately inform the competent border authority that received the API data transmitted through the router.	deleted

Amendment 59

Proposal for a regulation

Article 7 – paragraph 1 a (new)

Text proposed by the Commission	Amendment
	The competent border authorities shall be prohibited from processing API data for the purposes of profiling under any circumstances.

Amendment 60

Proposal for a regulation

Article 8 – paragraph 1

Text proposed by the Commission	Amendment
1. Air carriers shall store, for a time period of 48 hours from the moment of departure of the flight, the API data relating to that passenger that they collected pursuant to Article 4. They shall immediately and permanently delete that API data after the expiry of that time period.	1. Air carriers shall store, for a time period of 24 hours from the moment of departure of the flight, the API data relating to that passenger that they collected pursuant to Article 4. They shall immediately and permanently delete that API data after the expiry of that time period. This shall be without prejudice to the possibility for air carriers to retain and use the data where necessary for the normal course of their business, in particular for travel facilitation, in compliance with the applicable law and in particular Regulation (EU) 2016/679.

Amendment 61

Proposal for a regulation

Article 8 – paragraph 2

Text proposed by the Commission	Amendment
2. The competent border authorities shall store, for a time period of 48 hours from the moment of departure of the flight, the API data relating to that passenger that they received through the router pursuant to Article 11. They shall immediately and permanently delete that API data after the expiry of that time period.	2. The competent border authorities shall store, for a time period of 24 hours from the moment of departure of the flight, the API data relating to that passenger that they received through the router pursuant to Article 11. They shall immediately and permanently delete that API data after the expiry of that time period.

Amendment 62

Proposal for a regulation

Article 8 – paragraph 2 a (new)

Text proposed by the Commission	Amendment
	2a. Air carriers or competent border authorities shall immediately either correct, complete or update, or permanently delete, the API data concerned in both of the following situations:
	(a) where they become aware that the API data collected is inaccurate, incomplete or no longer up-to-date;
	(b) where the transfer of the API data in accordance with Article 5(2) has been completed.

Amendment 63

Proposal for a regulation

Article 8 – paragraph 2 b (new)

Text proposed by the Commission	Amendment
	2b. Air carriers or competent border authorities shall immediately and permanently delete API data where they become aware that the API data collected was processed unlawfully or that the data transferred does not constitute API data.

Amendment 64

Proposal for a regulation

Article 8 – paragraph 2 c (new)

Text proposed by the Commission	Amendment
	2c. Where the air carriers become aware of the circumstances referred to in point (a) of paragraph 2a or paragraph 2b after having completed the transfer of the data in accordance with Article 6(1), they shall immediately inform the European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA). Upon receiving such information, eu-LISA shall immediately inform the competent border authority that received the API data transmitted through the router.

Amendment 65

Proposal for a regulation

Article 8 – paragraph 3

Text proposed by the Commission	Amendment
3. Where an air carrier or competent border authority becomes aware that the data that it has collected, transferred or received under to this Regulation is inaccurate, incomplete, no longer up-to-date or was processed unlawfully, or that the data does not constitute API data, it shall immediately either correct, complete or update, or permanently delete, that API data. This is without prejudice to the possibility for air carriers to retain and use the data where necessary for the normal course of their business in compliance with the applicable law.	deleted

Amendment 66

Proposal for a regulation

Article 8 a (new)

Text proposed by the Commission	Amendment
	Article 8a
	Fundamental Rights
	1. Collection and processing of personal data in accordance with this Regulation and Regulation (EU) [API law enforcement] by air carriers and competent authorities shall not result in discrimination against persons on the grounds of sex and gender, race, colour, ethnic or social origin, genetic features, language, religion or belief, political or any other opinion, membership of a national minority, property, birth, disability, age or sexual orientation.
	2. This Regulation shall fully respect human dignity and the fundamental rights and principles recognised by the Charter, including the right to respect for one’s private life, to asylum, to the protection of personal data, to freedom of movement and to effective legal remedies.
	3. Particular attention shall be paid to children, the elderly, persons with a disability and vulnerable persons. The best interests of the child shall be a primary consideration when implementing this Regulation.

Amendment 67

Proposal for a regulation

Article 9 – paragraph 1

Text proposed by the Commission	Amendment
1. eu-LISA shall design, develop, host and technically manage, in accordance with Articles 22 and 23, a router for the purpose of facilitating the transfer of API data by the air carriers to the competent border authorities and to the PIUs in accordance with this Regulation and Regulation (EU) [API law enforcement], respectively.	1. eu-LISA shall design, develop, host and technically manage, in accordance with Articles 22 and 23, a router for the purpose of facilitating the transfer of encrypted API data by the air carriers to the competent border authorities in accordance with this Regulation.

Amendment 68

Proposal for a regulation

Article 9 – paragraph 2 – point b

Text proposed by the Commission	Amendment
(b) a secure communication channel between the central infrastructure and the competent border authorities and the PIUs, and a secure communication channel between the central infrastructure and the air carriers, for the transfer of API data and for any communications relating thereto.	(b) a secure communication channel between the central infrastructure and the competent border authorities and a secure communication channel between the central infrastructure and the air carriers, for the transfer and transmission of API data and for any communications relating thereto.

Amendment 69

Proposal for a regulation

Article 9 – paragraph 2 a (new)

Text proposed by the Commission	Amendment
	2a. The router shall allow for the reception and transmission of encrypted API data.

Amendment 70

Proposal for a regulation

Article 9 – paragraph 2 b (new)

Text proposed by the Commission	Amendment
	2b. The router shall automatically extract and make available the statistics, in accordance with Article 31, to the central repository for reporting and statistics.

Amendment 71

Proposal for a regulation

Article 9 – paragraph 3

Text proposed by the Commission	Amendment
3. Without prejudice to Article 10 of this Regulation, the router shall, to the extent technically possible, share and re-use the technical components, including hardware and software components, of the web service referred to in Article 13 of Regulation (EU) 2017/2226 of the European Parliament and of the Council48 , the carrier gateway referred to in Article 6(2), point (k), of Regulation (EU) 2018/1240, and the carrier gateway referred to in Article 2a, point (h), of Regulation (EC) 767/2008 of the European Parliament and of the Council49 .	3. Without prejudice to Article 10 of this Regulation, the router shall, if appropriate and to the extent technically possible, share and re-use the hardware and software components, of the web service referred to in Article 13 of Regulation (EU) 2017/2226 of the European Parliament and of the Council48 , the carrier gateway referred to in Article 6(2), point (k), of Regulation (EU) 2018/1240, and the carrier gateway referred to in Article 2a, point (h), of Regulation (EC) 767/2008 of the European Parliament and of the Council49 . eu-LISA shall design the router, to the extent technically and operationally possible, in a way that is coherent and consistent with the obligations put on air carriers by Regulations (EU) 2017/2226, (EU) 2018/1240 and (EC) 767/2008.
__________________	__________________
48 Regulation (EU) 2017/2226 of the European Parliament and of the Council of 30 November 2017 establishing an Entry/Exit System (EES) to register entry and exit data and refusal of entry data of third-country nationals crossing the external borders of the Member States and determining the conditions for access to the EES for law enforcement purposes, and amending the Convention implementing the Schengen Agreement and Regulations (EC) No 767/2008 and (EU) No 1077/2011 (OJ L 327, 9.12.2017, p. 20).	48 Regulation (EU) 2017/2226 of the European Parliament and of the Council of 30 November 2017 establishing an Entry/Exit System (EES) to register entry and exit data and refusal of entry data of third-country nationals crossing the external borders of the Member States and determining the conditions for access to the EES for law enforcement purposes, and amending the Convention implementing the Schengen Agreement and Regulations (EC) No 767/2008 and (EU) No 1077/2011 (OJ L 327, 9.12.2017, p. 20).
49 Regulation (EC) No 767/2008 of the European Parliament and of the Council of 9 July 2008 concerning the Visa Information System (VIS) and the exchange of data between Member States on short-stay visas (VIS Regulation) (OJ L 218, 13.8.2008, p. 60).	49 Regulation (EC) No 767/2008 of the European Parliament and of the Council of 9 July 2008 concerning the Visa Information System (VIS) and the exchange of data between Member States on short-stay visas (VIS Regulation) (OJ L 218, 13.8.2008, p. 60).

Amendment 72

Proposal for a regulation

Article 9 – paragraph 3 a (new)

Text proposed by the Commission	Amendment
	3a. eu-LISA shall design and develop the router in a way that any API data transferred from the air carriers to the router in accordance with Article 6 and any API data transmitted from the router to the competent border authorities in accordance with Article 11 and to the central repository for reporting and statistics in accordance with Article 31(2) are encrypted.

Amendment 73

Proposal for a regulation

Article 10 – paragraph 1

Text proposed by the Commission	Amendment
The router shall only be used by air carriers to transfer API data and by competent border authorities and PIUs to receive API data, in accordance with this Regulation and Regulation (EU) [API law enforcement], respectively.	Notwithstanding the use of the router in Article 4b (new) of Regulation (EU) [API law enforcement], the router shall only be used:
	(a) by air carriers to transfer encrypted API data in accordance with this Regulation;
	(b) by the competent border authorities to receive encrypted API data in accordance with this Regulation.

Amendment 74

Proposal for a regulation

Article 10 a (new)

Text proposed by the Commission	Amendment
	Article 10a
	Data format and transfer verifications
	1. The router shall, in an automated manner and based on real-time flight traffic data, verify whether the air carrier transferred the API data in accordance with Article 6(1).
	2. The router shall, immediately and in an automated manner, verify whether the API data transferred to it in accordance with Article 6(1) complies with the detailed rules on the supported data formats, referred to in Article 6(3).
	3. Where the router has verified in accordance with paragraph 1 that the data was not transferred by the air carrier or where the data in question is not compliant with the detailed rules referred to in paragraph 2, the router shall, immediately and in an automated manner, notify the air carrier concerned and the competent border authorities of the Member States to which the data were to be transmitted pursuant to Article 11(1). In this case, the air carrier shall immediately transfer the API data in accordance with Article 6.
	4. The Commission shall adopt implementing acts specifying the necessary detailed technical and procedural rules for the verifications and notifications referred to in paragraphs 1, 2 and 3 of this Article. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 36(2).

Amendment 75

Proposal for a regulation

Article 11 – paragraph 1 – subparagraph 1

Text proposed by the Commission	Amendment
The router shall, immediately and in an automated manner, transmit the API data, transferred to it pursuant to Article 6, to the competent border authorities of the Member State referred to in Article 4(3), point (c). It shall do so in accordance with the detailed rules referred to in paragraph 4 of this Article, where such rules have been adopted and are applicable.	Upon the verifications referred to in Article 10a, the router shall, immediately and in an automated manner, transmit the encrypted API data, transferred to it pursuant to Article 6, to the competent border authorities of the Member State referred to in Article 4(3), point (c). It shall do so in accordance with the detailed rules referred to in paragraph 4 of this Article, once such rules have been adopted and are applicable.

Amendment 76

Proposal for a regulation

Article 11 – paragraph 3

Text proposed by the Commission	Amendment
3. The Member States shall ensure that only the duly authorised staff of the competent border authorities have access to the API data transmitted to them through the router. They shall lay down the necessary rules to that effect. Those rules shall include rules on the creation and regular update of a list of those staff and their profiles.	3. The Member States shall ensure that only the duly authorised and trained staff of the competent border authorities, designated in accordance with paragraph 2, have access to the API data transmitted to them through the router. They shall lay down the necessary rules to that effect. Those rules shall include rules on the creation and regular update of a list of those staff and their profiles.

Amendment 77

Proposal for a regulation

Article 11 – paragraph 4

Text proposed by the Commission	Amendment
4. The Commission is empowered to adopt delegated acts in accordance with Article 37 to supplement this Regulation by laying down the necessary detailed technical and procedural rules for the transmissions of API data from the router referred to in paragraph 1.	4. The Commission is empowered to adopt delegated acts in accordance with Article 37 to supplement this Regulation by laying down the necessary detailed technical and procedural rules for the transmissions of encrypted API data from the router referred to in paragraph 1, including on requirements for data security.

Amendment 78

Proposal for a regulation

Article 12 – paragraph 1 – introductory part

Text proposed by the Commission	Amendment
API data, transferred to the router pursuant to this Regulation and Regulation (EU) [API law enforcement], shall be stored on the router only insofar as necessary to complete the transmission to the relevant competent borders authorities or PIUs, as applicable, in accordance with those Regulations and shall be deleted from the router, immediately, permanently and in an automated manner, in both of the following situations:	API data, transferred to the router pursuant to this Regulation, shall be stored on the router only insofar as necessary to complete the transmission to the relevant competent borders authorities and shall be deleted from the router, immediately, permanently and in an automated manner, in both of the following situations:

Amendment 79

Proposal for a regulation

Article 12 – paragraph 1 – point a

Text proposed by the Commission	Amendment
(a) where the transmission of the API data to the relevant competent border authorities or PIUs, as applicable, has been completed;	(a) where the transmission of the API data to the relevant competent border authorities has been completed;

Amendment 80

Proposal for a regulation

Article 12 – paragraph 1 – point a a (new)

Text proposed by the Commission	Amendment
	(aa) in cases of technical impossibility of the router to subsequently transmit the API data to the competent border authorities, after 12 hours.

Amendment 81

Proposal for a regulation

Article 12 – paragraph 1 – point b

Text proposed by the Commission	Amendment
(b) in respect of Regulation (EU) [API law enforcement], where the API data relates to other intra-EU flights than those included the lists referred to in Article 5(2) of that Regulation.	deleted

Amendment 82

Proposal for a regulation

Article 13 – paragraph 1 – subparagraph 1 – introductory part

Text proposed by the Commission	Amendment
eu-LISA shall keep logs of all processing operations relating to the transfer of API data through the router under this Regulation and Regulation (EU) [API law enforcement]. Those logs shall cover the following:	eu-LISA shall keep logs of all processing operations relating to the transfer of API data through the router under this Regulation. Those logs shall cover:

Amendment 83

Proposal for a regulation

Article 13 – paragraph 1 – subparagraph 1 – point b

Text proposed by the Commission	Amendment
(b) the competent border authorities and PIUs to which the API data was transmitted through the router;	(b) the competent border authorities to which the API data was transmitted through the router;

Amendment 84

Proposal for a regulation

Article 13 – paragraph 2

Text proposed by the Commission	Amendment
2. Air carriers shall create logs of all processing operations under this Regulation undertaken by using the automated means referred to in Article 5(2). Those logs shall cover the date, time and place of transfer of the API data.	2. Air carriers shall create logs of all processing operations under this Regulation undertaken by using the automated means referred to in Article 5(2). Those logs shall cover the date, time and place of transfer of the API data. Those logs shall not contain any personal data, other than the information necessary to identify the relevant member of the staff of the air carrier.

Amendment 85

Proposal for a regulation

Article 13 – paragraph 3

Text proposed by the Commission	Amendment
3. The logs referred to in paragraphs 1 and 2 shall be used only for ensuring the security and integrity of the API data and the lawfulness of the processing, in particular as regards compliance with the requirements set out in this Regulation and Regulation (EU) [API Law Enforcement], including proceedings for penalties for infringements of those requirements in accordance with Articles 29 and 30 of this Regulation.	3. The logs referred to in paragraphs 1 and 2 shall be used only for ensuring the security and integrity of the API data and the lawfulness of the processing, in particular as regards compliance with the requirements set out in this Regulation, including proceedings for penalties for infringements of those requirements in accordance with Articles 29 and 30 of this Regulation.

Amendment 86

Proposal for a regulation

Article 13 – paragraph 4

Text proposed by the Commission	Amendment
4. eu-LISA and the air carriers shall take appropriate measures to protect the logs that they created pursuant to paragraphs 1 and 2, respectively, against unauthorised access and other security risks.	4. eu-LISA and air carriers shall take appropriate measures to protect the logs that they created pursuant to paragraphs 1 and 2, respectively, against unauthorised access and other security risks.

Amendment 87

Proposal for a regulation

Article 13 – paragraph 4 a (new)

Text proposed by the Commission	Amendment
	4a. The national supervisory authorities referred to in Article 29 and competent authorities shall have access to the relevant logs referred to in paragraph 1 where necessary for the purposes referred to in paragraph 3.

Amendment 88

Proposal for a regulation

Article 13 – paragraph 5 – subparagraph 2

Text proposed by the Commission	Amendment
However, if those logs are needed for procedures for monitoring or ensuring the security and integrity of the API data or the lawfulness of the processing operations, as referred to in paragraph 2, and these procedures have already begun at the moment of the expiry of the time period referred to in the first subparagraph, eu-LISA and the air carriers may keep those logs for as long as necessary for those procedures. In that case, they shall immediately delete those logs when they are no longer necessary for those procedures.	However, if those logs are needed for procedures for monitoring or ensuring the security and integrity of the API data or the lawfulness of the processing operations, as referred to in paragraph 2, and these procedures have already begun at the moment of the expiry of the time period referred to in the first subparagraph, eu-LISA and the air carriers may keep those logs for as long as necessary for those procedures, provided that eu-LISA or the air carriers inform the Commission of the need to keep those logs and provide reasons for doing so. In that case, they shall immediately delete those logs when they are no longer necessary for those procedures.

Amendment 89

Proposal for a regulation

Article 15 – paragraph 1

Text proposed by the Commission	Amendment
The competent border authorities shall be controllers, within the meaning of Article 4, point (7), of Regulation (EU) 2016/679, in relation to the processing of API data constituting personal data through the router , including the transmission and the storage for technical reasons of that data in the router, as well as in relation to their processing of API data constituting personal data referred to in Article 7 of this Regulation.	The competent border authorities shall be controllers, within the meaning of Article 4, point (7), of Regulation (EU) 2016/679, in relation to the processing of API data constituting personal data through the router, including the transmission of the data from the router to the authorities and the storage for technical reasons of that data in the router, as well as in relation to their processing of API data constituting personal data referred to in Article 7 of this Regulation.

Amendment 90

Proposal for a regulation

Article 16 – paragraph 1

Text proposed by the Commission	Amendment
eu-LISA shall be the processor within the meaning of Article 3, point (12), of Regulation (EU) 2018/1725 for the processing of API data constituting personal data through the router in accordance with this Regulation and Regulation (EU) [API law enforcement].	eu-LISA shall be the processor on behalf of the competent border authorities within the meaning of Article 3, point (12), of Regulation (EU) 2018/1725 for the processing of API data constituting personal data through the router in accordance with this Regulation.

Amendment 91

Proposal for a regulation

Article 16 a (new)

Text proposed by the Commission	Amendment
	Article16a
	Information to passengers
	In accordance with the right of information in Article 13 of Regulation (EU) 2016/679, air carriers shall provide passengers, on flights covered by this Regulation, with information on the purpose of the collection of their personal data, the type of personal data collected, the recipients of the personal data and the means to exercise the data subject rights.
	This information shall be communicated to passengers in writing and in an easily accessible format at the moment of booking and at the moment of check-in, irrespective of the means used to collect the personal data at the moment of check-in in accordance with Article 5.

Amendment 92

Proposal for a regulation

Article 17 – paragraph -1 (new)

Text proposed by the Commission	Amendment
	-1. Competent border authorities and air carriers shall ensure the security of the API data, in particular API data constituting personal data, that they process pursuant to this Regulation.

Amendment 93

Proposal for a regulation

Article 17 – paragraph -1 a (new)

Text proposed by the Commission	Amendment
	-1a. Competent border authorities and air carriers shall cooperate, in accordance with their respective responsibilities and in compliance with Union law, with each other and with eu-LISA to ensure such security.

Amendment 94

Proposal for a regulation

Article 17 – paragraph 1

Text proposed by the Commission	Amendment
1. eu-LISA shall ensure the security of the API data, in particular API data constituting personal data, that it processes pursuant to this Regulation and Regulation (EU) [API law enforcement]. The competent border authorities and the air carriers shall ensure the security of the API data, in particular API data constituting personal data, that they process pursuant to this Regulation. eu-LISA, the competent border authorities and the air carriers shall cooperate, in accordance with their respective responsibilities and in compliance with Union law, with each other to ensure such security.	1. eu-LISA shall ensure the security and encryption of the API data, in particular API data constituting personal data, that it processes pursuant to this Regulation. The competent border authorities and the air carriers shall ensure the security of the API data, in particular API data constituting personal data, that they process pursuant to this Regulation. eu-LISA, the competent border authorities and the air carriers shall cooperate, in accordance with their respective responsibilities and in compliance with Union law, with each other to ensure such security.

Amendment 95

Proposal for a regulation

Article 17 – paragraph 2 – subparagraph 1 – point c

Text proposed by the Commission	Amendment
(c) ensure that it is possible to verify and establish to which competent border authorities or PIUs the API data is transmitted through the router;	(c) ensure that it is possible to verify and establish to which competent border authorities the API data is transmitted through the router;

Amendment 96

Proposal for a regulation

Article 18 – paragraph 1

Text proposed by the Commission	Amendment
The air carriers and competent authorities shall monitor their compliance with their respective obligations under this Regulation, in particular as regards their processing of API data constituting personal data, including through frequent verification of the logs referred to in Article 13.	The air carriers and competent authorities shall monitor their compliance with their respective obligations under this Regulation, in particular as regards their processing of API data constituting personal data, including through frequent verification of the logs in accordance with Article 13.

Amendment 97

Proposal for a regulation

Article 19 – paragraph 1

Text proposed by the Commission	Amendment
1. The competent national data protection authorities referred to in Article 51 of Regulation (EU) 2016/679 shall ensure that an audit of processing operations of API data constituting personal data performed by the competent border autorities for the purposes of this Regulation is carried out, in accordance with relevant international auditing standards, at least once every four years.	1. The independent supervisory authorities referred to in Article 51 of Regulation (EU) 2016/679 shall ensure that an audit of processing operations of API data constituting personal data performed by the competent border authorities for the purposes of this Regulation is carried out, in accordance with relevant international auditing standards, at least once every four years.

Amendment 98

Proposal for a regulation

Article 19 – paragraph 2

Text proposed by the Commission	Amendment
2. The European Data Protection Supervisor shall ensure that an audit of processing operations of API data constituting personal data performed by eu-LISA for the purposes of this Regulation and Regulation (EU) [API law enforcement] is carried out in accordance with relevant international auditing standards at least once every year. A report of that audit shall be sent to the European Parliament, to the Council, to the Commission, to the Member States and to eu-LISA. eu-LISA shall be given an opportunity to make comments before the reports are adopted.	2. The European Data Protection Supervisor shall carry out an audit of processing operations of API data constituting personal data performed by eu-LISA for the purposes of this Regulation, in accordance with relevant international auditing standards at least once every year. A report of that audit shall be sent to the European Parliament, to the Council, to the Commission, to the Member States and to eu-LISA. eu-LISA shall be given an opportunity to make comments before the reports are adopted.

Amendment 99

Proposal for a regulation

Article 20 – paragraph 1 – subparagraph 1

Text proposed by the Commission	Amendment
Member States shall ensure that their competent border authorities are connected to the router. They shall ensure that the competent border authorities’ systems and infrastructure for the reception of API data transferred purpsuant to this Regulation are integrated with the router.	Member States shall ensure that their competent border authorities are connected to the router. They shall ensure that the competent border authorities’ systems and infrastructure for the reception of API data transferred pursuant to this Regulation are integrated with the router.

Amendment 100

Proposal for a regulation

Article 20 – paragraph 2

Text proposed by the Commission	Amendment
2. The Commission is empowered to adopt delegated acts in accordance with Article 37 to supplement this Regulation by laying down the necessary detailed rules on the connections to and integration with the router referred to in paragraph 1.	2. The Commission is empowered to adopt delegated acts in accordance with Article 37 to supplement this Regulation by laying down the necessary detailed rules on the connections to and integration with the router referred to in paragraph 1, including on requirements for data security.

Amendment 101

Proposal for a regulation

Article 21 – paragraph 2

Text proposed by the Commission	Amendment
2. The Commission is empowered to adopt delegated acts in accordance with Article 37 to supplement this Regulation by laying down the necessary detailed rules on the connections to and integration with the router referred to in paragraph 1.	2. The Commission is empowered to adopt delegated acts in accordance with Article 37 to supplement this Regulation by laying down the necessary detailed rules on the connections to and integration with the router referred to in paragraph 1, including on requirements for data security.

Amendment 102

Proposal for a regulation

Article 22 – paragraph 3

Text proposed by the Commission	Amendment
3. eu-LISA shall ensure that the router is designed and developed in such a manner that the router provides the functionalities specified in this Regulation and Regulation (EU) [API law enforcement], and that the router starts operations as soon as possible after the adoption by the Commission of the delegated acts provided for in Article 5(4), Article 6(3), Article 11(4), Article 20(2) and Article 21(2).	3. eu-LISA shall ensure that the router is designed and developed in such a manner that the router provides the functionalities specified in this Regulation, and that the router starts operations as soon as possible after the adoption by the Commission of the delegated acts provided for in Article 5(4), Article 6(3), Article 11(4), Article 20(2) and Article 21(2) and after the carrying out of a data protection impact assessment in accordance with Article 35 of Regulation (EU) 2016/679.

Amendment 103

Proposal for a regulation

Article 22 – paragraph 4

Text proposed by the Commission	Amendment
4. Where eu-LISA considers that the development phase has been completed, it shall, without undue delay, conduct a comprehensive test of the router, in cooperation with the competent border authorities, PIUs and other relevant Member States’ authorities and air carriers and inform the Commission of the outcome of that test.	4. Where eu-LISA considers that the development phase has been completed, it shall, without undue delay, conduct a comprehensive test of the router, in cooperation with the competent border authorities and other relevant Member States’ authorities and air carriers and inform the Commission of the outcome of that test.

Amendment 104

Proposal for a regulation

Article 23 – paragraph 2 – subparagraph 1

Text proposed by the Commission	Amendment
eu-LISA shall be responsible for the technical management of the router, including its maintenance and technical developments, in such a manner as to ensure that the API data are securely, effectively and swiftly transmitted through the router, in compliance with this Regulation and Regulation (EU) [API law enforcement].	eu-LISA shall be responsible for the technical management of the router, including its maintenance and technical developments, in such a manner as to ensure that the API data are securely, effectively and swiftly transmitted through the router, in compliance with this Regulation.

Amendment 105

Proposal for a regulation

Article 23 – paragraph 2 – subparagraph 2

Text proposed by the Commission	Amendment
The technical management of the router shall consist of carrying out all the tasks and enacting all technical solutions necessary for the proper functioning of the router in accordance with this Regulation, Regulation (EU) [API law enforcement], in an uninterrupted manner, 24 hours a day, 7 days a week. It shall include the maintenance work and technical developments necessary to ensure that the router functions at a satisfactory level of technical quality, in particular as regards availability, accuracy and reliability of the transmission of API data, in accordance with the technical specifications and, as much as possible, in line with the operational needs of the competent border authorities, PIUs and air carriers.	The technical management of the router shall consist of carrying out all the tasks and enacting all technical solutions necessary for the proper functioning of the router in accordance with this Regulation in an uninterrupted manner, 24 hours a day, 7 days a week. It shall include the maintenance work and technical developments necessary to ensure that the router functions at a satisfactory level of technical quality, in particular as regards availability, accuracy and reliability of the transmission of API data, in accordance with the technical specifications and, as much as possible, in line with the operational needs of the competent border authorities and air carriers.

Amendment 106

Proposal for a regulation

Article 24 – paragraph 1

Text proposed by the Commission	Amendment
1. eu-LISA shall, upon their request, provide training to competent border authorities, PIUs and other relevant Member States’ authorities and air carriers on the technical use of the router.	1. eu-LISA shall, upon their request, provide training to competent border authorities and other relevant Member States’ authorities and air carriers on the technical use of the router and on the connection and integration to the router.

Amendment 107

Proposal for a regulation

Article 24 – paragraph 2

Text proposed by the Commission	Amendment
2. eu-LISA shall provide support to the competent border authorities and PIUs regarding the reception of API data through the router pursuant to this Regulation and Regulation (EU) [API law enforcement], respectively, in particular as regards the application of Articles 11 and 20 of this Regulation and Articles 5 and 10 of Regulation (EU) [API law enforcement].	2. eu-LISA shall provide support to the competent border authorities regarding the reception of API data through the router pursuant to this Regulation, in particular as regards the application of Articles 11 and 20.

Amendment 108

Proposal for a regulation

Article 25 – title

Text proposed by the Commission	Amendment
Costs of eu-LISA and of Member States	Costs of eu-LISA, the European Data Protection Supervisor, the national supervisory authorities and of Member States

Amendment 109

Proposal for a regulation

Article 25 – paragraph 1

Text proposed by the Commission	Amendment
1. Costs incurred by eu-LISA in relation to the design, development, hosting and technical management of the router under this Regulation and Regulation (EU) [API law enforcement] shall be borne by the general budget of the Union.	1. Costs incurred by eu-LISA in relation to the design, development, hosting and technical management of the router under this Regulation shall be borne by the general budget of the Union. In view of the Union interests at stake, in relation to its responsibilities for the design, development, hosting and technical management and maintenance of the router, eu-LISA shall be provided with the necessary resources under the Union budget in accordance with the applicable legislation.

Amendment 110

Proposal for a regulation

Article 25 – paragraph 2 – subparagraph 1

Text proposed by the Commission	Amendment
Costs incurred by Member States in relation to their connections to and integration with the router referred to in Article 20 shall be borne by the general budget of the Union.	Costs incurred by eu-LISA and Member States in relation to their connections to and integration with the router referred to in Article 20 shall be borne by the general budget of the Union.

Amendment 111

Proposal for a regulation

Article 25 – paragraph 2 a (new)

Text proposed by the Commission	Amendment
	2a. Costs incurred by the European Data Protection Supervisor in relation to the tasks entrusted to it under this Regulation shall be borne by the general budget of the Union.

Amendment 112

Proposal for a regulation

Article 25 – paragraph 2 b (new)

Text proposed by the Commission	Amendment
	2b. Costs incurred by independent national supervisory authorities in relation to the tasks entrusted to them under this Regulation shall be borne by the Member States.

Amendment 113

Proposal for a regulation

Article 28 – title

Text proposed by the Commission	Amendment
Voluntary use of the router in application of Directive 2004/81/EC	Voluntary use of the router in application of Directive 2004/82/EC

Amendment 114

Proposal for a regulation

Article 28 – paragraph 2

Text proposed by the Commission	Amendment
2. Where an air carrier starts using the router in accordance with paragraph 1, it shall continue using the router to transmit such information to the responsible authority concerned until the date of application of this Regulation referred to in Article 39, second subparagraph. However, that use shall be discontinued, from an appropriate date set by that authority, where that authority considers that there are objective reasons that require such discontinuation and has informed the air carrier accordingly.	2. Where an air carrier starts using the router in accordance with paragraph 1, it shall continue using the router to transmit such information to the responsible authorities of the Member State concerned until the date of application of this Regulation referred to in Article 39, second subparagraph. However, that use shall be discontinued, from an appropriate date set by that authority, where that authority considers that there are objective reasons that require such discontinuation and has informed the air carrier accordingly.

Amendment 115

Proposal for a regulation

Article 29 – paragraph 3

Text proposed by the Commission	Amendment
3. Member States shall, by the date of application of this Regulation referred to in Article 21, second subparagraph, notify the Commission of the name and the contact details of the authorities that they designated under paragraph 1 and of the detailed rules that they laid down pursuant to paragraph 2. They shall notify the Commission without delay of any subsequent changes or amendments thereto.	3. Member States shall, by the date of application of this Regulation referred to in Article 39, second subparagraph, notify the Commission of the name and the contact details of the authorities that they designated under paragraph 1 and of the detailed rules that they laid down pursuant to paragraph 2. They shall notify the Commission without delay of any subsequent changes or amendments thereto.

Amendment 116

Proposal for a regulation

Article 30 – paragraph 1

Text proposed by the Commission	Amendment
Member States shall lay down the rules on penalties applicable to infringements of this Regulation and shall take all measures necessary to ensure they are implemented. The penalties provided for shall be effective, proportionate and dissuasive penalties.	1. Member States shall lay down the rules on penalties applicable to infringements of this Regulation and shall take all measures necessary to ensure they are implemented. The penalties provided for shall be effective, proportionate and dissuasive penalties.
Member States shall, by the date of application of this Regulation referred to in Article 21, second subparagraph, notify the Commission of those rules and of those measures and shall notify it without delay of any subsequent amendment affecting them.	Member States shall, by the date of application of this Regulation referred to in Article 21, second subparagraph, notify the Commission of those rules and of those measures and shall notify it without delay of any subsequent amendment affecting them.

Amendment 117

Proposal for a regulation

Article 30 – paragraph 1 a (new)

Text proposed by the Commission	Amendment
	1a. Member States shall ensure that when deciding whether to impose a penalty and when determining the type and level of penalty, the national supervisory authorities take into account relevant circumstances, which may include:
	(a) the nature, gravity and duration of the infringement;
	(b) the degree of the air carrier's fault;
	(c) previous infringements by the air carrier;
	(d) the overall level of cooperation of the air carrier with the competent authorities;
	(e) the size of the air carrier, such as the annual number of passengers carried;
	(f) whether previous penalties have already been applied by other national API supervisory authorities to the same carrier for the same infringement.

Amendment 118

Proposal for a regulation

Article 30 – paragraph 1 b (new)

Text proposed by the Commission	Amendment
	1b. Member States shall ensure that a systematic or persistent failure to comply with obligations set out in this Regulation is subject to financial penalties of up to 2% of an air carrier's global turnover of the preceding business year.

Amendment 119

Proposal for a regulation

Article 31 – paragraph 1

Text proposed by the Commission	Amendment
1. Every quarter, eu-LISA shall publish statistics on the functioning of the router, showing in particular the number, the nationality and the country of departure of the travellers, and specifically of the travellers who boarded the aircraft with inaccurate, incomplete or no longer up-to-date API data, with a non-recognised travel document, without a valid visa, without a valid travel authorization, or reported as overstay, the number and nationality of travellers.	1. To support the implementation and supervision of this Regulation and based on the statistical information referred to in paragraph 5 of this Article, eu-LISA shall publish every quarter statistics on the functioning of the router, and on compliance by air carriers with the obligations set out in this Regulation. These statistics shall not allow for the identification of individuals.
	The statistics shall show in particular:
	(a) the number of passengers on which API data is transmitted,
	(b) the number of flights for which API data is transmitted,
	(c) the number of flights on which API data is not transmitted,
	(d) the number of API messages transmitted on time to competent border authorities,
	(e) the number of passengers who boarded the aircraft with inaccurate, incomplete or no longer up-to-date API data, with a non-recognised travel document.

Amendment 120

Proposal for a regulation

Article 31 – paragraph 2

Text proposed by the Commission	Amendment
2. eu-LISA shall store the daily statistics in the central repository for reporting and statistics established in Article 39 of Regulation (EU) 2019/817.	2. For the purposes set out in paragraph 1, the router shall automatically transmit the data listed in paragraph 5 to the central repository for reporting and statistics established in Article 39 of Regulation (EU) 2019/817.

Amendment 121

Proposal for a regulation

Article 31 – paragraph 3

Text proposed by the Commission	Amendment
3. At the end of each year, eu-LISA shall compile statistical data in an annual report for that year. It shall publish that annual report and transmit it to the European Parliament, the Council, the Commission, the European Data Protection Supervisor, the European Border and Coast Guard Agency and the national supervisory authorities referred to in Article 29.	3. In order to support the implementation and supervision of this Regulation, at the end of each year, eu-LISA shall compile statistical data in an annual report for that year. It shall publish that annual report and transmit it to the European Parliament, the Council, the Commission, the European Data Protection Supervisor, the European Border and Coast Guard Agency and the national supervisory authorities referred to in Article 29.

Amendment 122

Proposal for a regulation

Article 31 – paragraph 4

Text proposed by the Commission	Amendment
4. At the request of the Commission, eu-LISA shall provide it with statistics on specific aspects related to the implementation of this Regulation and Regulation (EU) [API Law enforcement] as well as the statistics pursuant to paragraph 3.	4. At the request of the Commission, eu-LISA shall provide it with statistics on specific aspects related to the implementation of this Regulation as well as the statistics pursuant to paragraph 3.

Amendment 123

Proposal for a regulation

Article 31 – paragraph 5 – introductory part

Text proposed by the Commission	Amendment
5. eu-LISA shall have the right to access the following API data transmitted through to the router, solely for the purposes of the reporting referred to in Article 38 and for generating statistics in accordance with the present Article, without however such access allowing for the identification of the travellers concerned:	5. The central repository for reporting and statistics shall provide eu-LISA with the statistical information necessary for the reporting referred to in Article 38 and for generating statistics in accordance with the present Article, without however such statistics on API allowing for the identification of the passengers concerned:

Amendment 124

Proposal for a regulation

Article 31 – paragraph 5 – point a

Text proposed by the Commission	Amendment
(a) whether the traveller is passenger or a crew member;	deleted

Amendment 125

Proposal for a regulation

Article 31 – paragraph 5 – point b

Text proposed by the Commission	Amendment
(b) the nationality, sex and year of birth of the traveller;	deleted

Amendment 126

Proposal for a regulation

Article 31 – paragraph 5 – point e

Text proposed by the Commission	Amendment
(e) the number of travellers checked-in on the same flight;	(e) the number of passengers checked-in on the same flight;

Amendment 127

Proposal for a regulation

Article 31 – paragraph 5 – point g

Text proposed by the Commission	Amendment
(g) whether the personal data of the traveller is accurate, complete and up-to-date.	(g) whether the personal data of the passenger is accurate, complete and up-to-date.

Amendment 128

Proposal for a regulation

Article 31 – paragraph 6

Text proposed by the Commission	Amendment
6. For the the purposes of the reporting referred to in Article 38 and for generating statistics in accordance with the present Article, eu-LISA shall store the data referred to in paragraph 5 of this Article in the central repository for reporting and statistics established by Article 39 of Regulation (EU) 2019/817. The cross-system statistical data and analytical reporting referred to in Article 39(1) of that Regulation shall allow the competent border authorities and other relevant authorities of the Member States to obtain customisable reports and statistics, for the purposes referred to in Article 1 of this Regulation.	6. For the purposes of the reporting referred to in Article 38 and for generating statistics in accordance with the present Article, eu-LISA shall store the data referred to in paragraph 5 of this Article in the central repository for reporting and statistics established by Article 39 of Regulation (EU) 2019/817. It shall store that data for a period of three years in accordance with paragraph 2, without the data allowing for the identification of the passengers concerned.
	The central repository for reporting and statistics shall provide duly authorised staff of the competent border authorities and other relevant authorities of the Member States with customisable reports and statistics on API as referred to in paragraph 5 for the implementation and supervision of this Regulation.

Amendment 129

Proposal for a regulation

Article 31 – paragraph 6 a (new)

Text proposed by the Commission	Amendment
	6a. The use of the data referred to in paragraph 5 of this Article for automated or non-automated risk analysis, profiling or predictive risk assessment shall be prohibited.

Amendment 130

Proposal for a regulation

Article 32 – paragraph 1

Text proposed by the Commission	Amendment
The Commission shall, in close cooperation with the competent border authorities, other relevant Member States’ authorities, the air carriers and relevant Union agencies, prepare and make publicly available a practical handbook, containing guidelines, recommendations and best practices for the implementation of this Regulation.	The Commission shall, in close cooperation with the competent border authorities, other relevant Member States’ authorities, the air carriers and relevant Union agencies, in particular the European Data Protection Supervisor and the Fundamental Rights Agency, prepare and make publicly available a practical handbook, containing guidelines, recommendations and best practices for the implementation of this Regulation, including on fundamental rights compliance as well as on penalties in accordance with Article 30.

Amendment 131

Proposal for a regulation

Article 32 a (new)

Text proposed by the Commission	Amendment
	Article 32a
	API Expert Group
	1. An API Expert Group shall be established with effect from [one month after the entry into force of this Regulation] in accordance with the horizontal rules on the creation and operation of Commission expert groups. It shall facilitate cooperation and the exchange of information on obligations stemming from and issues relating to this Regulation among Member States, EU institutions and stakeholders.
	2. The API Expert Group shall be composed of representatives of the European Commission, Member States’ relevant authorities, the European Parliament and eu-LISA. Where relevant for the performance of its tasks, the API Expert Group may invite relevant stakeholders, in particular representatives of air carriers, the EDPS and the independent national supervisory authorities, to participate in its work. The Commission’s representative shall chair the API Expert Group.

Amendment 132

Proposal for a regulation

Article 35 – paragraph 1

Regulation (EU) 2019/817

Article 39 – paragraph 2

Text proposed by the Commission	Amendment
2. eu-LISA shall establish, implement and host in its technical sites the CRRS containing the data and statistics referred to in Article 63 of Regulation (EU) 2017/2226, Article 17 of Regulation (EC) No 767/2008, Article 84 of Regulation (EU) 2018/1240, Article 60 of Regulation (EU) 2018/1861 and Article 16 of Regulation (EU) 2018/1860, logically separated by EU information system. eu-LISA shall also collect the data and statistics from the router referred to in Article 31(1) of Regulation (EU) …/… * [this Regulation]. Access to the CRRS shall be granted by means of controlled, secured access and specific user profiles, solely for the purpose of reporting and statistics, to the authorities referred to in Article 63 of Regulation (EU) 2017/2226, Article 17 of Regulation (EC) No 767/2008, Article 84 of Regulation (EU) 2018/1240, Article 60 of Regulation (EU) 2018/1861 and Article 38(2) of Regulation (EU) …/… [this Regulation ].	2. eu-LISA shall establish, implement and host in its technical sites the CRRS containing the data and statistics referred to in Article 63 of Regulation (EU) 2017/2226, Article 17 of Regulation (EC) No 767/2008, Article 84 of Regulation (EU) 2018/1240, Article 60 of Regulation (EU) 2018/1861 and Article 16 of Regulation (EU) 2018/1860, logically separated by EU information system. eu-LISA shall also collect the data and statistics from the router referred to in Article 31(1) of Regulation (EU) …/… * [this Regulation]. Access to the CRRS shall be granted by means of controlled, secured access and specific user profiles, solely for the purpose of reporting and statistics, to the authorities referred to in Article 63 of Regulation (EU) 2017/2226, Article 17 of Regulation (EC) No 767/2008, Article 84 of Regulation (EU) 2018/1240, Article 60 of Regulation (EU) 2018/1861 and Article 38(2) of Regulation (EU) …/… [this Regulation ]. Especially the use of the CRRS for risk analysis, profiling or predictive risk assessment shall be prohibited.

Amendment 133

Proposal for a regulation

Article 38 – paragraph 2

Text proposed by the Commission	Amendment
2. By [one year after the date of entry into force of this Regulation] and every year thereafter during the development phase of the router, eu-LISA shall produce a report, and submit it to the European Parliament and to the Council on the state of play of the development of the router. That report shall contain detailed information about the costs incurred and about any risks which may impact the overall costs to be borne by the general budget of the Union in accordance with Article 25.	2. By [one year after the date of entry into force of this Regulation] and every year thereafter during the development phase of the router, eu-LISA shall produce a report, and submit it to the European Parliament and to the Council on the state of play of the development of the router. That report shall contain detailed information about the costs incurred and about any risks which may impact the overall costs to be borne by the general budget of the Union in accordance with Article 25. From the date at which the router starts operations and every year thereafter, the Commission shall assess whether the budget under the MFF budget line 4.11.10.02 (“eu-LISA”) covers the needs necessary for good design, development, hosting and technical management of the router and, if appropriate, immediately propose amendment to the budget appropriations.

Amendment 134

Proposal for a regulation

Article 38 – paragraph 4 – introductory part

Text proposed by the Commission	Amendment
4. By [four years after the date of entry into force of this Regulation ] and every four years thereafter, the Commission shall produce a report containing an overall evaluation of this Regulation, including an assessment of:	4. By [four years after the date of entry into force of this Regulation ] and every four years thereafter, the Commission shall produce a report containing an overall evaluation of this Regulation, demonstrating the necessity and the added value of the collection of API data, including an assessment of:

Amendment 135

Proposal for a regulation

Article 38 – paragraph 4 – point c a (new)

Text proposed by the Commission	Amendment
	(ca) the impact of this Regulation on the travel experience of legitimate passengers.

Amendment 136

Proposal for a regulation

Article 38 – paragraph 4 – point c b (new)

Text proposed by the Commission	Amendment
	(cb) the impact of this Regulation on the competitiveness of the aviation sector and the burden incurred by businesses. The Commission’s report shall also address this Regulation’s interaction with other relevant Union legislative acts, in particular Regulations (EU) 2017/2226, (EU) 2018/1240 and (EC) 767/2008, in order to assess the overall impact of related reporting obligations on air carriers, identify provisions that could be updated and simplified, where appropriate, to mitigate the burden on air carriers, and consider actions and measures that could be taken to reduce the total cost pressure on air carriers.

Amendment 137

Proposal for a regulation

Article 38 – paragraph 4 a (new)

Text proposed by the Commission	Amendment
	4a. The evaluation referred to in paragraph 1 shall also include an assessment of the feasibility of including non-commercial business aviation within the scope of this Regulation.

Amendment 138

Proposal for a regulation

Article 38 – paragraph 6

Text proposed by the Commission	Amendment
6. The Member States and air carriers shall, upon request, provide eu-LISA and the Commission with the information necessary to draft the reports referred to in paragraphs 2, 3 and 4, including information not constituting personal data related to the results of the pre-checks of Union information systems and national databases at the external borders with API data. However, Member States may refrain from providing such information if, and to the extent necessary not to disclose confidential working methods or jeopardise ongoing investigations of the competent border authorities. The Commission shall ensure that any confidential information provided is appropriately protected.	6. The Member States and air carriers shall, upon request, provide eu-LISA and the Commission with the information necessary to draft the reports referred to in paragraphs 2, 3 and 4, including information not constituting personal data related to the results of the pre-checks of Union information systems and national databases at the external borders with API data. In particular, Member States shall provide quantitative and qualitative information on the necessity and added value of the collection of API data from an operational perspective. However, Member States may refrain from providing such information if, and to the extent necessary not to disclose confidential working methods or jeopardise ongoing investigations of the competent border authorities. The Commission shall ensure that any confidential information provided is appropriately protected.

EXPLANATORY STATEMENT

This Regulation updates and replaces Directive 2004/82/EC, the existing legal framework on API data that intents to facilitate external border controls, combat illegal immigration and increase internal security. Whereas Directive 2004/82/EC has proven effective in improving border controls, its divergent application at national level has created inconsistencies, which are now being addressed by the new rules proposed by the Commission.

More specifically, this Regulation introduces:

1) provisions for the collection and transfer of API data by air carriers to the router, rules for the processing of API data by competent authorities and the storage and deletion of API data by both air carriers and competent authorities;

2) the establishement of a single point of reception and onward distribution of data, the router, which will be managed by eu-LISA; furthermore rules on the use of the router, on the deletion of the API data from the router and procedure in case of technical impossibilities to use the router;

3) provisions on the protection of personal data, as well as security and self-monitoring by air carriers and competent authorities;

4) rules and conditions on the possibility of an initial voluntary use of the router by air carriers, before its compulsory application;

5) requirements on supervision and possible penalties in case of non-compliance by air carriers.

This Regulation also includes budgetary provisions that will finance the establishment and functioning of the router and the costs incurred by the Member States (with some exceptions) in relation to their connections to and integration with the router, under the Union budget.

Rapporteur’s position

This Regulation should allow authorities to estimate in advance the necessary control capacity at airports and should enable air carriers to process the information and the check-in in a more efficient and faster way. The Rapporteur therefore welcomes this streamlined and simpler method for air carriers to provide API data through a centralised system. He also shares the view that digitalisation and automation can be a useful tool to mitigate errors and to allow for a better travel experience for passengers. Nevertheless, this Regulation should avoid going to the detriment of the travel experience of the legitimate traveller. In that sense, a clarification on the possibility to check in online was introduced, as well as a restriction to apply fees to the passengers when the data is provided at the airport.

The Rapporteur also shares the intention to ensure better quality API data in order to facilitate checks at external borders, while underlining the need to fully respect the citizens' fundamental right to data protection. In view of the sensitive nature of the personal data, the requirement to encrypt the API data when transferred from the air carrier to the router and further on to the competent authorites is introduced. The Rapporteur also proposes a clear restriction of the use of statistical data for specific defined purposes in Art. 31. For reasons of coherence and proportionality, the Rapporteur also intents to exclude both members of the crew and transit passengers from the scope of this Regulation.

The Rapporteur believes that this legislation should facilitate people travelling, with reduced times at disembarkation and at the physical border checks. Therefore, the Rapporteur introduces a provision in Article 38 which imposes a requirement on the Commission to carry out an assessment on the impact of this Regulation on the travel experience of travellers. He also calls for the establishement of a API contact group, to enhance cooperation and information exchange among Member States, EU institutions and stakeholders. The Rapporteur understands that in certain cases air carriers may need to keep logs for longer than for procedures for monitoring or ensuring the security and integrity of the API data or the lawfulness of the processing operations. As the reasons for a prolongation of the temporary storage period has not been made sufficiently clear in relation to the purpose of this Regulation, the Rapporteur prefers to limit the data retention period for both air carriers and competent border authorities to 24 hours.

Regarding the penalties imposed on air carries for non-compliance with the obligations as laid out in this Regulation, the Rapporteur shares the intention to make them effective and dissuasive, but he prefers to introduce a threshold for maximum penalties in order to fully ensure proportionality. The Rapporteur believes that the financial appropriation to the functioning of the router will determine its success, therefore eu-LISA should be provided with the necessary resources. In addition, in view of the expected increase in tasks for the EDPS and national data protection authorities, the Rapporteur includes provisions regarding the coverage of cost costs incurred by them as well.

As regards the provisions and references related to intra-EU flights in the Regulation (EU) [API law enforcement], the Rapporteur prefers to remove them from the text since it is questionable if the proposed filtering mechanism of the router would fully comply with the requirements of the Ligue des droits humains judgment. Moreover, he is of the opinion that separate provisions on non-discrimination and legal remedies are essential fundamental rights safeguards which apply horizontally.

Furthermore, the Rapporteur considers that the obligation to provide API data should not be extented to other means of transport. As such, he does not agree with the introduction of an opening clause in Recital 35, as proposed by the Commission.

ANNEX: ENTITIES OR PERSONS FROM WHOM THE RAPPORTEUR HAS RECEIVED INPUT

Pursuant to Article 8 of Annex I to the Rules of Procedure, the rapporteur declares that he has received input from the following entities or persons in the preparation of the report, until the adoption thereof in committee:

Entity and/or person
Airlines for Europe IATA European Parliament Research Service Bundeskriminalamt, Passenger Information Unit Germany Fundamental Rights Association BEUC – The European Consumer Organization Federal Ministy of Justice

The list above is drawn up under the exclusive responsibility of the rapporteur.

19.7.2023

OPINION OF THE COMMITTEE ON TRANSPORT AND TOURISM

for the Committee on Civil Liberties, Justice and Home Affairs

(COM(2022)0729 – C90428 – 2022/0424(COD))

Rapporteur for opinion: JanChristoph Oetjen

SHORT JUSTIFICATION

This Regulation updates and replaces Directive 2004/82/EC, the existing legal framework on API data that facilitates external border controls, combats illegal immigration and increases internal security.

Whereas Directive 2004/82/EC has proven effective in improving boarder controls, its divergent application at national level has created inconsistencies. Inconsistencies that are takled by the new rules set by the proposed Regulation.

More specifically, this Regulation introduces:

1 provisions for the collection and tranfer of API data by air carriers to the router, the rule for the processing of API data by competent authorities and the storage and deletion of API data by both air carriers and competent authorities;

2 the establishement of a single point of reception and onward distribution of data, the router, which will be managed by an EU Agency, eu-LISA, the rules on the use of the router, on the deletion of the API data from the router and the procedure in case of a partial or full technical impossibility to use the router;

3 provisions on the protection of personal data, as well as security and self-monitoring by air carriers and competent authorities;

4 rules and conditions on the the possibility of an initial voluntary use of the router by air carriers, before its compulsory application;

5 requirements on supervision and possible penalties in case of non-compliance by air carriers.

Rapporteur’s position

The Rapporteur welcomes this streamlined and simpler method for air carriers to provide API data, especially through a centralised system. He also shares the view that digitalisation and automation can be a useful tool to mitigate errors and to allow for a better travel experience for legitimate travellers.

The Rapporteur also shares the need to ensure better quality API data for law enforcement, in full respect of personal data protection. However, this Regulation should avoid going to the detriment of the travel experience of the legitimate traveller. It should also allow authorities to estimate in advance the necessary control capacity at airports and should enable air carriers to process the information at the check-in in a more efficient and faster way. The Rapporteur believes that this legislation should facilitate people travelling, with reduced times at disembarkation and at the physical border checks. Therefore, the Rapporteur introduces a provision in Article 8(1) that allows for the use of API data by air carriers for travel facilitation, in compliance with the General Data Protection Regulation. The Rapporteur also introduces a provision in Article 38, which imposes a requirement on the Commission to carry out an assessment on the impact of this Regulation on the travel experience of travellers.

The Rapporteur understands that in certain cases air carriers may need to keep logs for longer than for procedures for monitoring or ensuring the security and integrity of the API data or the lawfulness of the processing operations. However to avoid any missuse or abuse, the air carriers should inform and justify to the Commission the reason for keeping the logs longer.

The Rapporteur believes that the financial appropriation to the functioning of the router will determine its success, therefore eu-LISA should be provided with the necessary resources under the Union budget.

AMENDMENT

The Committee on Transport and Tourism calls on the Committee on Civil Liberties, Justice and Home Affairs, as the committee responsible, to take the following into account:

Amendment 1

Proposal for a regulation

Recital 8

Text proposed by the Commission	Amendment
(8) In the interest of effectiveness and legal certainty, the items of information that jointly constitute the API data to be collected and subsequently transferred under this Regulation should be listed clearly and exhaustively, covering both information relating to each traveller and information on the flight of that traveller. Such flight information should cover information on the border crossing point of entry into the territory of the Member State concerned in all cases covered by this Regulation, but that information should be collected only where applicable under Regulation (EU) [API law enforcement], that is, not when the API data relate to intra-EU flights.	(8) In the interest of effectiveness and legal certainty, the items of information that jointly constitute the API data to be collected and subsequently transferred under this Regulation should be listed clearly and exhaustively, covering both information relating to each traveller and information on the flight of that traveller. Such flight information should cover information on the border crossing point of entry into the territory of the Member State concerned in all cases covered by this Regulation, but that information should be collected only where applicable under Regulation (EU) [API law enforcement].

Amendment 2

Proposal for a regulation

Recital 8 a (new)

Text proposed by the Commission	Amendment
	(8 a) Where technically and operationally feasible, the router should allow for the use of pseudonymization and/or encryption of the API data.

Amendment 3

Proposal for a regulation

Recital 12 a (new)

Text proposed by the Commission	Amendment
	(12 a) The automatic data collection systems and other processes established under this Regulation should not negatively impact the employees in the aviation industry, who should benefit from upskilling and reskilling opportunities that would increase the efficiency and reliability of data collection and transfer as well as the working conditions in the sector.

Amendment 4

Proposal for a regulation

Recital 13

Text proposed by the Commission	Amendment
(13) In view of ensuring that the pre-checks carried out in advance by competent border authorities are effective and efficient, the API data transferred to those authorities should contain data of travellers that are effectively set to cross the external borders, that is, of travellers that are effectively on board of the aircraft. Therefore, the air carriers should transfer API data directly after flight closure. Moreover, API data helps the competent border authorities to distinguish legitimate travellers from travellers who may be of interest and therefore may require additional verifications, which would necessitate further coordination and preparation of follow-up measures to be taken upon arrival. That could occur, for example, in cases of unexpected number of travellers of interest whose physical checks at the borders could adversely affect the border checks and waiting times at the borders of other legitimate travellers. To provide the competent border authorities with an opportunity to prepare adequate and proportionate measures at the border, such as temporarily reinforcing or reaffecting staff, particularly for flights where the time between the flight closure and the arrival at the external borders is insufficient to allow the competent border authorities to prepare the most appropriate response, API data should also be transmitted prior to boarding, at the moment of check-in of each traveller.	(13) In view of ensuring that the pre-checks carried out in advance by competent border authorities are effective and efficient, the API data transferred to those authorities should contain data of travellers that are effectively set to cross the external borders, that is, of travellers that are effectively on board of the aircraft. Therefore, the air carriers should transfer API data directly after flight closure. Moreover, API data helps the competent border authorities to distinguish legitimate travellers from travellers who may be of interest and therefore may require additional verifications, which would necessitate further coordination and preparation of follow-up measures to be taken upon arrival. That could occur, for example, in cases of unexpected number of travellers of interest whose physical checks at the borders could adversely affect the border checks and waiting times at the borders of other legitimate travellers. To provide the competent border authorities with an opportunity to prepare adequate and proportionate measures at the border, such as temporarily reinforcing or reaffecting staff, particularly for flights where the time between the flight closure and the arrival at the external borders is insufficient to allow the competent border authorities to prepare the most appropriate response, API data should also be transmitted prior to boarding, at the moment of check-in of each traveller. In order to reduce the impact on air carriers, and with a view to create synergies with other reporting obligations on air carriers in Regulations (EU) 2017/2226, (EU) 2018/1240 and (EC) 767/2008 and avoid duplication, air carriers should transfer the API data at the moment of check-in of each traveller by way of interactive API in accordance with international standards, using the existing carrier gateway. Air carriers should receive a meaningful reply to the transfer of interactive API in accordance with Regulations (EU) 2017/2226, (EU) 2018/1240 and (EC) 767/2008.

Amendment 5

Proposal for a regulation

Recital 13 a (new)

Text proposed by the Commission	Amendment
	(13 a) With a view to guaranteeing the fulfilment of the rights provided for under the Charter and to ensuring accessible and inclusive travel options, especially for vulnerable groups and persons with disabilities, air carriers, supported by the Member States, should ensure that an offline alternative for the check-in and for the provision of the necessary data by the passengers is possible at all times.

Amendment 6

Proposal for a regulation

Recital 13 b (new)

Text proposed by the Commission	Amendment
	(13 b) In order to enhance data quality, the router should verify whether the API data transferred to it by the air carriers complies with the supported data formats. Where the router has verified that the data is not compliant with the supported data formats, the router should, immediately and in an automated manner, notify the air carrier concerned.

Amendment 7

Proposal for a regulation

Recital 15 a (new)

Text proposed by the Commission	Amendment
	(15 a) This Regulation should be subject to regular evaluations to ensure the monitoring of its effective application. In particular, the collection of API data should not be to the detriment of the travel experience of legitimate travellers. Therefore, the Commission should include in its regular evaluation reports on the application of this Regulation an assessment of the impact of this Regulation on the travel experience of legitimate travellers.

Amendment 8

Proposal for a regulation

Recital 15 b (new)

Text proposed by the Commission	Amendment
	(15 b) Given that this Regulation requires additional adjustment and administrative costs by the air carriers, the overall regulatory burden for the aviation sector should be kept under close review. Against this backdrop, the report evaluating the functioning of this Regulation should assess the extent to which the objectives of the Regulation have been met and to which extent it has impacted the competitiveness of the sector. Therefore, the Commission’s report should also conduct a holistic assessment and refer to the interaction of this Regulation with other relevant EU legislative acts, in particular Regulations (EU) 2017/2226, (EU) 2018/1240 and (EC) 767/2008. The report should assess the overall impact of related reporting obligations on air carriers, identifying provisions that could be updated and simplified, where appropriate, to mitigate the burden on air carriers, as well as actions and measures that have been or could be taken to reduce the total cost pressure on the aviation sector.

Amendment 9

Proposal for a regulation

Recital 16

Text proposed by the Commission	Amendment
(16) To ensure that competent border authorities have sufficient time to carry out pre-checks effectively on all travellers, including travellers on long-haul flights and those travelling on connecting flights, as well as sufficient time to ensure that the API data collected and transferred by the air carriers is complete, accurate and up-to-date, and where necessary to request additional clarifications, corrections or completions from the air carriers, the competent border authorities should store the API data that they received under this Regulation for a fixed time period that remains limited to what is strictly necessary for those purposes. Similarly, to be able to respond to such requests, air carriers should store the API data that they transferred under this Regulation for the same fixed and strictly necessary time period.	(16) To ensure that competent border authorities have sufficient time to carry out pre-checks effectively on all travellers, including travellers on long-haul flights and those travelling on connecting flights, as well as sufficient time to ensure that the API data collected and transferred by the air carriers is complete, accurate and up-to-date, and where necessary to request additional clarifications, corrections or completions from the air carriers, the competent border authorities should store the API data that they received under this Regulation for a fixed time period that remains limited to what is strictly necessary for those purposes. Similarly, to be able to respond to such requests, air carriers should store the API data that they transferred under this Regulation for the same fixed and strictly necessary time period. Beyond that, and with a view to enhance the travel experience of legitimate travellers, air carriers should be able to retain and use the API data where necessary for the normal course of their business in particular for travel facilitation, in compliance with the applicable law and in particular Regulation (EU) 2016/679.

Amendment 10

Proposal for a regulation

Recital 17

Text proposed by the Commission	Amendment
(17) In order to avoid that air carriers have to establish and maintain multiple connections with the competent border authorities of the Member States’ for the transfer of API data collected under this Regulation and the related inefficiencies and security risks, provision should be made for a single router, created and operated at Union level, that serves as a connection and distribution point for those transfers. In the interest of efficiency and cost effectiveness, the router should, to the extent technically possible and in full respect of the rules of this Regulation and Regulation (EU) [API law enforcement], rely on technical components from other relevant systems created under Union law.	(17) In order to avoid that air carriers have to establish and maintain multiple connections with the competent border authorities of the Member States’ for the transfer of API data collected under this Regulation and the related inefficiencies and security risks, provision should be made for a single router, created and operated at Union level, that serves as a connection and distribution point for those transfers. In the interest of efficiency and cost effectiveness, the router should, to the extent technically possible and in full respect of the rules of this Regulation and Regulation (EU) [API law enforcement], rely on technical components from other relevant systems created under Union law, in particular the web service referred to in Regulation (EU) 2017/2226, the carrier gateway referred to in Regulation (EU) 2018/1240 and the carrier gateway referred to in Regulation (EC) 767/2008. In order to reduce the impact on air carriers and ensure a harmonised approach towards air carriers, eu-LISA should design the router, to the extent technically and operationally possible, in a way that is coherent and consistent with the obligations put on air carriers by Regulations (EU) 2017/2226, (EU) 2018/1240 and (EC) 767/2008.

Amendment 11

Proposal for a regulation

Recital 17 a (new)

Text proposed by the Commission	Amendment
	(17 a) With a view to ensuring increased data quality and accuracy, the setting up of travel document validation systems, able to automatically verify carrier-submitted passenger data, should be considered.

Amendment 12

Proposal for a regulation

Recital 19

Text proposed by the Commission	Amendment
(19) The router should serve only to facilitate the transmission of API data from the air carriers to the competent border authorities in accordance with this Regulation and to PIUs in accordance with Regulation (EU) [API law enforcement], and should not be a repository of API data. Therefore, and in order to minimise any risk of unauthorised access or other misuse and in accordance with the principle of data minimisation, any storage of the API data on the router should remain limited to what is strictly necessary for technical purposes related to the transmission and the API data should be deleted from the router, immediately, permanently and in an automated manner, from the moment that the transmission has been completed or, where relevant under Regulation (EU) [API law enforcement], the API data is not to be transmitted at all.	(19) The router should serve only to facilitate the transmission of API data from the air carriers to the competent border authorities in accordance with this Regulation and to PIUs in accordance with Regulation (EU) [API law enforcement], and should not be a repository of API data. Therefore, and in order to minimise any risk of unauthorised access or other misuse and in accordance with the principle of data minimisation, any storage of the API data on the router should remain limited to what is strictly necessary for technical purposes related to the transmission and the API data should be deleted from the router, immediately, permanently and in an automated manner, from the moment that the transmission has been completed.

Amendment 13

Proposal for a regulation

Recital 22

Text proposed by the Commission	Amendment
(22) The router to be created and operated under this Regulation should reduce and simplify the technical connections needed to transfer API data, limiting them to a single connection per air carrier and per competent border authority. Therefore, this Regulation provides for the obligation for the competent border authorities and air carriers to each establish such a connection to, and achieve the required integration with, the router, so as to ensure that the system for transferring API data established by this Regulation can function properly. To give effect to those obligations and to ensure the proper functioning of the system set up by this Regulation, they should be supplemented by detailed rules.	(22) The router to be created and operated under this Regulation should reduce and simplify the technical connections needed to transfer API data, limiting them to a single connection per air carrier and per competent border authority. Therefore, this Regulation provides for the obligation for the competent border authorities and air carriers to each establish such a connection to, and achieve the required integration with, the router, so as to ensure that the system for transferring API data established by this Regulation can function properly. The design and development of the router by eu-LISA should enable the effective and efficient connection and integration of air carriers’ systems and infrastructure by providing for all relevant standards and technical requirements. To give effect to those obligations and to ensure the proper functioning of the system set up by this Regulation, they should be supplemented by detailed rules.

Amendment 14

Proposal for a regulation

Recital 23

Text proposed by the Commission	Amendment
(23) In view of the Union interests at stake, the costs incurred by eu-LISA for the performance of its tasks under this Regulation and Regulation (EU) [API law enforcement] in respect of the router should be borne by the Union budget. The same should go for appropriate costs incurred by the Member States in relation to their connections to, and integration with, the router, as required under this Regulation and in accordance with the applicable legislation, subject to certain exceptions. The costs covered by those exceptions should be borne by each Member State concerned itself.	(23) In view of the Union interests at stake, the costs incurred by eu-LISA for the performance of its tasks under this Regulation and Regulation (EU) [API law enforcement] in respect of the router should be borne by the Union budget. The same should go for appropriate costs incurred by the Member States in relation to their connections to, and integration with, the router, as required under this Regulation and in accordance with the applicable legislation, subject to certain exceptions. The costs covered by those exceptions should be borne by each Member State concerned itself. The Union budget should also cover the support, such as training, provided by eu-LISA to air carriers and PIUs to enable the effective transfer and transmission of API data through the router.

Amendment 15

Proposal for a regulation

Recital 28 a (new)

Text proposed by the Commission	Amendment
	(28 a) When providing for the penalties applicable to air carriers under this Regulation, Member States shall take into account the technical, operational and economic feasibility of ensuring complete data accuracy. Additionally, when fines are imposed, their application and value shall be established taking into consideration the actions undertaken by the air carrier to mitigate the issue as well as its repeated failure to cooperate with national authorities.

Amendment 16

Proposal for a regulation

Article 6 – paragraph 2

Text proposed by the Commission	Amendment
2. Air carriers shall transfer the API data both at the moment of check-in and immediately after flight closure, that is, once the passengers have boarded the aircraft in preparation for departure and it is no longer possible for passengers to board or to leave the aircraft.	2. Air carriers shall transfer the API data both at the moment of check-in and immediately after flight closure, that is, once the passengers have boarded the aircraft in preparation for departure and it is no longer possible for passengers to board or to leave the aircraft. At the moment of check-in, air carriers shall transfer the API data by way of interactive API in accordance with international standards. Where an air carrier transfers the API data by way of interactive API, it shall receive a meaningful reply in accordance with Regulation (EU) 2017/2226, Regulation (EU) 2018/1240 and Regulation (EC) 767/2008.

Amendment 17

Proposal for a regulation

Article 6 – paragraph 2 a (new)

Text proposed by the Commission	Amendment
	2 a. The router shall verify whether the API data transferred to it in accordance with paragraph 1 complies with the detailed rules on the supported data formats. Where the router has verified that the data is not compliant with the detailed rules, the router shall, immediately and in an automated manner, notify the air carrier concerned.

Amendment 18

Proposal for a regulation

Article 6 – paragraph 3

Text proposed by the Commission	Amendment
3. The Commission is empowered to adopt delegated acts in accordance with Article 37 to supplement this Regulation by laying down the necessary detailed rules on the common protocols and supported data formats to be used for the transfers of API data to the router referred to in paragraph 1.	3. The Commission is empowered to adopt delegated acts in accordance with Article 37 to supplement this Regulation by laying down the necessary detailed rules on the common protocols and supported data formats to be used for the transfers of API data to the router referred to in paragraph 1, including the use of interactive API for the transfer of API data at the moment of check-in.

Amendment 19

Proposal for a regulation

Article 8 – paragraph 1

Text proposed by the Commission	Amendment
1. Air carriers shall store, for a time period of 48 hours from the moment of departure of the flight, the API data relating to that passenger that they collected pursuant to Article 4. They shall immediately and permanently delete that API data after the expiry of that time period.	1. Air carriers shall store, for a time period of 48 hours from the moment of departure of the flight, the API data relating to that passenger that they collected pursuant to Article 4. They shall immediately and permanently delete that API data after the expiry of that time period. This is without prejudice to the possibility for air carriers to retain and use the data where necessary for the normal course of their business in particular for travel facilitation, in compliance with the applicable law and in particular Regulation (EU) 2016/679.

Amendment 20

Proposal for a regulation

Article 9 – paragraph 3

Text proposed by the Commission	Amendment
3. Without prejudice to Article 10 of this Regulation, the router shall, to the extent technically possible, share and re-use the technical components, including hardware and software components, of the web service referred to in Article 13 of Regulation (EU) 2017/2226 of the European Parliament and of the Council48 , the carrier gateway referred to in Article 6(2), point (k), of Regulation (EU) 2018/1240, and the carrier gateway referred to in Article 2a, point (h), of Regulation (EC) 767/2008 of the European Parliament and of the Council49 .	3. Without prejudice to Article 10 of this Regulation, the router shall, to the extent technically possible, share and re-use the technical components, including hardware and software components, of the web service referred to in Article 13 of Regulation (EU) 2017/2226 of the European Parliament and of the Council48 , the carrier gateway referred to in Article 6(2), point (k), of Regulation (EU) 2018/1240, and the carrier gateway referred to in Article 2a, point (h), of Regulation (EC) 767/2008 of the European Parliament and of the Council49 . eu-LISA shall design the router, to the extent technically and operationally possible, in a way that is coherent and consistent with the obligations put on air carriers by Regulations (EU) 2017/2226, (EU) 2018/1240 and (EC) 767/2008.
__________________	__________________
48 Regulation (EU) 2017/2226 of the European Parliament and of the Council of 30 November 2017 establishing an Entry/Exit System (EES) to register entry and exit data and refusal of entry data of third-country nationals crossing the external borders of the Member States and determining the conditions for access to the EES for law enforcement purposes, and amending the Convention implementing the Schengen Agreement and Regulations (EC) No 767/2008 and (EU) No 1077/2011 (OJ L 327, 9.12.2017, p. 20).	48 Regulation (EU) 2017/2226 of the European Parliament and of the Council of 30 November 2017 establishing an Entry/Exit System (EES) to register entry and exit data and refusal of entry data of third-country nationals crossing the external borders of the Member States and determining the conditions for access to the EES for law enforcement purposes, and amending the Convention implementing the Schengen Agreement and Regulations (EC) No 767/2008 and (EU) No 1077/2011 (OJ L 327, 9.12.2017, p. 20).
49 Regulation (EC) No 767/2008 of the European Parliament and of the Council of 9 July 2008 concerning the Visa Information System (VIS) and the exchange of data between Member States on short-stay visas (VIS Regulation) (OJ L 218, 13.8.2008, p. 60).	49 Regulation (EC) No 767/2008 of the European Parliament and of the Council of 9 July 2008 concerning the Visa Information System (VIS) and the exchange of data between Member States on short-stay visas (VIS Regulation) (OJ L 218, 13.8.2008, p. 60).

Amendment 21

Proposal for a regulation

Article 12 – paragraph 1 – point b

Text proposed by the Commission	Amendment
(b) in respect of Regulation (EU) [API law enforcement], where the API data relates to other intra-EU flights than those included the lists referred to in Article 5(2) of that Regulation.	(b) in respect of Regulation (EU) [API law enforcement].

Amendment 22

Proposal for a regulation

Article 13 – paragraph 5 – subparagraph 2

Text proposed by the Commission	Amendment
However, if those logs are needed for procedures for monitoring or ensuring the security and integrity of the API data or the lawfulness of the processing operations, as referred to in paragraph 2, and these procedures have already begun at the moment of the expiry of the time period referred to in the first subparagraph, eu-LISA and the air carriers may keep those logs for as long as necessary for those procedures. In that case, they shall immediately delete those logs when they are no longer necessary for those procedures.	However, if those logs are needed for procedures for monitoring or ensuring the security and integrity of the API data or the lawfulness of the processing operations, as referred to in paragraph 2, and these procedures have already begun at the moment of the expiry of the time period referred to in the first subparagraph, eu-LISA and the air carriers may keep those logs for as long as necessary for those procedures, provided that eu-LISA or the air carriers inform the Commission of the need to keep those logs and provide reasons for doing so. In that case, they shall immediately delete those logs when they are no longer necessary for those procedures.

Amendment 23

Proposal for a regulation

Article 24 – paragraph 1

Text proposed by the Commission	Amendment
1. eu-LISA shall, upon their request, provide training to competent border authorities, PIUs and other relevant Member States’ authorities and air carriers on the technical use of the router.	1. eu-LISA shall, upon their request, provide training to competent border authorities, PIUs and other relevant Member States’ authorities and air carriers on the technical use of the router and on the connection and integration to the router.

Amendment 24

Proposal for a regulation

Article 25 – paragraph 1

Text proposed by the Commission	Amendment
1. Costs incurred by eu-LISA in relation to the design, development, hosting and technical management of the router under this Regulation and Regulation (EU) [API law enforcement] shall be borne by the general budget of the Union.	1. Costs incurred by eu-LISA in relation to the design, development, hosting and technical management of the router under this Regulation and Regulation (EU) [API law enforcement] shall be borne by the general budget of the Union. In view of the Union interests at stake, in relation to its responsibilities for the design, development, hosting and technical management and maintenance of the router, eu-LISA shall be provided with the necessary resources under the Union budget in accordance with the applicable legislation.

Amendment 25

Proposal for a regulation

Article 28 – title

Text proposed by the Commission	Amendment
Voluntary use of the router in application of Directive 2004/81/EC	Voluntary use of the router in application of Directive 2004/82/EC

Amendment 26

Proposal for a regulation

Article 38 – paragraph 2

Text proposed by the Commission	Amendment
2. By [one year after the date of entry into force of this Regulation] and every year thereafter during the development phase of the router, eu-LISA shall produce a report, and submit it to the European Parliament and to the Council on the state of play of the development of the router. That report shall contain detailed information about the costs incurred and about any risks which may impact the overall costs to be borne by the general budget of the Union in accordance with Article 25.	2. By [one year after the date of entry into force of this Regulation] and every year thereafter during the development phase of the router, eu-LISA shall produce a report, and submit it to the European Parliament and to the Council on the state of play of the development of the router. That report shall contain detailed information about the costs incurred and about any risks which may impact the overall costs to be borne by the general budget of the Union in accordance with Article 25. From the date at which the router starts operations and every year thereafter, the Commission shall assess whether the budget under the MFF budget line 4.11.10.02 (“eu-LISA”) covers the needs necessary for good design, development, hosting and technical management of the router and, if appropriate, immediately propose amendment to the budget appropriations.

Amendment 27

Proposal for a regulation

Article 38 – paragraph 4 – point c a (new)

Text proposed by the Commission	Amendment
	(c a) the impact of this Regulation on the travel experience of legitimate travellers.

Amendment 28

Proposal for a regulation

Article 38 – paragraph 4 – point c b (new)

Text proposed by the Commission	Amendment
	(c b) the impact of this Regulation on the competitiveness of the aviation sector and the burden incurred by businesses. The Commission’s report shall also address this Regulation’s interaction with other relevant EU legislative acts, in particular Regulations (EU) 2017/2226, (EU) 2018/1240 and (EC) 767/2008, with a view to assess the overall impact of related reporting obligations on air carriers, identify provisions that could be updated and simplified, where appropriate, to mitigate the burden on air carriers, and consider actions and measures that could be taken to reduce the total cost pressure on air carriers.