Sittings · Document

REPORT (COM(2022)0731 – C90427/2022 – 2022/0425(COD)) 2023-12-07

On the proposal for a regulation of the European Parliament and of the Council on the collection and transfer of advance passenger information for the prevention, detection, investigation and prosecution of terrorist offences and serious crime, and amending Regulation (EU) 2019/818

Committee on Civil Liberties, Justice and Home Affairs · Rapporteur: Assita Kanko

DRAFT EUROPEAN PARLIAMENT LEGISLATIVE RESOLUTION

on the proposal for a regulation of the European Parliament and of the Council on the collection and transfer of advance passenger information for the prevention, detection, investigation and prosecution of terrorist offences and serious crime, and amending Regulation (EU) 2019/818

(COM(2022)0731 – C90427/2022 – 2022/0425(COD))

(Ordinary legislative procedure: first reading)

The European Parliament,

– having regard to the Commission proposal to Parliament and the Council (COM(2022)0731),

– having regard to Article 294(2) and Articles 82(1) point (d) and 87(2) point (a) of the Treaty on the Functioning of the European Union, pursuant to which the Commission submitted the proposal to Parliament (C90427/2022),

– having regard to Article 294(3) of the Treaty on the Functioning of the European Union,

– having regard to Rules 59 of its Rules of Procedure,

– having regard to the opinion of the Committee on Transport and Tourism,

– having regard to the report of the Committee on Civil Liberties, Justice and Home Affairs (A9-0411/2023),

1. Adopts its position at first reading hereinafter set out;

2. Calls on the Commission to refer the matter to Parliament again if it replaces, substantially amends or intends to substantially amend its proposal;

3. Instructs its President to forward its position to the Council, the Commission and the national parliaments.

Amendment 1

Proposal for a regulation

Recital 1

Text proposed by the Commission	Amendment
(1) The transnational dimension of serious and organised crime and the continuous threat of terrorist attacks on European soil call for action at Union level to adopt appropriate measures to ensure security within an area of freedom, security and justice without internal borders. Information on air travellers, such as Passenger Name Records (PNR) and in particular Advance Passenger Information (API), is essential in order to identify high-risk travellers, including those who are not otherwise known to law enforcement authorities, and to establish links between members of criminal groups, and countering terrorist activities.	(1) The transnational dimension of serious and organised crime and the continuous threat of terrorist attacks on European soil call for action at Union level to adopt appropriate measures to ensure security within an area of freedom, security and justice without internal borders. Information on air passengers, such as Passenger Name Records (PNR) and in particular Advance Passenger Information (API), is essential in order to identify high-risk passengers, including those who are not otherwise known to law enforcement authorities, and to establish links between members of criminal groups, and countering terrorist activities.

Amendment 2

Proposal for a regulation

Recital 2

Text proposed by the Commission	Amendment
(2) While Council Directive 2004/82/EC27 establishes a legal framework for the collection and transfer of API data by air carriers with the aims of improving border controls and combating illegal immigration, it also states that Member States may use API data for law enforcement purposes. However, only creating such a possibility leads to several gaps and shortcomings. In particular, it means that, despite its relevance for law enforcement purposes, API data is not in all cases collected and transferred by air carriers for those purposes. It also means that, where Member States acted upon the possibility, air carriers are faced with diverging requirements under national law as regards when and how to collect and transfer API data for this purpose. Those divergences lead not only to unnecessary costs and complications for the air carriers, but they are also prejudicial to the Union’s internal security and effective cooperation between the competent law enforcement authorities of the Member States. Moreover, in view of the different nature of the purposes of facilitating border controls and law enforcement, it is appropriate to establish a distinct legal framework for the collection and transfer of API data for each of those purposes.	(2) While Council Directive 2004/82/EC27 establishes a legal framework for the collection and transfer of API data by air carriers with the aims of improving border controls and combating illegal immigration, it also states that Member States may use API data for law enforcement purposes. However, only creating such a possibility leads to several gaps and shortcomings. In particular, it means that, API data is not systematically collected and transferred by air carriers for law enforcement purposes. It also means that, where Member States acted upon the possibility, air carriers are faced with diverging requirements under national law as regards when and how to collect and transfer API data for this purpose. Those divergences lead not only to unnecessary costs and complications for the air carriers, but can also negatively affect the Union’s internal security and complicate effective cooperation between the competent law enforcement authorities of the Member States. Moreover, in view of the different nature of the purposes of facilitating border controls and law enforcement, it is appropriate to establish a distinct legal framework for the collection and transfer of API data for each of those purposes
__________________	__________________
27 Council Directive 2004/82/EC of 29 April 2004 on the obligation of carriers to communicate passenger data (OJ L 261, 6.8.2004, p. 24).	27 Council Directive 2004/82/EC of 29 April 2004 on the obligation of carriers to communicate passenger data (OJ L 261, 6.8.2004, p. 24).

Amendment 3

Proposal for a regulation

Recital 4

Text proposed by the Commission	Amendment
(4) It is therefore necessary to establish at Union level clear, harmonised and effective rules on the collection and transfer of API data for the purpose of preventing, detecting, investigating and prosecuting terrorist offences and serious crime.	(4) It is therefore necessary to establish clear, harmonised and effective rules at Union level on the collection and transfer of API data for the purpose of preventing, detecting, investigating and prosecuting terrorist offences and serious crime.

Amendment 4

Proposal for a regulation

Recital 5

Text proposed by the Commission	Amendment
(5) Considering the close relationship between both acts, this Regulation should be understood as complementing the rules provided for in Directive (EU) 2016/681. Therefore, API data is to be collected and transferred in accordance with the specific requirements of this Regulation, including as regards the situations and the manner in which that is to be done. However, the rules of that Directive apply in respect of matters not specifically covered by this Regulation, especially the rules on the subsequent processing of the API data received by the PIUs, exchange of information between Member States, conditions of access by the European Union Agency for Law Enforcement Cooperation (Europol), transfers to third countries, retention and depersonalisation, as well as the protection of personal data. Insofar as those rules apply, the rules of that Directive on penalties and the national supervisory authorities apply as well. This Regulation should leave those rules unaffected.	(5) Considering the close relationship between both acts, this Regulation should be understood as complementing the rules provided for in Directive (EU) 2016/681. Therefore, API data is to be collected and transferred in accordance with the specific requirements of this Regulation, including as regards the situations and the manner in which that is to be done. However, the rules of that Directive apply in respect of matters not specifically covered by this Regulation, especially regarding the rules on the subsequent processing of the API data received by the PIUs, exchange of information between Member States, conditions of access by the European Union Agency for Law Enforcement Cooperation (Europol), transfers to third countries, retention and depersonalisation, as well as the protection of personal data. Insofar as those rules apply, the rules of that Directive on penalties and the national supervisory authorities apply as well. This Regulation should leave those rules unaffected.

Amendment 5

Proposal for a regulation

Recital 6

Text proposed by the Commission	Amendment
(6) The collection and transfer of API data affects the privacy of individuals and entails the processing of personal data. In order to fully respect fundamental rights, in particular the right of respect for private life and the right to the protection of personal data, in accordance with the Charter of Fundamental Rights of the European Union (‘Charter’), adequate limits and safeguards should be provided for. In particular, any processing of API data and, in particular, API data constituting personal data, should remain limited to what is necessary for and proportionate to achieving the objectives pursued by this Regulation. In addition, it should be ensured that the API collected and transferred under this Regulation do not lead to any form of discrimination precluded by the Charter.	(6) The collection and transfer of API data affects the privacy of individuals and entails the processing of their personal data. In order to fully respect their fundamental rights, in particular the right of respect for private life and the right to the protection of personal data, in accordance with the Charter of Fundamental Rights of the European Union (‘Charter’), adequate limits and safeguards should be provided for. In particular, any processing of API data and, in particular, API data constituting personal data, should remain strictly limited to what is necessary for and proportionate to achieving the objectives pursued by this Regulation. In addition, it should be ensured that the processing of any API data collected and transferred under this Regulation do not lead to any form of discrimination precluded by the Charter.

Amendment 6

Proposal for a regulation

Recital 7

Text proposed by the Commission	Amendment
(7) In view of the complementary nature of this Regulation in relation to Directive (EU) 2016/681, the obligations of air carriers under this Regulation should apply in respect of all flights for which Member States are to require air carriers to transmit PNR data under Directive (EU) 2016/681, namely flights, including both scheduled and non-scheduled flights, both between Member States and third countries (extra-EU flights), and between several Member States (intra-EU flights) insofar as those flights have been selected in accordance with Directive (EU) 2016/681, irrespective of the place of establishment of the air carriers conducting those flights.	(7) In view of the complementary nature of this Regulation in relation to Directive (EU) 2016/681, the obligations of commercial air carriers under this Regulation should apply in respect of all flights for which Member States are to require air carriers to transmit PNR data under Directive (EU) 2016/681, namely flights, including both scheduled and non-scheduled flights, both between Member States and third countries (extra-EU flights), and between several Member States (intra-EU flights) insofar as those flights have been selected in accordance with Directive (EU) 2016/681, irrespective of the place of establishment of the air carriers conducting those flights. In accordance with the relevant ICAO classifications, general aviation such as flight schools, military or medical flights, should be exempted from this Regulation.

Amendment 7

Proposal for a regulation

Recital 9

Text proposed by the Commission	Amendment
(9) In view of the close relationship between the acts of Union law concerned and in the interest of consistency and coherence, the definitions set out in this Regulation should as much possible be aligned with, and be interpreted and applied in the light of, the definitions set out in Directive (EU) 2016/681 and Regulation (EU) [API border management]29 .	(9) In view of the close relationship between the acts of Union law concerned and in the interest of consistency and coherence, the definitions set out in this Regulation should be aligned with, interpreted and applied in the light of, the definitions set out in Directive (EU) 2016/681 and Regulation (EU) [API border management]29 .
__________________	__________________
29 OJ C , , p. .	29 OJ C , , p. .

Amendment 8

Proposal for a regulation

Recital 10

Text proposed by the Commission	Amendment
(10) In particular, the items of information that jointly constitute the API data to be collected and subsequently transferred under this Regulation should be those listed clearly and exhaustively in Regulation (EU) API [border management], covering both information relating to each passenger and information on the flight of that traveller. Under this Regulation, such flight information should cover information on the border crossing point of entry into the territory of the Member State concerned only where applicable, that is, not when the API data relate to intra-EU flights.	(10) In particular, the items of information that jointly constitute the API data to be collected and subsequently transferred under this Regulation should be the same as those listed clearly and exhaustively in Regulation (EU) API [border management], covering both information relating to each passenger and information on the flight of that passenger. Under this Regulation, such flight information should cover information on the border crossing point of entry into the territory of the Member State concerned only where applicable, that is, not when the API data relate to intra-EU flights

Amendment 9

Proposal for a regulation

Recital 11

Text proposed by the Commission	Amendment
(11) In order to ensure a consistent approach on the collection and transfer of API data by air carriers as much as possible, the rules set out in this Regulation should be aligned with those set out in the Regulation (EU) [API border management] where appropriate. That concerns, in particular, the rules on data quality, the air carriers’ use of automated means for such collection, the precise manner in which they are to transfer the collected API data to the router and the deletion of the API data.	(11) In order to ensure an approach that is as consistent as possible on the collection and transfer of API data by air carriers, the rules set out in this Regulation should be aligned with those set out in the Regulation (EU) [API border management] where appropriate. That alignment concerns, in particular, the rules on data quality, the precise manner in which they are to transfer the collected API data to the router, the encryption of API data in transit, and the deletion of the API data. Furthermore, and as set out in this Regulation and in the Regulation (EU) [API border management], air carriers should be required to collect the API data using automated means, specifically by reading information from the machine-readable data of the travel document. Where the use of such automated means is however not possible, air carriers should collect the API data manually, either as part of the online check-in process, or as part of the check-in at the airport, in such a manner as to ensure compliance with their obligations under this Regulation.

Amendment 10

Proposal for a regulation

Recital 11 a (new)

Text proposed by the Commission	Amendment
	(11a) The collection of API data by automated means should be strictly limited to the alphanumerical data contained in the travel document and should not lead to the collection of any biometric data from it. As the collection of API data is part of the check-in process, either online or at the airport, it should not include an obligation for air carriers to check a travel document of the passenger at the moment of boarding. Compliance with this regulation should not include any obligation for passenger to carry a travel document at the moment of boarding.

Amendment 11

Proposal for a regulation

Recital 11 b (new)

Text proposed by the Commission	Amendment
	(11b) The requirements set out by this Regulation and by the corresponding delegated and implementing acts should lead to a uniform implementation by the airlines, thereby minimising the cost of the interconnection of their respective systems. To facilitate a harmonised implementation of those requirements by the airlines, in particular as regards the data structure, format and transmission protocol, the Commission, based on its cooperation with the PIUs, other Member States authorities, air carriers, and relevant Union agencies, should ensure that the practical handbook to be prepared by Commission provides all the necessary guidance and clarifications.

Amendment 12

Proposal for a regulation

Recital 11 c (new)

Text proposed by the Commission	Amendment
	(11c) In order to enhance data quality, the router should verify whether the API data transferred to it by the air carriers complies with the supported data formats. Where the router has verified that the data is not compliant with the supported data formats, the router should, immediately and in an automated manner, notify the air carrier concerned thereof.

Amendment 13

Proposal for a regulation

Recital 11 d (new)

Text proposed by the Commission	Amendment
	(11d) In order to reduce the impact on air carriers, and with a view to create synergies with other reporting obligations on air carriers in Regulation (EU) 2017/2226, Regulation (EU) 2018/1240 and Regulation (EC) 767/2008 and avoid duplication, air carriers should transfer the API data at the moment of the check-in of each passenger by way of interactive API in accordance with international standards, using the existing carrier gateway. Air carriers should receive an acknowledgement of receipt to the transfer of interactive API, in line with international standards. The use of an interactive API should not lead to an automatic denial of boarding.

Amendment 14

Proposal for a regulation

Recital 11 e (new)

Text proposed by the Commission	Amendment
	(11e) The passengers should be enabled to provide certain API data themselves during an online check-in process. Such means could, for example, include a secure app on a passengers’ smartphone, computer or webcam with the capability to read the machine-readable data of the travel document. Where the passengers did not check-in online, air carriers should provide them with the possibility to provide the required machine-readable API data concerned during check-in at the airport with the assistance of a self-service kiosk or of airline staff at the check-in counter. The Commission should ensure that the obligations under this Regulation do not lead to disproportionate obstacles for passengers unable to use online means for automated check-in, such as additional airport check-in fees.

Amendment 15

Proposal for a regulation

Recital 11 f (new)

Text proposed by the Commission	Amendment
	(11f) The automatic data collection systems and other processes established under this Regulation should not have a negative impact on the employees in the aviation industry, who should benefit from upskilling and reskilling opportunities that would increase the efficiency and reliability of data collection and transfer as well as the working conditions in the sector.

Amendment 16

Proposal for a regulation

Recital 12

Text proposed by the Commission	Amendment
(12) In order to ensure the joint processing of API data and PNR data to effectively fight terrorism and serious crime in the Union and at the same time minimise the interference with passengers’ fundamental rights protected under the Charter, the PIUs should be the competent authorities in the Member States that are entrusted to receive, and subsequently further process and protect, API data collected and transferred under this Regulation. In the interest of efficiency and to minimise any security risks, the router, as designed, developed, hosted and technically maintained by the European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) in accordance with Regulation (EU) [API border management], should transmit the API data, collected and transferred to it by the air carriers under this Regulation, to the relevant PIUs. Given the necessary level of protection of API data constituting personal data, including to ensure the confidentiality of the information concerned, the API data should be transmitted by the router to the relevant PIUs in an automated manner.	(12) In order to ensure the joint processing of API data and PNR data to effectively fight terrorism and serious crime in the Union and at the same time minimise the interference with passengers’ fundamental rights protected under the Charter, the PIUs should be the sole competent authorities in the Member States that are entrusted to receive, and subsequently further process and protect, API data collected and transferred under this Regulation. In the interest of efficiency and to minimise any security risks, the router, as designed, developed, hosted and technically maintained by the European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) in accordance with Regulation (EU) [API border management], should transmit the API data, collected and transferred to it by the air carriers under this Regulation, to the relevant PIUs. Given the necessary level of protection of API data constituting personal data, including to ensure the confidentiality of the information concerned, the API data should be transmitted by the router to the relevant PIUs in an automated manner.

Amendment 17

Proposal for a regulation

Recital 12 a (new)

Text proposed by the Commission	Amendment
	(12a) With a view to guaranteeing the fulfilment of the rights provided for under the Charter and to ensuring accessible and inclusive travel options, especially for vulnerable groups and persons with disabilities, air carriers, supported by the Member States, should ensure that an offline alternative for the check-in and for the provision of the necessary data by the passengers is possible at all times.

Amendment 18

Proposal for a regulation

Recital 13

Text proposed by the Commission	Amendment
(13) For extra-EU flights, the PIU of the Member State on the territory of which the flight will land and or from the territory of which the flight will depart should receive the API data from the router for all those flights, given that that PNR data is collected for all those flights in accordance with Directive (EU) 2016/681. The router should identify the flight and the corresponding PIUs using the information contained in the PNR record locator, a data element common to both the API and PNR data sets allowing for the joint processing of API data and PNR data by the PIUs.	(13) For extra-EU flights, the PIU of the Member State on whose territory the flight will land and or from where the flight will depart should receive the API data from the router for all those flights, that PNR data is collected for in accordance with Directive (EU) 2016/681. The router should identify the flight and the corresponding PIUs using the information contained in the PNR record locator, a data element common to both the API and PNR data sets allowing for the joint processing of API data and PNR data by the PIUs.

Amendment 19

Proposal for a regulation

Recital 14

Text proposed by the Commission	Amendment
As regards intra-EU flights, in line with the case law of the Court of Justice of the European Union (CJEU), in order to avoid unduly interfering with the relevant fundamental rights protected under the Charter and to ensure compliance with the requirements of Union law on the free movement of persons and the abolition of internal border controls, a selective approach should be provided for. In view of the importance of ensuring that API data can be processed together with PNR data, that approach should be aligned with that of Directive (EU) 2016/681. For those reasons, API data on those flights should only be transmitted from the router to the relevant PIUs, where the Member States have selected the flights concerned in application of Article 2 of Directive (EU) 2016/681. As recalled by the CJEU, the selection entails Member States targeting the obligations in question only at, inter alia, certain routes, travel patterns or airports, subject to the regular review of that selection.	(14) As regards intra-EU flights, in line with the case law of the Court of Justice of the European Union (CJEU), in order to avoid unduly interfering with passengers’ relevant fundamental rights as protected under the Charter and to ensure compliance with the requirements of Union law on the free movement of persons and the abolition of internal border controls, a selective approach should be provided for. This is with the exception of situations of a genuine and present or foreseeable terrorist threat, where Member States should be able to apply Directive (EU) 2016/681 to all intra-EU flights arriving at or departing from its territory, in a decision that is limited in time to what is strictly necessary and that is open to effective review. In view of the importance of ensuring that API data can be processed together with PNR data, that approach should be aligned with that of Directive (EU) 2016/681. For those reasons, API data on those flights should only be transmitted from the router to the relevant PIUs, where the Member States have selected the flights concerned in application of Article 2 of Directive (EU) 2016/681. As recalled by the CJEU, the selection entails Member States targeting the obligations in question only at, inter alia, certain routes, travel patterns or airports, subject to the regular review of that selection. Furthermore, the selection criteria should be relevant for the prevention, detection, investigation and prosecution of terrorist offences and serious crime and should demonstrate an objective link or suspicion of a link, with the carriage of passengers by air.

Amendment 20

Proposal for a regulation

Recital 14 a (new)

Text proposed by the Commission	Amendment
	(14a) In order to comply with the requirements of the Court of Justice of the European Union (CJEU), this Regulation should lay down a common methodology for carrying out a threat assessment based on which the Member States should operate a selection of intra-EU flights. That common methodology should also help avoid divergent practices among Member States and allow for effective supervision by the national data protection authorities.

Amendment 21

Proposal for a regulation

Recital 15

Text proposed by the Commission	Amendment
(15) In order to enable the application of that selective approach under this Regulation in respect of intra-EU flights, the Member States should be required to draw up and submit to eu-LISA the lists of the flights they selected, so that eu-LISA can ensure that only for those flights API data is transmitted from the router to the relevant PIUs and that the API data on other intra-EU flights is immediately and permanently deleted.	(15) In order to enable the application of that selective approach under this Regulation in respect of intra-EU flights, the Member States should be required to draw up and submit to eu-LISA the lists of the flights they selected, so that eu-LISA can ensure that only API data for those flights is transmitted from the router to the relevant PIUs and that the API data on other intra-EU flights is immediately and permanently deleted.

Amendment 22

Proposal for a regulation

Recital 15 a (new)

Text proposed by the Commission	Amendment
	(15a) In order to increase cohesion among the selective approaches taken by the different Member States, the Commission should facilitate a regular exchange of views on the choice of selection criteria, including the sharing of best practices, as well as, on a voluntary basis, of selected flights.

Amendment 23

Proposal for a regulation

Recital 16

Text proposed by the Commission	Amendment
(16) In order not to endanger the effectiveness of the system that relies on the collection and transfer of API data set up by this Regulation, and of PNR data under the system set up by Directive (EU) 2016/681, for the purpose of preventing, detecting, investigating and prosecuting terrorist offences and serious crime, in particular by creating the risk of circumvention, information on which intra-EU flights the Member States selected should be treated in a confidential manner. For that reason, such information should not be shared with the air carriers and they should therefore be required to collect API data on all flights covered by this Regulation, including all intra-EU flights, and then transfer it to the router, where the necessary selection should be enacted. Moreover, by collecting API data on all intra-EU flights, passengers are not made aware on which selected intra-EU flights API data, and hence also PNR data, is transmitted to PIUs in accordance with Member States’ assessment. That approach also ensures that any changes relating to that selection can be implemented swiftly and effectively, without imposing any undue economic and operational burdens on the air carriers.	(16) In order not to endanger the effectiveness of the system that relies on the collection and transfer of API data set up by this Regulation, and of PNR data under the system set up by Directive (EU) 2016/681, for the purpose of preventing, detecting, investigating and prosecuting terrorist offences and serious crime, in particular by creating the risk of circumvention, information on which intra-EU flights the Member States selected should be treated in a confidential manner. For that reason, such information should not be shared with the air carriers and they should therefore be required to collect API data on all flights covered by this Regulation, including all intra-EU flights, and then transfer it to the router, where the necessary selection should be enacted. Moreover, by collecting API data on all intra-EU flights, passengers are not made aware on which selected intra-EU flights API data, and hence also PNR data, is transmitted to the PIUs in accordance with the assessment of Member States. That approach also ensures that any changes relating to that selection can be implemented swiftly and effectively, without imposing any undue economic and operational burdens on the air carriers. Nonetheless, API data should not be collected and transferred on those flights where neither the Member State of departure nor the Member State of arrival of intra-EU flights have notified the Commission of their decision to apply Directive (EU) 2016/681 to intra-EU flights, pursuant to Article 2 of that Directive.

Amendment 24

Proposal for a regulation

Recital 16 a (new)

Text proposed by the Commission	Amendment
	(16a) This Regulation does not permit the collection and transfer of API data on intra-EU flights for the purposes of combating illegal immigration, in accordance with Union law and the case law of the Court of Justice of the European Union.

Amendment 25

Proposal for a regulation

Recital 17

Text proposed by the Commission	Amendment
(17) In the interest of ensuring compliance with the fundamental right to protection of personal data and in line with Regulation (EU) [API border management], this Regulation should identify the controllers. In the interest of effective monitoring, ensuring adequate protection of personal data and minimising security risks, rules should also be provided for on logging, security of processing and self-monitoring. Where they relate to the processing of personal data, those provisions should be understood as complementing the generally applicable acts of Union law on the protection of personal data, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council30 , Directive (EU) 2016/680 of the European Parliament and the Council31 and Regulation (EU) 2018/1725 of the European Parliament and the Council32 . Those acts, which also apply to the processing of personal data under this Regulation in accordance with the provisions thereof, should not be affected by this Regulation.	(17) In the interest of ensuring compliance with the passengers’ fundamental right to the protection of their personal data and in line with Regulation (EU) [API border management], this Regulation should identify the controllers. In the interest of effective monitoring, ensuring adequate protection of personal data and minimising security risks, rules should also be provided for on logging, security of processing and self-monitoring. Where they relate to the processing of personal data, those provisions should be understood as complementing the generally applicable acts of Union law on the protection of personal data, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council30 , Directive (EU) 2016/680 of the European Parliament and the Council31 and Regulation (EU) 2018/1725 of the European Parliament and the Council32 . Those acts, which also apply to the processing of personal data under this Regulation in accordance with the provisions thereof, should not be affected by this Regulation.
__________________	__________________
30 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), OJ L 119, 4.5.2016, p. 1.	30 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), OJ L 119, 4.5.2016, p. 1.
31 Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, OJ L 119, 4.5.2016, p. 89.	31 Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, OJ L 119, 4.5.2016, p. 89.
32 Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC, OJ L 295, 21.11.2018, p. 39	32 Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC, OJ L 295, 21.11.2018, p. 39

Amendment 26

Proposal for a regulation

Recital 17 a (new)

Text proposed by the Commission	Amendment
	(17a) Taking into account the right of passengers to be informed of the processing of their personal data, Member States should ensure that passengers are provided with accurate information about the collection of API data, the transfer of that data to the PIU and their rights as data subjects that is easily accessible and easy to understand, at the moment of the flight booking and at the moment of check-in. .

Amendment 27

Proposal for a regulation

Recital 17 b (new)

Text proposed by the Commission	Amendment
	(17b) In order to ensure compliance with the fundamental right to the protection of personal data, this Regulation should also set out rules on audits. The audits that Member States are responsible for should be carried out by the supervisory authorities referred to in Article 41 of Directive (EU) 2016/680 or by an auditing body entrusted with this task by the supervisory authority.

Amendment 28

Proposal for a regulation

Recital 17 c (new)

Text proposed by the Commission	Amendment
	(17c) In order to avoid that air carriers have to establish and maintain multiple connections with PIUs for the transfer of API data and PNR data, and to avoid the related inefficiencies and security risks, provision should be made for a single router, created and operated at the Union level, that should serve as a connection, filter and distribution point for those transfers. In the interest of efficiency and cost effectiveness, the router should, to the extent technically possible and in full respect of the rules of this Regulation and Regulation (EU) [API border management], rely on technical components from other relevant systems created under Union law, in particular the web service referred to in Regulation (EU) 2017/2226, the carrier gateway referred to in Regulation (EU) 2018/1240 and the carrier gateway referred to in Regulation (EC) 767/2008. In order to reduce the impact on air carriers and ensure a harmonised approach towards air carriers, eu-LISA should design the router, to the extent technically and operationally possible, in a way that is coherent and consistent with the obligations put on air carriers by Regulation (EU) 2017/2226, Regulation (EU) 2018/1240 and Regulation (EC) 767/2008.

Amendment 29

Proposal for a regulation

Recital 17 d (new)

Text proposed by the Commission	Amendment
	(17d) Furthermore, in order to provide for the same level of clarity and certainty, the provisions related to the router, security and support tasks by the eu-LISA should be mirrored in this Regulation and Regulation (EU) [API border management].

Amendment 30

Proposal for a regulation

Recital 17 e (new)

Text proposed by the Commission	Amendment
	(17e) The router should serve only to facilitate the transmission of API data from the air carriers to the PIUs in accordance with this Regulation, and should not be a repository of API data. Therefore, and in order to minimise any risk of unauthorised access or other misuse and in accordance with the principle of data minimisation, no storage should take place unless strictly necessary for technical purposes related to the transmission and the API data should be deleted from the router, immediately, permanently and in an automated manner, from the moment that the transmission has been completed.

Amendment 31

Proposal for a regulation

Recital 17 f (new)

Text proposed by the Commission	Amendment
	(17f) With a view to ensuring the proper functioning of the transmission of API data from router, the Commission should be empowered to lay down detailed technical and procedural rules on that transmission. Those rules should be such as to ensure that the transmission is secure, effective and swift and impacts passengers’ travel rights and air carriers no more than necessary.

Amendment 32

Proposal for a regulation

Recital 18

Text proposed by the Commission	Amendment
(18) The router to be created and operated under Regulation (EU) [API border management] should reduce and simplify the technical connections needed to transfer API data, limiting them to a single connection per air carrier and per PIU. Therefore, this Regulation provides for the obligation for the PIUs and air carriers to each establish such a connection to, and achieve the required integration with, the router, so as to ensure that the system for transferring API data established by this Regulation can function properly.	(18) The router to be created and operated under this Regulation and Regulation (EU) [API border management] should reduce and simplify the technical connections needed to transfer API data and PNR data, limiting them to a single connection per air carrier and per PIU. Therefore, this Regulation provides for the obligation for the PIUs and air carriers to each establish such a connection to, and achieve the required integration with, the router, so as to ensure that the system for transferring API data established by this Regulation can function properly. The design and development of the router by eu-LISA should enable the effective and efficient connection and integration of air carriers’ systems and infrastructure by providing for all relevant standards and technical requirements. To ensure the proper functioning of the system set up by this Regulation, detailed rules should be provided. When designing and developing the router, eu-LISA should ensure that API data transferred by air carriers and transmitted to PIUs is encrypted in transit.

Amendment 33

Proposal for a regulation

Recital 19

Text proposed by the Commission	Amendment
(19) In view of the Union interests at stake, appropriate costs incurred by the Member States in relation to their connections to, and integration with, the router, as required under this Regulation, should be borne by the Union budget, in accordance with the applicable legislation and subject to certain exceptions. The costs covered by those exceptions should be borne by each Member State concerned itself.	(19) In view of the Union interests at stake, the costs incurred by the European Data Protection Supervisor and eu-LISA for the performance of its tasks under this Regulation in respect of the router should be borne by the Union budget. The same should go for appropriate costs incurred by the Member States in relation to their connections to, and integration with, the router and costs related to the maintenance of those connections as required under this Regulation, should be borne by the Union budget, in accordance with the applicable legislation and subject to certain exceptions. The costs covered by those exceptions should be borne by each Member State concerned itself. The Union budget should also cover the support, such as training, by eu-LISA to air carriers and PIUs to enable effective transfer and transmission of API data through the router. The costs incurred by the independent national supervisory authorities in relation to the tasks entrusted to them under this Regulation shall also be borne by the respective Member States.

Amendment 34

Proposal for a regulation

Recital 20

Text proposed by the Commission	Amendment
(20) In accordance with Regulation (EU) 2018/1726, Member States may entrust eu-LISA with the task of facilitating connectivity with air carriers in order to assist Member States in the implementation of Directive (EU) 2016/681, particularly by collecting and transferring PNR data via the router.	deleted

Amendment 35

Proposal for a regulation

Recital 20 a (new)

Text proposed by the Commission	Amendment
	(20a) In order to allow both the air carriers and the PIUs to make the most efficient use of their connections to the router, to prevent any duplication of passenger data transfers and processing, and to ensure compliance with the CJEU case-law and enhance the related monitoring and supervision, this Regulation should provide for the mandatory use of the router by the air carriers for transferring PNR data, and for the PIUs for receiving such data. The router should constitute the only necessary and available means for the Member States to require air carriers to comply with the obligations related to transfer of PNR data as foreseen by the PNR Directive.

Amendment 36

Proposal for a regulation

Recital 21

Text proposed by the Commission	Amendment
(21) It cannot be excluded that, due to exceptional circumstances and despite all reasonable measures having been taken in accordance with this Regulation and, as regards the router, Regulation (EU) [API border management], the router or the systems or infrastructure connecting the PIUs and the air carriers thereto fail to function properly, thus leading to a technical impossibility to use the router to transmit API data. Given the unavailability of the router and that it will generally not be reasonably possible for air carriers to transfer the API data affected by the failure in a lawful, secure, effective and swift manner through alternative means, the obligation for air carriers to transfer that API data to the router should cease to apply for as long as the technical impossibility persist. In order to minimise the duration and negative consequences thereof, the parties concerned should in such a case immediately inform each other and immediately take all necessary measures to address the technical impossibility. This arrangement should be without prejudice to the obligations under this Regulation of all parties concerned to ensure that the router and their respective systems and infrastructure function properly, as well as the fact that air carriers are subject to penalties when they fail to meet those obligations, including when they seek to rely on this arrangement where such reliance is not justified. In order to deter such abuse and to facilitate supervision and, where necessary, the imposition of penalties, air carriers that rely on this arrangement on account of the failure of their own system and infrastructure should report thereon to the competent supervisory authority.	(21) It cannot be excluded that, due to exceptional circumstances and despite all reasonable measures having been taken in accordance with this Regulation and Regulation (EU) [API border management], the router or the systems or infrastructure connecting the PIUs and the air carriers thereto fail to function properly, thus leading to a technical impossibility to use the router to transmit API data. Given the unavailability of the router and that it will generally not be reasonably possible for air carriers to transfer the API data affected by the failure in a lawful, secure, effective and swift manner through alternative means, the obligation for air carriers to transfer that API data to the router should cease to apply for as long as the technical impossibility persist. In order to minimise the duration and negative consequences thereof, the parties concerned should in such a case immediately inform each other and immediately take all necessary measures to address the technical impossibility. This arrangement should be without prejudice to the obligations under this Regulation of all parties concerned to ensure that the router and their respective systems and infrastructure function properly, as well as the fact that air carriers are subject to penalties when they fail to meet those obligations, including when they seek to rely on this arrangement where such reliance is not justified. In order to deter such abuse and to facilitate supervision and, where necessary, the imposition of penalties, air carriers that rely on this arrangement on account of the failure of their own system and infrastructure should report thereon to the competent supervisory authority.

Amendment 37

Proposal for a regulation

Recital 23

Text proposed by the Commission	Amendment
(23) Effective, proportionate and dissuasive penalties, including financial ones, should be provided for by Member States against those air carriers failing to meet their obligations regarding the collection and transfer of API data under this Regulation.	(23) Effective, proportionate and dissuasive penalties, including financial ones, should be provided for by Member States against those air carriers failing to meet their obligations regarding the collection and transfer of API and PNR data under this Regulation.

Amendment 38

Proposal for a regulation

Recital 23 a (new)

Text proposed by the Commission	Amendment
	(23a) When providing for the penalties applicable to air carriers under this Regulation, Member States should take into account the technical and operational feasibility of ensuring complete data accuracy. Additionally, when penalties are imposed, their application and value should be established taking into consideration the actions undertaken by the air carrier to mitigate the issue as well as its level of cooperation with national authorities.

Amendment 39

Proposal for a regulation

Recital 23 b (new)

Text proposed by the Commission	Amendment
	(23b) In order to store the reports and statistics of the router on the Central Repository for Reporting and Statistics, it is necessary to amend Regulation (EU) 2019/817 of the European Parliament and of the Council.1a The Central Repository for Reporting and Statistics should provide only statistics based on API data for the implementation and effective supervision of this Regulation. The data that the router automatically transmits to the Central Repository for Reporting and Statistics to that end should not allow for the identification of the passengers concerned. The router should not transmit any data to the Central Repository for Reporting and Statistics for those intra-EU flights that have not been selected by a Member State based on an assessment in compliance with the criteria and methodology for the selection of intra-EU flights set out in this Regulation.
	__________________
	1a Regulation (EU) 2019/817 of the European Parliament and of the Council of 20 May 2019 on establishing a framework for interoperability between EU information systems in the field of borders and visa and amending Regulations (EC) No 767/2008, (EU) 2016/399, (EU) 2017/2226, (EU) 2018/1240, (EU) 2018/1726 and (EU) 2018/1861 of the European Parliament and of the Council and Council Decisions 2004/512/EC and 2008/633/JHA (OJ L 135, 22.5.2019, p. 27).

Amendment 40

Proposal for a regulation

Recital 24

Text proposed by the Commission	Amendment
(24) In order to adopt measures relating to the technical requirements and operational rules for the automated means for the collection of machine-readable API data, to the common protocols and formats to be used for the transfer of API data by air carriers, to the technical and procedural rules for the transmission of API data from the router and to the PIUs and to the PIU’s and air carriers’ connections to and integration with the router, the power to adopt acts in accordance with Article 290 of the Treaty on the Functioning of the European Union should be delegated to the Commission in respect of Articles 4, 5, 10 and 11, respectively. It is of particular importance that the Commission carry out appropriate consultations during its preparatory work, including at expert level, and that those consultations be conducted in accordance with the principles laid down in the Interinstitutional Agreement on Better Law-Making of 13 April 201633 . In particular, to ensure equal participation in the preparation of delegated acts, the European Parliament and the Council receive all documents at the same time as Member States’ experts, and their experts systematically have access to meetings of Commission expert groups dealing with the preparation of delegated acts.	(24) In order to adopt measures relating to the technical requirements and operational rules for the automated means for the collection of machine-readable API data, to the common protocols and formats to be used for the transfer of API data by air carriers, to the technical and procedural rules for the transmission of API data from the router and to the PIUs and to the PIU’s and air carriers’ connections to and integration with the router, the power to adopt acts in accordance with Article 290 of the Treaty on the Functioning of the European Union should be delegated to the Commission in respect of Articles 4, 5, 10 and 11, respectively. It is of particular importance that the Commission carry out appropriate consultations with relevant stakeholders, including air carriers, during its preparatory work, including at expert level, and that those consultations be conducted in accordance with the principles laid down in the Interinstitutional Agreement on Better Law-Making of 13 April 201633. In particular, to ensure equal participation in the preparation of delegated acts, the European Parliament and the Council receive all documents at the same time as Member States’ experts, and their experts systematically have access to meetings of Commission expert groups dealing with the preparation of delegated acts. Taking into account the state of the art, those technical requirements and rules might change over time.
__________________	__________________
33 OJ L 123, 12.5.2016, p. 1.	33 OJ L 123, 12.5.2016, p. 1.

Amendment 41

Proposal for a regulation

Recital 24 a (new)

Text proposed by the Commission	Amendment
	(24a) It is important to collect reliable and useful statistics based on the implementation of this Regulation in order to support its objectives and inform the evaluations under this Regulation. Such statistics should not contain any personally identifiable data. All relevant stakeholders, including relevant Member State authorities, Europol and, where appropriate, air carriers, should have access to those statistics.

Amendment 42

Proposal for a regulation

Recital 24 b (new)

Text proposed by the Commission	Amendment
	(24b) In order to ensure uniform conditions for the implementation of this Regulation, namely as regards the start of operations of the router, implementing powers should be conferred on the Commission. Those powers should be exercised in accordance with Regulation (EU) No 182/2011 of the European Parliament and of the Council1a.
	__________________
	1a Regulation (EU) No 182/2011 of the European Parliament and of the Council of 16 February 2011 laying down the rules and general principles concerning mechanisms for control by Member States of the Commission’s exercise of implementing powers (OJ L 55, 28.2.2011, p. 13).

Amendment 43

Proposal for a regulation

Recital 25

Text proposed by the Commission	Amendment
(25) All interested parties, and in particular the air carriers and the PIUs, should be afforded sufficient time to make the necessary preparations to be able to meet their respective obligations under this Regulation, taking into account that some of those preparations, such as those regarding the obligations on the connection to and integration with the router, can only be finalised when the design and development phases of the router have been completed and the router starts operations. Therefore, this Regulation should apply only from an appropriate date after the date at which the router starts operations, as specified by the Commission in accordance with Regulation (EU) [API border management]. However, it should be possible for the Commission to adopt delegated acts under this Regulation already from an earlier date, so as to ensure that the system set up by this Regulation is operational as soon as possible.	(25) All interested parties, and in particular the air carriers and the PIUs, should be afforded sufficient time to make the necessary preparations to be able to meet their respective obligations under this Regulation, taking into account that some of those preparations, such as those regarding the obligations on the connection to and integration with the router, can only be finalised when the design and development phases of the router have been completed and the router starts operations. Therefore, this Regulation should apply only from an appropriate date after the date at which the router starts operations, as specified by the Commission in accordance with this Regulation and Regulation (EU) [API border management].

Amendment 44

Proposal for a regulation

Recital 25 a (new)

Text proposed by the Commission	Amendment
	(25a) This Regulation should be subject to regular evaluations to ensure the monitoring of its effective application. In particular, the collection of API data should not be to the detriment of the travel experience of legitimate passengers. Therefore, the Commission should include in its regular evaluation reports on the application of this Regulation an assessment of the impact of this Regulation on the travel experience of legitimate passengers.

Amendment 45

Proposal for a regulation

Recital 25 b (new)

Text proposed by the Commission	Amendment
	(25b) Given that this Regulation requires additional adjustment and administrative costs by the air carriers, the overall regulatory burden for the aviation sector should be kept under close review. Against this backdrop, the report evaluating the functioning of this Regulation should assess the extent to which the objectives of the Regulation have been met and to which it has impacted the competitiveness of the sector. Therefore, the Commission’s report should also conduct a holistic assessment and refer to the interaction of this Regulation with other relevant EU legislative acts, in particular Regulation (EU) 2017/2226, Regulation (EU) 2018/1240 and Regulation (EC) 767/2008. The report should assess the overall impact of related reporting obligations on air carriers, identifying provisions that could be updated and simplified, where appropriate, to mitigate the burden on air carriers, as well as actions and measures that have been or could be taken to reduce the total cost pressure on the aviation sector.

Amendment 46

Proposal for a regulation

Article 1 – paragraph 1 – point a

Text proposed by the Commission	Amendment
(a) the collection by air carriers of advance passenger information data (‘API data’) on extra EU flights and selected intra EU flights;	(a) the collection by air carriers of advance passenger information data (‘API data’) on extra EU flights and intra EU flights;

Amendment 47

Proposal for a regulation

Article 1 – paragraph 1 – point c

Text proposed by the Commission	Amendment
(c) the transmission from the router to the Passenger Information Units (‘PIUs’) of the API data on extra-EU flights and selected intra-EU flights.	(c) the transmission from the router to the Passenger Information Units (‘PIUs’) of the API data and PNR data on extra-EU flights and selected intra-EU flights.

Amendment 48

Proposal for a regulation

Article 1 – paragraph 1 a (new)

Text proposed by the Commission	Amendment
	This Regulation is without prejudice to Regulation (EU) 2016/679, Regulation (EU) 2018/1725 and Directive (EU) 2016/680.

Amendment 49

Proposal for a regulation

Article 3 – paragraph 1 – point c

Text proposed by the Commission	Amendment
(c) ‘intra-EU flight’ means any flight as defined in Article 3, point (3), of Directive (EU) 2016/681;	(c) ‘intra-EU flight’ means any flight as defined in Article 3, point (3), of Directive (EU) 2016/681, with the exception of those flights for which neither the Member State from where the flight is scheduled to depart, nor the Member State where the flight is scheduled to land, have notified their decision to apply Directive 2016/681 to intra-EU flights, pursuant to Article 2 of that Directive;

Amendment 50

Proposal for a regulation

Article 3 – paragraph 1 – point d

Text proposed by the Commission	Amendment
(d) ‘scheduled flight’ means a flight as defined in Article 3, point (e), of Regulation (EU) [API border management];	(d) ‘scheduled flight’ means a commercial flight as defined in Article 3, point (e), of Regulation (EU) [API border management];

Amendment 51

Proposal for a regulation

Article 3 – paragraph 1 – point e

Text proposed by the Commission	Amendment
(e) ‘non-scheduled flight’ means a flight as defined in Article 3, point (f), of Regulation (EU) [API border management];	(e) ‘non-scheduled flight’ means a commercial flight as defined in Article 3, point (f), of Regulation (EU) [API border management];

Amendment 52

Proposal for a regulation

Article 3 – paragraph 1 – point g

Text proposed by the Commission	Amendment
(g) ‘crew’ means any person as defined in Article 3, point (h), of Regulation (EU) [API border management];	(g) ‘crew’ means any person as defined in Article 3, point (i), of Regulation (EU) [API border management];

Amendment 53

Proposal for a regulation

Article 3 – paragraph 1 – point h

Text proposed by the Commission	Amendment
(h) ‘traveller’ means any person as defined in Article 3, point (i), of Regulation (EU) [API border management];	deleted

Amendment 54

Proposal for a regulation

Article 3 – paragraph 1 – point i

Text proposed by the Commission	Amendment
(i) ‘advance passenger information data’ or ‘API data’ means the data as defined in Article 3, point (j), of Regulation (EU) [API border management];	(i) ‘advance passenger information data’ or ‘API data’ means the data as defined in Article 3, point (k), of Regulation (EU) [API border management];

Amendment 55

Proposal for a regulation

Article 3 – paragraph 1 – point m

Text proposed by the Commission	Amendment
(m) ‘serious crime’ means the offences as defined in Article 3, point (9), of Directive 2016/681;	(m) ‘serious crime’ means the offences as defined in Article 3, point (9), of Directive (EU) 2016/681;

Amendment 56

Proposal for a regulation

Article 3 – paragraph 1 – point n

Text proposed by the Commission	Amendment
(n) ‘the router’ means the router as defined in Article 3, point (k) of Regulation (EU) [API border management];	(n) ‘the router’ means the router as referred to in Article 4b;

Amendment 57

Proposal for a regulation

Article 4 – paragraph 1

Text proposed by the Commission	Amendment
1. Air carriers shall collect API data of travellers on the flights referred to in Article 2, for the purpose of transferring that API data to the router in accordance with paragraph 6. Where the flight is code-shared between one or more air carriers, the obligation to transfer the API data shall be on the air carrier that operates the flight.	1. Air carriers shall collect API data of passengers, consisting of the passenger data and the flight information specified in paragraphs 1a and 1b of this Article, respectively, on the flights referred to in Article 2, for the purpose of transferring that API data to the router in accordance with paragraph 6. Where the flight is code-shared between one or more air carriers, the obligation to transfer the API data shall be on the air carrier that operates the flight.

Amendment 58

Proposal for a regulation

Article 4 – paragraph 1 a (new)

Text proposed by the Commission	Amendment
	1a. The API data shall consist only of the following passenger data relating to each passenger on the flight:
	(a) the surname (family name), first name or names (given names);
	(b) the date of birth, sex and nationality;
	(c) the type and number of the travel document and the three-letter code of the issuing country of the travel document;
	(d) the date of expiry of the validity of the travel document;
	(e) the number identifying a passenger name record used by an air carrier to locate a passenger within its information system (PNR record locator);
	(f) the number of the seat in the aircraft assigned to a passenger, where the air carrier collects such information;
	(g) the number and the weight of checked bags, where the air carrier collects such information.

Amendment 59

Proposal for a regulation

Article 4 – paragraph 1 b (new)

Text proposed by the Commission	Amendment
	1b. The API data shall also consist only of the following flight information relating to the flight of each passenger:
	(a) the flight identification number or, where the flight is code-shared between one or more air carriers, the flight identification numbers, or, if no such number exists, other clear and suitable means to identify the flight;
	(b) where applicable, the border crossing point of entry into the territory of the Member State;
	(c) the code of the airport of entry into the territory of the Member State;
	(d) the initial point of embarkation;
	(e) the local date and estimated time of departure;
	(f) the local date and estimated time of arrival.

Amendment 60

Proposal for a regulation

Article 4 – paragraph 2 – subparagraph 1 a (new)

Text proposed by the Commission	Amendment
	The collection of API data in accordance with the first subparagraph shall not include an obligation for air carriers to check the travel document at the moment of boarding the aircraft or an obligation for passengers to carry a travel document when travelling, without prejudice to acts of national law that are compatible with Union law.

Amendment 61

Proposal for a regulation

Article 4 – paragraph 3 – subparagraph 1

Text proposed by the Commission	Amendment
Air carriers shall collect the API data referred to Article 4(2), points (a) to (d), of Regulation (EU) [API border management] using automated means to collect the machine-readable data of the travel document of the traveller concerned. They shall do so in accordance with the detailed technical requirements and operational rules referred paragraph 5, where such rules have been adopted and are applicable.	Air carriers shall collect the API data referred to in paragraph 1a (new) points (a) to (d), using automated means to collect the machine-readable data of the travel document of the passenger concerned. Air carriers shall collect that data during the check-in process, either as part of the online check-in or as part of the check-in at the airport. They shall do so in accordance with the detailed technical requirements and operational rules referred to in paragraph 5, once such rules have been adopted and are applicable and, in particular, by using the most reliable automated means available to collect the machine-readable data of the respective travel document.

Amendment 62

Proposal for a regulation

Article 4 – paragraph 3 – subparagraph 1 a (new)

Text proposed by the Commission	Amendment
	The collection of API data with automated means shall not lead to the collection of any biometric data contained in the travel document.

Amendment 63

Proposal for a regulation

Article 4 – paragraph 3 – subparagraph 1 b (new)

Text proposed by the Commission	Amendment
	Where air carriers provide an online check-in process, they shall enable passengers to provide the API data referred to in paragraph 1a, points (a) to (d), during the online check-in process, using automated means.

Amendment 64

Proposal for a regulation

Article 4 – paragraph 3 – subparagraph 2

Text proposed by the Commission	Amendment
However, where such use of automated means is not possible due to the travel document not containing machine-readable data, air carriers shall collect that data manually, in such a manner as to ensure compliance with paragraph 2.	Where the use of automated means is not possible, air carriers shall collect that data manually, either as part of the online check-in or as part of the check-in at the airport, in such a manner as to ensure compliance with paragraph 2.

Amendment 65

Proposal for a regulation

Article 4 – paragraph 4

Text proposed by the Commission	Amendment
4. Any automated means used by air carriers to collect API data under this Regulation shall be reliable, secure and up-to-date.	4. Any automated means used by air carriers to collect API data under this Regulation shall be reliable, secure and up-to-date. Air carriers shall ensure that API data is encrypted during the transmission of the data from the passenger to the air carriers.

Amendment 66

Proposal for a regulation

Article 4 – paragraph 5

Text proposed by the Commission	Amendment
5. The Commission is empowered to adopt delegated acts in accordance with Article 19 to supplement this Regulation by laying down detailed technical requirements and operational rules for the collection of the API data referred to in Article 4(2), points (a) to (d), of Regulation (EU) [API border management] using automated means in accordance with paragraphs 3 and 4 of this Article.	5. The Commission is empowered to adopt delegated acts in accordance with Article 19 to supplement this Regulation by laying down detailed technical requirements and operational rules for the collection of the API data referred to in paragraph 1a, points (a) to (d), using automated means in accordance with paragraphs 3 and 4 of this Article, including on requirements for data security.

Amendment 67

Proposal for a regulation

Article 4 – paragraph 6

Text proposed by the Commission	Amendment
6. Air carriers shall transfer the API data collected pursuant to paragraph 1 to the router, by electronic means. They shall do so in accordance with the detailed rules referred to in paragraph 9, where such rules have been adopted and are applicable.	6. Air carriers shall transfer the encrypted API data to the router, by electronic means. They shall do so in accordance with the detailed rules referred to in paragraph 9, once such rules have been adopted and are applicable.

Amendment 68

Proposal for a regulation

Article 4 – paragraph 7

Text proposed by the Commission	Amendment
7. Air carriers shall transfer the API data both at the moment of check-in and immediately after flight closure, that is, once the travellers have boarded the aircraft in preparation for departure and it is no longer possible for travellers to board or to leave the aircraft.	7. Air carriers shall transfer the API data both at the moment of check-in and immediately after flight closure, that is, once the passengers have boarded the aircraft in preparation for departure and it is no longer possible for passengers to board or to leave the aircraft. At the moment of check-in, air carriers shall transfer the API data in accordance with this Regulation and relevant international standards. Air carriers shall receive an acknowledgement of receipt of the transfer of the API data.

Amendment 69

Proposal for a regulation

Article 4 – paragraph 7 a (new)

Text proposed by the Commission	Amendment
	7a. The Commission is empowered to adopt delegated acts in accordance with Article 19 to supplement this Regulation by laying down the necessary detailed rules on the common protocols and supported data formats to be used for the encrypted transfers of API data to the router referred to in paragraph 6, including the transfer of API data at the moment of check-in and requirements for data security. Such detailed rules shall ensure that airlines transmit API data using the same structure and content.

Amendment 70

Proposal for a regulation

Article 4 – paragraph 7 b (new)

Text proposed by the Commission	Amendment
	7b. The PIUs shall process API data, transferred to them in accordance with this Regulation, solely for the purposes referred to in Article 1.
	The PIUs or other competent authorities shall under no circumstances process API data for the purposes of profiling.

Amendment 71

Proposal for a regulation

Article 4 – paragraph 8 – subparagraph 1 – introductory part

Text proposed by the Commission	Amendment
Without prejudice to the possibility for air carriers to retain and use the data where necessary for the normal course of their business in compliance with the applicable law, air carriers shall immediately either correct, complete or update, or permanently delete, the API data concerned in both of the following situations:	Air carriers shall store, for 24 hours from the moment of departure of the flight, the API data relating to that passenger that they collected pursuant to Article 4. They shall immediately and permanently delete that API data after the expiry of that time period. This is without prejudice to the possibility for air carriers to retain and use the data where necessary for the normal course of their business in compliance with the applicable law and in particular Regulation (EU) 2016/679.
	Air carriers shall immediately either correct, complete or update, or permanently delete, the API data concerned in both of the following situations:

Amendment 72

Proposal for a regulation

Article 4 – paragraph 8 – subparagraph 1 – point a

Text proposed by the Commission	Amendment
(a) where they become aware that the API data collected is inaccurate, incomplete or no longer up-to-date or was processed unlawfully, or that the data transferred does not constitute API data;	(a) where they become aware that the API data collected is inaccurate, incomplete or no longer up-to-date;

Amendment 73

Proposal for a regulation

Article 4 – paragraph 8 a (new)

Text proposed by the Commission	Amendment
	8a. Air carriers shall immediately and permanently delete API data where they become aware that the API data collected was processed unlawfully or that the data transferred does not constitute API data.

Amendment 74

Proposal for a regulation

Article 4 – paragraph 8 b (new)

Text proposed by the Commission	Amendment
	8b. Where the air carriers become aware of the circumstances referred to in point (a) of paragraph 8a or paragraph 8b after having completed the transfer of the data in accordance with paragraph 6, they shall immediately inform the European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA). Upon receiving such information, eu-LISA shall immediately inform the PIUs that received the API data transmitted through the router.

Amendment 75

Proposal for a regulation

Article 4 – paragraph 9

Text proposed by the Commission	Amendment
9. The Commission is empowered to adopt delegated acts in accordance with Article 19 to supplement this Regulation by laying down the necessary detailed rules on the common protocols and supported data formats to be used for the transfers of API data to the router referred to in paragraph 6.	deleted

Amendment 76

Proposal for a regulation

Article 4 – paragraph 9 a (new)

Text proposed by the Commission	Amendment
	9a. In accordance with Directive 2016/681, air carriers shall also transfer PNR data to the router, insofar as those data are collected in the normal course of their business, for the transmission of those data from the router to the respective PIUs in accordance with Article 5(4). Air carriers shall not be allowed to transfer PNR data in accordance with Article 8(1) of Directive 2016/681 by any other means.

Amendment 77

Proposal for a regulation

Article 4 a (new)

Text proposed by the Commission	Amendment
	Article 4a
	Fundamental Rights
	1. The collection and processing of personal data in accordance with this Regulation and Regulation (EU) [API Border Management] by air carriers and competent authorities shall not result in discrimination against persons on the grounds of sex and gender, race, colour, ethnic or social origin, genetic features, language, religion or belief, political or any other opinion, membership of a national minority, property, birth, disability, age or sexual orientation.
	2. This Regulation shall fully respect human dignity and the fundamental rights and principles recognised by the Charter of Fundamental Rights of the European Union, including the right to respect for one’s private life, to asylum, to the protection of personal data, to freedom of movement and to effective legal remedies.
	3. Particular attention shall be paid to children, the elderly, persons with a disability and vulnerable persons. The best interests of the child shall be a primary consideration when implementing this Regulation.

Amendment 78

Proposal for a regulation

Chapter 2 a (new)

Text proposed by the Commission	Amendment
	CHAPTER 2a (new)
	PROVISIONS RELATING TO THE ROUTER
	Article 4b
	The Router
	1. eu-LISA shall design, develop, host and technically manage, in accordance with Articles 11a and 11b, a router for the purpose of facilitating the transfer of encrypted API and PNR data by the air carriers to the PIUs in accordance with this Regulation.
	2. The router shall be composed of:
	(a) a central infrastructure, including a set of technical components enabling the transmission of API and PNR data;
	(b) a secure communication channel between the central infrastructure and the PIUs, and a secure communication channel between the central infrastructure and the air carriers, for the transfer of API and PNR data and for any communications relating thereto.
	3. The router shall allow for the reception and transmission of encrypted API data.
	4. The router shall automatically extract and make available the statistics, in accordance with Article 31, to the central repository for reporting and statistics.
	5. Without prejudice to Article 4c of this Regulation, the router shall, where appropriate and to the extent technically possible, share and re-use the technical components, including hardware and software components, of the web service referred to in Article 13 of Regulation (EU) 2017/2226 of the European Parliament and of the Council1a, the carrier gateway referred to in Article 6(2), point (k), of Regulation (EU) 2018/1240, and the carrier gateway referred to in Article 2a, point (h), of Regulation (EC) 767/2008 of the European Parliament and of the Council1b. eu-LISA shall design the router, to the extent technically and operationally possible, in a way that is coherent and consistent with the obligations put on air carriers by Regulation (EU) 2017/2226, Regulation (EU) 2018/1240 and Regulation (EC) 767/2008.
	6. eu-LISA shall design and develop the router in a way that for any transfer of API and PNR data from the air carriers to the router in accordance with Article 4, and for any transmission of API and PNR data from the router to the PIUs in accordance with Article 5 and to the central repository for reporting and statistics in accordance with Article 16a(new)(2), the API and PNR data is end-to-end encrypted during transit.
	Article 4c
	Exclusive use of the router
	Notwithstanding the use of the router in Article 10 of Regulation (EU) [API border management], the router shall only be used:
	(a) by air carriers to transfer encrypted API data or other PNR data in accordance with this Regulation;
	(b) by PIUs to receive encrypted API data or other PNR data in accordance with this Regulation.
	Article 4d
	Data format and transfer verifications
	1. The router shall, in an automated manner and based on real-time flight traffic data, verify whether the air carrier transferred the API data in accordance with Article 4(6).
	2. The router shall, immediately and in an automated manner, verify whether the API data transferred to it in accordance with Article 6(1) complies with the detailed rules on the supported data formats, referred to in Article 4(7a).
	3. Where the router has verified in accordance with paragraph 1 that the data was not transferred by the air carrier or where the data in question is not compliant with the detailed rules referred to in paragraph 2, the router shall, immediately and in an automated manner, notify the air carrier concerned and the competent border authorities of the Member States to which the data were to be transmitted pursuant to Article 11(1). In this case, the air carrier shall immediately transfer the API data in accordance with Article 4 paragraphs 6, 7 and 7a.
	4. The Commission shall adopt implementing acts specifying the necessary detailed technical and procedural rules for the verifications and notifications referred to in paragraph 1, 2 and 3 of this Article. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 18a(2).
	__________________
	1a Regulation (EU) 2017/2226 of the European Parliament and of the Council of 30 November 2017 establishing an Entry/Exit System (EES) to register entry and exit data and refusal of entry data of third-country nationals crossing the external borders of the Member States and determining the conditions for access to the EES for law enforcement purposes, and amending the Convention implementing the Schengen Agreement and Regulations (EC) No 767/2008 and (EU) No 1077/2011 (OJ L 327, 9.12.2017, p. 20).
	1b Regulation (EC) No 767/2008 of the European Parliament and of the Council of 9 July 2008 concerning the Visa Information System (VIS) and the exchange of data between Member States on short-stay visas (VIS Regulation) (OJ L 218, 13.8.2008, p. 60).

Amendment 79

Proposal for a regulation

Article 5 – paragraph 1 – subparagraph 1

Text proposed by the Commission	Amendment
The router shall, immediately and in an automated manner, transmit the API data, transferred to it by air carriers pursuant to Article 4, to the PIUs of the Member State on the territory of which the flight will land or from the territory of which the flight will depart, or to both in the case of intra-EU-flights. Where a flight has one or more stop-overs at the territory of other Member States than the one from which it departed, the router shall transmit the API data to the PIUs of all the Member States concerned.	Upon the verifications referred to in Article 10a, the router shall, immediately and in an automated manner, transmit the API data, transferred to it by air carriers pursuant to Article 4, to the PIUs of the Member State on whose territory the flight will land or depart, or to both in the case of intra-EU-flights. Where a flight has one or more stop-overs at the territory of other Member States than the one from which it departed, the router shall transmit the API data to the PIUs of all the Member States concerned.

Amendment 80

Proposal for a regulation

Article 5 – paragraph 1 – subparagraph 3

Text proposed by the Commission	Amendment
However, for intra-EU flights, the router shall only transmit the API data to that PIU in respect of the flights included in the list referred to in paragraph 2.	However, for intra-EU flights, the router shall only transmit API data of the flights included in the list referred to in paragraph 2 to the applicable PIUs.

Amendment 81

Proposal for a regulation

Article 5 – paragraph 1 – subparagraph 4

Text proposed by the Commission	Amendment
The router shall transmit the API data in accordance with the detailed rules referred to in paragraph 3, where such rules have been adopted and are applicable.	The router shall transmit the API data in accordance with the detailed rules referred to in paragraph 3, once such rules have been adopted and are applicable.

Amendment 82

Proposal for a regulation

Article 5 – paragraph 3

Text proposed by the Commission	Amendment
3. The Commission is empowered to adopt delegated acts in accordance with Article 19 to supplement this Regulation by laying down the necessary detailed technical and procedural rules for the transmissions of API data from the router referred to in paragraph 1.	3. The Commission is empowered to adopt delegated acts in accordance with Article 19 to supplement this Regulation by laying down the necessary detailed technical and procedural rules for the transmissions of API data from the router referred to in paragraph 1, including on requirements for data security.

Amendment 83

Proposal for a regulation

Article 5 – paragraph 3 a (new)

Text proposed by the Commission	Amendment
	3a. This provision shall apply mutatis mutandis to the transmission of PNR data from the router to the PIUs of the Member States in accordance with Article 8(1) of Directive 2016/681, which shall be the only means for PIUs to receive PNR data from air carriers.

Amendment 84

Proposal for a regulation

Article 5 a (new)

Text proposed by the Commission	Amendment
	Article 5a
	Methodology and criteria for the selection of intra-EU flights
	Member States that decide to apply Directive (EU) 2016/681 and consequently this Regulation to intra-EU flights shall for the selection of those flights:
	(a) carry out an objective, duly reasoned and non-discriminatory threat assessment in accordance with Article 2 of Directive (EU) 2016/681, the case-law of the Court of Justice of the European Union and the fundamental rights laid down, inter alia, in Articles 7 and 8 of the Charter of Fundamental Rights;
	(b) take into account only criteria which are relevant for the prevention, detection, investigation and prosecution of terrorist offences and serious crime having an objective link, including an indirect link, with the carriage of passengers by air and not be purely based on nationality, sex, age, race, colour, ethnic origin, language, religion or belief or membership of a national minority of any passengers or groups of passengers;
	(c) in situations of a genuine and present or foreseeable terrorist threat, Member States may apply Directive (EU) 2016/681 to all intra-EU flights arriving at or departing from its territory, in a decision that is limited in time to what is strictly necessary and that is open to effective review. In the absence of such a situation, Member States shall target only specific routes, travel patterns or airports for which there are indications of suspicious activities regarding terrorist offenses and serious crime and that justify the transmission and processing of API data; and
	(d) use only sources that can inform an objective, duly reasoned and non-discriminatory threat assessment.
	Member States shall keep all documentation of such threat assessment, including of prolongations where relevant, and make it available, in accordance with Directive 2016/680, to their independent supervisory authorities and national supervisory authorities upon request.
	Member States shall limit the duration of their threat assessments to what is strictly necessary, and no longer than 3 months. That duration may be extended for a further 3 months where duly justified. Member States shall regularly review the list of selected intra-EU flights, in order to ensure strict adherence to the necessity and proportionality principles.
	The Commission shall facilitate a regular exchange of views on the selection criteria for the objective and reasoned threat assessments, including best practices, as well as, on a voluntary basis, exchange of information on selected flights.

Amendment 85

Proposal for a regulation

Article 5 b (new)

Text proposed by the Commission	Amendment
	Article 5b
	Deletion of API data from the router
	API data, transferred to the router pursuant to this Regulation, shall be stored on the router only insofar as necessary to complete the transmission to the PIUs and shall be deleted from the router, immediately, permanently and in an automated manner, in the following situations:
	(a) where the transmission of the API data to the relevant PIUs has been completed;
	(b) in cases of technical impossibility of the router to subsequently transmit the API data to the PIU, after 12 hours;
	(c) where the API data relates to other intra-EU flights than those included the lists referred to in Article 5(2) of this Regulation. The router shall automatically inform eu-LISA and the PIUs of the immediate deletion of these intra-EU flights for the purposes of the statistics referred to in Article 16a(1).

Amendment 86

Proposal for a regulation

Article 6 – paragraph -1 (new)

Text proposed by the Commission	Amendment
	-1. eu-LISA shall keep logs of all processing operations relating to the transfer of API data through the router under this Regulation. Those logs shall cover the following:
	(a) the air carrier that transferred the API data to the router;
	(b) the competent authorities and PIUs to which the API data was transmitted through the router;
	(c) the date and time of the transfers referred to in points (a) and (b), and place of transfer;
	(d) any access by staff of eu-LISA necessary for the maintenance of the router, as referred to in Article 11b(3);
	(e) any other information relating to those processing operations necessary to monitor the security and integrity of the API data and the lawfulness of those processing operations.
	Those logs shall not include any personal data, other than the information necessary to identify the relevant member of the staff of eu-LISA, referred to in point (d) of the first subparagraph.

Amendment 87

Proposal for a regulation

Article 6 – paragraph 1

Text proposed by the Commission	Amendment
1. Air carriers shall create logs of all processing operations under this Regulation undertaken using the automated means referred to in Article 4(3). Those logs shall cover the date, time, and place of transfer of the API data.	1. Air carriers shall create logs of all processing operations under this Regulation undertaken using the automated means referred to in Article 4(3). Those logs shall cover the date, time, and place of transfer of the API data. Those logs shall not contain any personal data, other than the information necessary to identify the relevant member of the staff of the air carrier.

Amendment 88

Proposal for a regulation

Article 6 – paragraph 3

Text proposed by the Commission	Amendment
3. Air carriers shall take appropriate measures to protect the logs that they created pursuant to paragraph 1 against unauthorised access and other security risks.	3. eu-LISA and air carriers shall take appropriate measures to protect the logs that they created pursuant to paragraph 1 against unauthorised access and other security risks.

Amendment 89

Proposal for a regulation

Article 6 – paragraph 3 a (new)

Text proposed by the Commission	Amendment
	3a. The national supervisory authorities referred to in Article 15 and PIUs shall have access to the relevant logs referred to in paragraph 1 where necessary for the purposes referred to in paragraph 2.

Amendment 90

Proposal for a regulation

Article 6 – paragraph 4 – subparagraph 1

Text proposed by the Commission	Amendment
Air carriers shall keep the logs that they created pursuant to paragraph 1, for a time period of one year from the moment of the creation of those logs. They shall immediately and permanently delete those logs upon the expiry of that time period.	eu-LISA and the air carriers shall keep the logs that they created pursuant to paragraph 1, for a time period of one year from the moment of the creation of those logs. They shall immediately and permanently delete those logs upon the expiry of that time period .

Amendment 91

Proposal for a regulation

Article 6 – paragraph 4 – subparagraph 2

Text proposed by the Commission	Amendment
However, if those logs are needed for procedures for monitoring or ensuring the security and integrity of the API data or the lawfulness of the processing operations, as referred to in paragraph 2, and those procedures have already begun at the moment of the expiry of the time period referred to in the first subparagraph, air carriers may keep those logs for as long as necessary for those procedures. In that case, they shall immediately delete those logs when they are no longer necessary for those procedures.	However, if those logs are needed for procedures for monitoring or ensuring the security and integrity of the API data or the lawfulness of the processing operations, as referred to in paragraph 2, and those procedures have already begun at the moment of the expiry of the time period referred to in the first subparagraph, air carriers may keep those logs for as long as necessary for those procedures, provided that eu-LISA or the air carriers inform the Commission of the need to keep those logs and provide reasons for doing so. In that case, they shall immediately delete those logs when they are no longer necessary for those procedures.

Amendment 92

Proposal for a regulation

Article 6 a (new)

Text proposed by the Commission	Amendment
	Article 6a
	Actions in the case of technical impossibility to use the router
	1. Where it is technically impossible to use the router to transmit API data because of a failure of the router, eu-LISA shall immediately notify the air carriers and PIUs of that technical impossibility in an automated manner. In that case, eu-LISA shall immediately take measures to address the technical impossibility to use the router and shall immediately notify those parties when it has been successfully addressed.
	During the time period between those notifications, Article 4(6) shall not apply, insofar as the technical impossibility prevents the transfer of API data to the router. Insofar as that is the case, Article 4 paragraphs 1 and 8 shall not apply either to the API data in question during that time period.
	2. Where it is technically impossible to use the router to transmit API data because of a failure of the systems or infrastructure referred to in Article 10 of a Member State, the PIU of that Member State shall immediately notify the air carriers, the other PIUs, eu-LISA and the Commission of that technical impossibility in an automated manner. In that case, that Member State shall immediately take measures to address the technical impossibility to use the router and shall immediately notify those parties when it has been successfully addressed.
	During the time period between those notifications, Article 4(6) shall not apply, insofar as the technical impossibility prevents the transfer of API data to the router. Insofar as that is the case, Article 4(1) shall not apply either to the API data in question during that time period.
	3. Where it is technically impossible to use the router to transmit API data because of a failure of the systems or infrastructure referred to in Article 11 of an air carrier, that air carrier shall immediately notify the PIUs, eu-LISA and the Commission of that technical impossibility in an automated manner. In that case, that air carrier shall immediately take measures to address the technical impossibility to use the router and shall immediately notify those parties when it has been successfully addressed.
	During the time period between those notifications, Article 4(6) shall not apply, insofar as the technical impossibility prevents the transfer of API data to the router. Insofar as that is the case, Article 4(1) shall not apply either to the API data in question during that time period.
	When the technical impossibility has been successfully addressed, the air carrier concerned shall, without delay, submit to the competent national supervisory authority referred to in Article 15 a report containing all necessary details on the technical impossibility, including the reasons for the technical impossibility, its extent and consequences as well as the measures taken to address it.

Amendment 93

Proposal for a regulation

Article 7 – paragraph 1

Text proposed by the Commission	Amendment
The PIUs shall be controllers, within the meaning of Article 3, point (8), of Directive (EU) 2016/680 in relation to the processing of API data constituting personal data under this Regulation through the router, including transmission and storage for technical reasons of that data on the router.	The PIUs shall be controllers, within the meaning of Article 3, point (8), of Directive (EU) 2016/680 in relation to the processing of API data constituting personal data under this Regulation through the router, including transmission of the data from the router to the PIUs and storage for technical reasons of that data on the router as well as in relation to their processing of API data constituting personal data referred to in Article 4(7b) of this Regulation.

Amendment 94

Proposal for a regulation

Article 7 a (new)

Text proposed by the Commission	Amendment
	Article 7a
	Personal data processor
	eu-LISA shall be the processor on behalf of the PIUs within the meaning of Article 3, point (9), of Directive 2016/680 for the processing of API data constituting personal data through the router in accordance with this Regulation.

Amendment 95

Proposal for a regulation

Article 7 b (new)

Text proposed by the Commission	Amendment
	Article 7b
	Information to passengers
	In accordance with the right of information in Article 13 of Regulation (EU) 2016/679, air carriers shall provide passengers, on flights covered by this Regulation, with information on the purpose of the collection of their personal data, the type of personal data collected, the recipients of the personal data and the means to exercise the data subject rights.
	This information shall be communicated to passengers in writing and in an easily accessible format at the moment of booking and at the moment of check-in, irrespective of the means used to collect the personal data at the moment of check-in, in accordance with Article 4.

Amendment 96

Proposal for a regulation

Article 8 – paragraph 1

Text proposed by the Commission	Amendment
PIUs and air carriers shall ensure the security of the API data, in particular API data constituting personal data, that they process pursuant to this Regulation.	1. PIUs and air carriers shall ensure the security of the API data, in particular API data constituting personal data, that they process pursuant to this Regulation.

Amendment 97

Proposal for a regulation

Article 8 – paragraph 2

Text proposed by the Commission	Amendment
PIUs and air carriers shall cooperate, in accordance with their respective responsibilities and in compliance with Union law, with each other and with eu-LISA to ensure such security.	2. PIUs and air carriers shall cooperate, in accordance with their respective responsibilities and in compliance with Union law, with each other and with eu-LISA to ensure such security.

Amendment 98

Proposal for a regulation

Article 8 – paragraph 2 a (new)

Text proposed by the Commission	Amendment
	2a. eu-LISA shall ensure the security and encryption of the API data, in particular API data constituting personal data, that it processes pursuant to this Regulation. The PIUs and the air carriers shall ensure the security of the API data, in particular API data constituting personal data, that they process pursuant to this Regulation. eu-LISA, the PIUs and the air carriers shall cooperate, in accordance with their respective responsibilities and in compliance with Union law, with each other to ensure such security.

Amendment 99

Proposal for a regulation

Article 8 – paragraph 2 b (new)

Text proposed by the Commission	Amendment
	2b. In particular, eu-LISA shall take the necessary measures to ensure the security of the router and the API data, in particular API data constituting personal data, transmitted through the router, including by establishing, implementing and regularly updating a security plan, a business continuity plan and a disaster recovery plan, in order to:
	(a) physically protect the router, including by making contingency plans for the protection of critical components thereof;
	(b) prevent any unauthorised processing of the API data, including any unauthorised access thereto and copying, modification or deletion thereof, both during the transfer of the API data to and from the router and during any storage of the API data on the router where necessary to complete the transmission, in particular by means of appropriate encryption techniques;
	(c) ensure that it is possible to verify and establish to which PIUs the API data is transmitted through the router;
	(d) properly report to its Management Board any faults in the functioning of the router;
	(e) monitor the effectiveness of the security measures required under this Article and under Regulation (EU) 2018/1725, and assess and update those security measures where necessary in the light of technological or operational developments.
	The measures referred to in the first subparagraph of this paragraph shall not affect Article 33 of Regulation (EU) 2018/1725 and Article 32 of Regulation (EU) 2016/679.

Amendment 100

Proposal for a regulation

Article 9 a (new)

Text proposed by the Commission	Amendment
	Article 9a
	Personal data protection audits
	1. The independent supervisory authorities referred to in Article 41 of Directive 2016/680 shall ensure that an audit of processing operations of API data constituting personal data performed by the PIUs for the purposes of this Regulation is carried out, in accordance with relevant international auditing standards, at least once every four years.
	2. The European Data Protection Supervisor shall carry out an audit of processing operations of API data constituting personal data performed by eu-LISA for the purposes of this Regulation, in accordance with relevant international auditing standards at least once every year. A report of that audit shall be sent to the European Parliament, to the Council, to the Commission, to the Member States and to eu-LISA. eu-LISA shall be given an opportunity to make comments before the reports are adopted.
	3. In relation to the processing operations referred to in paragraph 2, upon request, eu-LISA shall supply information requested by the European Data Protection Supervisor, shall grant the European Data Protection Supervisor access to all the documents it requests and to the logs referred to in Article 6, and shall allow the European Data Protection Supervisor access to all eu-LISA’s premises at any time.

Amendment 101

Proposal for a regulation

Article 10 – paragraph 1 – subparagraph 2

Text proposed by the Commission	Amendment
Member States shall ensure that the connection to that router and integration with it enables their PIUs to receive and further process the API data, as well as to exchange any communications relating thereto, in a lawful, secure, effective and swift manner.	Member States shall ensure that the connection to the router and integration with it enables their PIUs to receive and further process the API data, as well as to exchange any communications relating thereto, in a lawful, secure, effective and swift manner

Amendment 102

Proposal for a regulation

Article 10 – paragraph 2

Text proposed by the Commission	Amendment
2. The Commission is empowered to adopt delegated acts in accordance with Article 19 to supplement this Regulation by laying down the necessary detailed rules on the connections to and integration with the router referred to in paragraph 1.	2. The Commission is empowered to adopt delegated acts in accordance with Article 19 to supplement this Regulation by laying down the necessary detailed rules on the connections to and integration with the router referred to in paragraph 1, including on requirements for data security.

Amendment 103

Proposal for a regulation

Article 11 – paragraph 2

Text proposed by the Commission	Amendment
2. The Commission is empowered to adopt delegated acts in accordance with Article 19 to supplement this Regulation by laying down the necessary detailed rules on the connections to and integration with the router referred to in paragraph 1.	2. The Commission is empowered to adopt delegated acts in accordance with Article 19 to supplement this Regulation by laying down the necessary detailed rules on the connections to and integration with the router referred to in paragraph 1, including on data security requirements.

Amendment 104

Proposal for a regulation

Article 11 a (new)

Text proposed by the Commission	Amendment
	Article 11a
	eu-LISA’s tasks relating to the design and development of the router
	1. eu-LISA shall be responsible for the design of the physical architecture of the router, including defining the technical specifications.
	2. eu-LISA shall be responsible for the development of the router, including for any technical adaptations necessary for the operation of the router. The development of the router shall consist of the elaboration and implementation of the technical specifications, testing and overall project management and the coordination of the development phase.
	3. eu-LISA shall ensure that the router is designed and developed in such a manner that the router provides the functionalities specified in this Regulation, and that the router starts operations as soon as possible after the adoption by the Commission of the delegated acts provided for in 4(5) and (9), Article 5(3), Article 10(2), Article 11(2) and after the carrying out of a data protection impact assessment in accordance with Article 35 of Regulation (EU) 2016/679.
	4. Where eu-LISA considers that the development phase has been completed, it shall, without undue delay, conduct a comprehensive test of the router, in cooperation with the PIUs and other relevant Member States’ authorities and air carriers and inform the Commission of the outcome of that test.

Amendment 105

Proposal for a regulation

Article 11 b (new)

Text proposed by the Commission	Amendment
	Article 11b
	eu-LISA’s tasks relating to the hosting and technical management of the router
	1. eu-LISA shall host the router in its technical sites.
	2. eu-LISA shall be responsible for the technical management of the router, including its maintenance and technical developments, in such a manner as to ensure that the API data are securely, effectively and swiftly transmitted through the router, in compliance with this Regulation.
	The technical management of the router shall consist of carrying out all the tasks and enacting all technical solutions necessary for the proper functioning of the router in accordance with this Regulation, in an uninterrupted manner, 24 hours a day, 7 days a week. It shall include the maintenance work and technical developments necessary to ensure that the router functions at a satisfactory level of technical quality, in particular as regards availability, accuracy and reliability of the transmission of API data, in accordance with the technical specifications and, as much as possible, in line with the operational needs of the PIUs and air carriers.
	3. eu-LISA shall not have access to any of the API data that is transmitted through the router. However, that prohibition shall not preclude eu-LISA from having such access insofar as strictly necessary for the maintenance of the router.
	4. Without prejudice to paragraph 3 of this Article and to Article 17 of Council Regulation (EEC, Euratom, ECSC) No 259/681a, eu-LISA shall apply appropriate rules of professional secrecy or other equivalent duties of confidentiality to its staff required to work with API data transmitted through the router. This obligation shall also apply after such staff leave office or employment or after the termination of their activities.
	__________________
	1a Regulation (EEC, Euratom, ECSC) No 259/68 of the Council of 29 February 1968 laying down the Staff Regulations of Officials and the Conditions of Employment of Other Servants of the European Communities and instituting special measures temporarily applicable to officials of the Commission (OJ L 56, 4.3.1968, p. 1).

Amendment 106

Proposal for a regulation

Article 11 c (new)

Text proposed by the Commission	Amendment
	Article11c
	eu-LISA’s support tasks relating to the router
	1. eu-LISA shall, upon their request, provide training to PIUs and other relevant Member States’ authorities and air carriers on the technical use of the router and on the connection and integration to the router.
	2. eu-LISA shall provide support to the PIUs regarding the reception of API data through the router pursuant to this Regulation, in particular as regards the application of Articles 5 and 10 of this Regulation.

Amendment 107

Proposal for a regulation

Article 12 – title

Text proposed by the Commission	Amendment
Member States’ costs	Costs for eu-Lisa and of Member States

Amendment 108

Proposal for a regulation

Article 12 – paragraph -1 (new)

Text proposed by the Commission	Amendment
	-1. Costs incurred by eu-LISA in relation to the design, development, hosting and technical management of the router under this Regulation shall be borne by the general budget of the Union. In view of the Union interests at stake, in relation to its responsibilities for the design, development, hosting and technical management and maintenance of the router, eu-LISA shall be provided with the necessary resources under the Union budget in accordance with the applicable legislation.

Amendment 109

Proposal for a regulation

Article 12 – paragraph 1 – subparagraph 1

Text proposed by the Commission	Amendment
Costs incurred by the Member States in relation to their connections to and integration with the router referred to in Article 10 shall be borne by the general budget of the Union.	Costs incurred by eu-LISA and the Member States in relation to their connections to and integration with the router referred to in Article 10 shall be borne by the general budget of the Union.

Amendment 110

Proposal for a regulation

Article 12 – paragraph 1 a (new)

Text proposed by the Commission	Amendment
	1a. Costs incurred by the European Data Protection Supervisor in relation to the tasks entrusted to it under this Regulation shall be borne by the general budget of the Union.

Amendment 111

Proposal for a regulation

Article 12 – paragraph 1 b (new)

Text proposed by the Commission	Amendment
	1b. Costs incurred by independent national supervisory authorities in relation to the tasks entrusted to them under this Regulation shall be borne by the Member States.

Amendment 112

Proposal for a regulation

Article 12 – paragraph 2

Text proposed by the Commission	Amendment
2. Member States shall also bear the costs arising from the administration, use and maintenance of their connections to and integration with the router.	2. The Member States shall also bear the costs arising from the administration, use and maintenance of their connections to and integration with the router.

Amendment 113

Proposal for a regulation

Article 13

Text proposed by the Commission	Amendment
[...]	deleted

Amendment 114

Proposal for a regulation

Article 14 a (new)

Text proposed by the Commission	Amendment
	Article 14a
	Start of operations of the router
	The Commission shall determine, without undue delay, the date from which the router starts operations by means of an implementing act once eu-LISA has informed the Commission of the successful completion of the comprehensive test of the router referred to in Article 11a (4). That implementing act shall be adopted in accordance with the examination procedure referred to in Article 18a (2).
	The Commission shall set the date referred to in the first subparagraph to be no later than 30 days from the date of the adoption of that implementing act.

Amendment 115

Proposal for a regulation

Article 14 b (new)

Text proposed by the Commission	Amendment
	Article 14b
	Voluntary use of the router in application of Directive 2004/82/EC
	1. Air carriers shall be entitled to use the router to transmit the information referred to in Article 3(1) of Directive 2004/82/EC to one or more of the responsible PIUs referred to therein, in accordance with that Directive, provided that the responsible PIU concerned has agreed with such use, from an appropriate date set by that PIU. That PIU shall only agree after having established that, in particular as regards both its own connection to the router and that of the air carrier concerned, the information can be transmitted in a lawful, secure, effective and swift manner.
	2. Where an air carrier starts using the router in accordance with paragraph 1, it shall continue using the router to transmit such information to the responsible PIU concerned until the date of application of this Regulation referred to in Article 21, second subparagraph. However, that use shall be discontinued, from an appropriate date set by that PIU, where that PIU considers that there are objective reasons that require such discontinuation and has informed the air carrier accordingly.
	3. The responsible PIU concerned shall:
	(a) consult eu-LISA before agreeing with the voluntary use of the router in accordance with paragraph 1;
	(b) except in situations of duly justified urgency, afford the air carrier concerned an opportunity to comment on its intention to discontinue such use in accordance with paragraph 2 and, where relevant, also consult eu-LISA thereon;
	(c) immediately inform eu-LISA and the Commission of any such use to which it agreed and any discontinuation of such use, providing all necessary information, including the date of the start of the use, the date of the discontinuation and the reasons for the discontinuation, as applicable.

Amendment 116

Proposal for a regulation

Article 14 c (new)

Text proposed by the Commission	Amendment
	Article 14c
	Use of the router for PNR data
	The provisions of Chapters 3 and 4 shall apply mutatis mutandis to the mandatory transfer and transmission of PNR data through the router.

Amendment 117

Proposal for a regulation

Article 16 – paragraphs 1 and 2

Text proposed by the Commission	Amendment
Member States shall lay down the rules on penalties applicable to infringements of this Regulation and shall take all measures necessary to ensure they are implemented. The penalties provided for shall be effective, proportionate and dissuasive penalties.	1. Member States shall lay down the rules on penalties applicable to infringements of this Regulation and shall take all measures necessary to ensure they are implemented. The penalties provided for shall be effective, proportionate and dissuasive penalties.
Member States shall, by the date of application of this Regulation referred to in Article 21, second subparagraph, notify the Commission of those rules and of those measures and shall notify it without delay of any subsequent amendment affecting them.	Member States shall, by the date of application of this Regulation referred to in Article 21, second subparagraph, notify the Commission of those rules and of those measures and shall notify it without delay of any subsequent amendment affecting them.

Amendment 118

Proposal for a regulation

Article 16 – paragraph 1 a (new)

Text proposed by the Commission	Amendment
	1a. Member States shall ensure that when deciding whether to impose a penalty and when determining the type and level of penalty, the national supervisory authorities take into account relevant circumstances, which may include:
	(a) the nature, gravity and duration of the infringement;
	(b) the degree of the air carrier's fault;
	(c) previous infringements by the air carrier;
	(d) the overall level of cooperation of the air carrier with the competent authorities;
	(e) the size of the air carrier, such as the annual number of passengers carried;
	(f) whether previous penalties have already been applied by other national API supervisory authorities to the same carrier for the same infringement.

Amendment 119

Proposal for a regulation

Article 16 – paragraph 1 b (new)

Text proposed by the Commission	Amendment
	1b. Member States shall ensure that a systematic or persistent failure to comply with obligations set out in this Regulation is subject to financial penalties of up to 2% of an Air Carrier's global turnover of the preceding business year.

Amendment 120

Proposal for a regulation

Article 16 a (new)

Text proposed by the Commission	Amendment
	Article16a
	Statistics
	1. To support the implementation and supervision of this Regulation and based on the statistical information referred to in paragraph 5 of this Article, eu-LISA shall publish every quarter statistics on the functioning of the router, and on compliance by air carriers with the obligations set out in this Regulation. Those statistics shall not allow for the identification of individuals.
	The statistics shall show in particular:
	(a) the number of passengers on which API and PNR data is transmitted,
	(b) the number of flights for which API and PNR data is transmitted,
	(c) the number of flights on which API and PNR data is not transmitted,
	(d) the number of API and PNR messages transmitted on time to PIUs,
	(e) the number of passengers who boarded the aircraft with inaccurate, incomplete or no longer up-to-date API data, with a non-recognised travel document.
	2. For the purposes set out in paragraph 1, the router shall automatically transmit the data listed in paragraph 5 to the central repository for reporting and statistics established in Article 39 of Regulation (EU) 2019/818.
	3. In order to support the implementation and supervision of this Regulation, at the end of each year, eu-LISA shall compile statistical data in an annual report for that year. It shall publish that annual report and transmit it to the European Parliament, the Council, the Commission, the European Data Protection Supervisor, the European Border and Coast Guard Agency and the national supervisory authorities referred to in Article 15.
	4. At the request of the Commission, eu-LISA shall provide it with statistics on specific aspects related to the implementation of this Regulation as well as the statistics pursuant to paragraph 3.
	5. The central repository for reporting and statistics shall provide eu-LISA with the statistical information necessary for the reporting referred to in Article 20 and for generating statistics in accordance with the present Article, without however such statistics on API allowing for the identification of the passengers concerned :
	(a) the date and initial point of embarkation, and the date and airport of entry into the territory of a Member State arrival;
	(b) the type of the travel document and the three letter code of the issuing country and the date of expiry of the travel document;
	(c) the number of passengers checked-in on the same flight;
	(d) whether the flight is a scheduled or a non-scheduled flight;
	(e) whether the personal data of the passenger is accurate, complete and up-to-date.
	6. For the purposes of the reporting referred to in Article 20 and for generating statistics in accordance with the present Article, eu-LISA shall store the data referred to in paragraph 5 of this Article in the central repository for reporting and statistics established by Article 39 of Regulation (EU) 2019/817. It shall store that data for a period of three years in accordance with paragraph 2, without the data allowing for the identification of the passengers concerned.
	The central repository for reporting and statistics shall provide duly authorised staff of the PIUs and other relevant authorities of the Member States with customisable reports and statistics on API as referred to in paragraph 5 for the implementation and supervision of this Regulation.
	7. The use of the data referred to in paragraph 5 of this Article for automated or non-automated risk analysis, profiling or predictive risk assessment shall be prohibited.
	8. The procedures put in place by eu-LISA to monitor the development and the functioning of the router referred to in Article 39(1) of Regulation (EU) 2019/818 shall include the possibility to produce regular statistics to ensure that monitoring.

Amendment 121

Proposal for a regulation

Article 17 – paragraph 1

Text proposed by the Commission	Amendment
The Commission shall, in close cooperation with the PIUs, other relevant Member States’ authorities, the air carriers and relevant Union agencies, prepare and make publicly available a practical handbook, containing guidelines, recommendations and best practices for the implementation of this Regulation.	The Commission shall, in close cooperation with the PIUs, other relevant Member States’ authorities, the air carriers and relevant Union agencies, in particular the European Data Protection Supervisor and the Fundamental Rights Agency, prepare and make publicly available a practical handbook, containing guidelines, recommendations and best practices for the implementation of this Regulation, including on fundamental rights compliance as well as on penalties in accordance with Article 16.

Amendment 122

Proposal for a regulation

Article 17 a (new)

Text proposed by the Commission	Amendment
	Article 17a
	API Expert Group
	1. An API Expert Group shall be established with effect from ... [one month from the date of entry into force of this Regulation] in accordance with the horizontal rules on the creation and operation of Commission expert groups. It shall facilitate cooperation and the exchange of information on obligations stemming from and issues relating to this Regulation among Member States, EU institutions and stakeholders.
	2. The API Expert Group shall be composed of representatives of the European Commission, Member States’ relevant authorities, the European Parliament and eu-LISA. Where relevant for the performance of its tasks, the API Expert Group may invite relevant stakeholders, in particular representatives of air carriers, the EDPS and the independent national supervisory authorities, to participate in its work. The Commission’s representative shall chair the API Expert Group.

Amendment 123

Proposal for a regulation

Article 18 – paragraph 1

Regulation (EU) 2019/818

Article 39 – paragraph 2

Text proposed by the Commission	Amendment
2. eu-LISA shall establish, implement and host in its technical sites the CRRS containing the data and statistics referred to in Article 74 of Regulation (EU) 2018/1862 and Article 32 of Regulation (EU) 2019/816 logically separated by EU information system. eu-LISA shall also collect the data and statistics from the router referred to in Article 13(1) of Regulation (EU) …/… * [this Regulation ]. Access to the CRRS shall be granted by means of controlled, secured access and specific user profiles, solely for the purpose of reporting and statistics, to the authorities referred to in Article 74 of Regulation (EU) 2018/1862, Article 32 of Regulation (EU) 2019/816 and Article 13(1) of Regulation (EU) …/… * [this Regulation ].	“2. eu-LISA shall establish, implement and host in its technical sites the CRRS containing the data and statistics referred to in Article 74 of Regulation (EU) 2018/1862 and Article 32 of Regulation (EU) 2019/816 logically separated by EU information system. eu-LISA shall also collect the data and statistics from the router referred to in Article 13(1) of Regulation (EU) …/… * [this Regulation ]. Access to the CRRS shall be granted by means of controlled, secured access and specific user profiles, solely for the purpose of reporting and statistics, to the authorities referred to in Article 74 of Regulation (EU) 2018/1862, Article 32 of Regulation (EU) 2019/816 and Article 13(1) of Regulation (EU) …/… * [this Regulation ]. Especially the use of the CRRS for risk analysis, profiling or predictive risk assessment shall be prohibited.”

Amendment 124

Proposal for a regulation

Article 18 a (new)

Text proposed by the Commission	Amendment
	Article 18a
	Committee Procedure
	1. The Commission shall be assisted by a committee. That committee shall be a committee within the meaning of Regulation (EU) No 182/2011.
	2. Where reference is made to this paragraph, Article 5 of Regulation (EU) No 182/2011 shall apply. Where the committee delivers no opinion, the Commission shall not adopt the draft implementing act and Article 5(4), the third subparagraph, of Regulation (EU) No 182/2011 shall apply.

Amendment 125

Proposal for a regulation

Article 19 – paragraph 2

Text proposed by the Commission	Amendment
2. The power to adopt delegated acts referred to in Article 4(5) and (9), Article 5(3), Article 10(2) and Article 11(2) shall be conferred on the Commission for a period of five years from [date of adoption of the Regulation]. The Commission shall draw up a report in respect of the delegation of power not later than nine months before the end of the five-year period. The delegation of power shall be tacitly extended for periods of an identical duration, unless the European Parliament or the Council opposes such extension not later than three months before the end of each period.	2. The power to adopt delegated acts referred to in Article 4(5), Article 4(7b), Article 5(3), Article 5(4) (Left 238), Article 10(2) and Article 11(2) shall be conferred on the Commission for a period of five years from [date of adoption of the Regulation]. The Commission shall draw up a report in respect of the delegation of power not later than nine months before the end of the five-year period. The delegation of power shall be tacitly extended for periods of an identical duration, unless the European Parliament or the Council opposes such extension not later than three months before the end of each period.

Amendment 126

Proposal for a regulation

Article 19 – paragraph 3

Text proposed by the Commission	Amendment
3. The delegation of power referred to in Article 4(5) and (9), Article 5(3), Article 10(2) and Article 11(2) may be revoked at any time by the European Parliament or by the Council. A decision to revoke shall put an end to the delegation of the power specified in that decision. It shall take effect the day following the publication of the decision in the Official Journal of the European Union or at a later date specified therein. It shall not affect the validity of any delegated acts already in force.	3. The delegation of power referred to in Article 4(5), Article 4(7b), Article 5(3) and (4) (Left 239), Article 10(2) and Article 11(2) may be revoked at any time by the European Parliament or by the Council. A decision to revoke shall put an end to the delegation of the power specified in that decision. It shall take effect the day following the publication of the decision in the Official Journal of the European Union or at a later date specified therein. It shall not affect the validity of any delegated acts already in force.

Amendment 127

Proposal for a regulation

Article 20 – paragraph -1 (new)

Text proposed by the Commission	Amendment
	-1. eu-LISA shall ensure that procedures are in place to monitor the development of the router in light of objectives relating to planning and costs, and to monitor the functioning of the router in light of objectives relating to the technical output, cost-effectiveness, security and quality of service.

Amendment 128

Proposal for a regulation

Article 20 – paragraph -1 a (new)

Text proposed by the Commission	Amendment
	-1a. By ... [one year from the date of entry into force of this Regulation] and every year thereafter during the development phase of the router, eu-LISA shall produce a report, and submit it to the European Parliament and to the Council on the state of play of the development of the router. That report shall contain detailed information about the costs incurred and about any risks which may impact the overall costs to be borne by the general budget of the Union in accordance with Article 12. From the date at which the router starts operations and every year thereafter, the Commission shall assess whether the budget under the MFF budget line 4.11.10.02 (“eu-LISA”) covers the needs necessary for good design, development, hosting and technical management of the router and, if appropriate, immediately propose amendment to the budget appropriations.

Amendment 129

Proposal for a regulation

Article 20 – paragraph -1 b (new)

Text proposed by the Commission	Amendment
	-1b. Once the router starts operations, eu-LISA shall produce a report and submit it to the European Parliament and to the Council explaining in detail how the objectives, in particular relating to planning and costs, were achieved as well as justifying any divergences.

Amendment 130

Proposal for a regulation

Article 20 – paragraph 1 – introductory part

Text proposed by the Commission	Amendment
1. By [four years after the date of entry into force of this Regulation], and every four years thereafter, the Commission shall produce a report containing an overall evaluation of this Regulation, including an assessment of:	1. By [four years after the date of entry into force of this Regulation], and every four years thereafter, the Commission shall produce a report containing an overall evaluation of this Regulation, demonstrating the necessity and added value of the collection of API data, including an assessment of:

Amendment 131

Proposal for a regulation

Article 20 – paragraph 1 – point c a (new)

Text proposed by the Commission	Amendment
	(ca) the impact of this Regulation on the travel experience of legitimate passengers;

Amendment 132

Proposal for a regulation

Article 20 – paragraph 1 – point c b (new)

Text proposed by the Commission	Amendment
	(cb) the impact of this Regulation on the competitiveness of the aviation sector and the burden incurred by businesses. The Commission’s report shall also address this Regulation’s interaction with other relevant EU legislative acts, notably Regulation (EU) 2017/2226, Regulation (EU) 2018/1240 and Regulation (EC) 767/2008, with a view to assessing the overall impact of related reporting obligations on air carriers, identify provisions that may be updated and simplified, where appropriate, to mitigate the burden on air carriers, and consider actions and measures that could be taken to reduce the total cost pressure on air carriers.

Amendment 133

Proposal for a regulation

Article 20 – paragraph 1 a (new)

Text proposed by the Commission	Amendment
	1a. The evaluation referred to in paragraph 1 shall also include an assessment of:
	(a) the necessity, proportionality and effectiveness of including the mandatory collection and transfer of API data relating to intra-EU flights within the scope of this Regulation;
	(b) the feasibility of including non-commercial business aviation within the Scope of this Regulation.

Amendment 134

Proposal for a regulation

Article 20 – paragraph 1 b (new)

Text proposed by the Commission	Amendment
	1b. The Commission shall submit the evaluation report to the European Parliament, the Council, the European Data Protection Supervisor and the European Agency for Fundamental Rights. If appropriate, in light of the evaluation conducted, the Commission shall make a legislative proposal to the European Parliament and to the Council with a view to amending this Regulation.

Amendment 135

Proposal for a regulation

Article 20 – paragraph 2

Text proposed by the Commission	Amendment
2. The Member States and air carriers shall, upon request, provide the Commission with the information necessary to draft the report referred to in paragraph 1. However, Member States may refrain from providing such information if, and to the extent, necessary not to disclose confidential working methods or jeopardise ongoing investigations of their PIUs or other law enforcement authorities. The Commission shall ensure that any confidential information provided is appropriately protected.	2. The Member States and air carriers shall, upon request, provide the eu-LISA and the Commission with the information necessary to draft the report referred to in paragraph 1. In particular, Member States shall provide quantitative and qualitative information on the necessity and added value of the collection of API data from an operational perspective. However, Member States may refrain from providing such information if, and to the extent, necessary not to disclose confidential working methods or jeopardise ongoing investigations of their PIUs or other law enforcement authorities. The Commission shall ensure that any confidential information provided is appropriately protected.

Amendment 136

Proposal for a regulation

Article 21 – paragraph 2

Text proposed by the Commission	Amendment
It shall apply from two years from the date at which the router starts operations, specified by the Commission in accordance with Article 27 of Regulation (EU) [API border management].	It shall apply from two years from the date at which the router starts operations, specified by the Commission in accordance with Article 14a.

Amendment 137

Proposal for a regulation

Article 21 – paragraph 3

Text proposed by the Commission	Amendment
However, Article 4(5) and (9), Article 5(3), Article 10(2), Article 11(2) and Article 19 shall apply from [Date of entry into force of this Regulation].	However:
	(a) Article 4(5), Article 5(3) and (4), Article 10(2), Article 11(2), Article 18a and Article 19 shall apply from [Date of entry into force of this Regulation].
	(b) Article 4b, Article 6(-1), (2) and (3), Article 7, Article 7a, Article 8, Article 11b, Article 11c, Article 14 and Article 14 shall apply from the date at which the router starts operations, specified by the Commission in accordance with Article 14a.

EXPLANATORY STATEMENT

1. Context of the proposal

The Council Directive 2004/82/EC of 29 April 2004 on the obligation of carriers to communicate passenger data (‘API Directive’) aims at improving border controls and combating illegal immigration. It requires Member States to establish an obligation for air carriers to transmit, at the request of the authorities responsible for carrying out checks on persons at external borders, information concerning the passengers they will carry. The API Directive establishes no obligation for Member States to request the transmission of data. The API Directive contains an open list of data categories that Member States may request. The API Directive is in principle intended as an instrument to enhance border security, but it allows the Member States to use the personal data collected for law enforcement purposes as well.

The Directive (EU) 2016/681 of the European Parliament and of the Council of 27 April 2016 on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime (‘PNR Directive’) aims to facilitate the prevention, detection, investigation and prosecution of terrorist offences and serious crime and thus enhance the internal security of the Union. The PNR Directive establishes an obligation for Member States to introduce provisions laying down obligations on air carriers operating extra-EU flights to transfer PNR data they collect. The PNR Directive allows Member States to apply the Directive to intra-EU flights. The PNR Directive includes API data in the list of PNR data.

On 21 June 2022, the Court of Justice of the European Union (CJEU) in case C-817/19 confirmed the validity of the PNR Directive. The CJEU also provided clarifications on certain provisions, in particular a number of conditions regarding the selection criteria for flights that Member States must comply with if they apply the PNR Directive to intra-EU flights.

The context of the API and PNR Directives is that in 2019, the EU recorded about 1 billion air passengers, half of which crossed the EU’s external borders. The Schengen Borders Code requires effective and systematic checks of people crossing the EU’s external borders. Advance passenger information is one of the tools for border authorities to anticipate their workload and perform adequate border controls.

The collection and transfer of API is in itself nothing new, nor is it limited to the EU. It is a commitment of all EU Member States since they are all parties to the Chicago Convention of the International Civil Aviation Organisation (ICAO). Furthermore, it is a requirement from many countries of destination, such as the United States, Japan, France, United Kingdom, China, India, Australia, Canada, Mexico and Thailand. API collection is an established practice under the abovementioned API Directive.

2. Content of the proposal

The API and PNR Directives leaves a lot of room for variable implementation. As a result, the API collection practice varies widely among EU Member States. Airlines have to deal with each Member State individually and are confronted with varying requests for data categories, modes of data transfer and safeguards including data security and privacy.

In order to remedy this situation, the Commission has proposed twin Regulations:

 A Regulation on the collection and transfer of advance passenger information (API) for enhancing and facilitating external border controls, amending Regulation (EU) 2019/817 and Regulation (EU) 2018/1726 and repealing Council Directive 2004/82/EC (‘API borders’);

 A Regulation on the collection and transfer of advance passenger information for the prevention, detection, investigation and prosecution of terrorist offences and serious crime, and amending Regulation (EU) 2019/818 (‘API law enforcement’).

In the Commission’s design, the API borders proposal contains the main elements, including with regards to the technical solution (the router). The API law enforcement proposal has its own legal base and contains the elements relevant to the collection, transfer and processing of API data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime by Member States’ competent authorities.

Taken together, the proposals include the following main changes compared to the API Directive currently in force:

 A closed and exhaustive list of API data elements. Under the current API Directive, the list of data elements is open.

 Automated collection of API data, which should give more reliable data. Under the current API Directive, the collection can be done manually.

 Mandatory API data collection for the purposes of enhancing and facilitating the efficiency of border checks at external borders and of combating illegal immigration on all flights entering the Union. Under the current API Directive, Member States may request this data but are not obliged to do so.

 Mandatory API data collection for law enforcement purposes for all flights to and from the EU, as well as on flights within the EU. Under the current API Directive, Member States may use the personal data for law enforcement purposes, but the mandatory nature of the collection is new.

 Streamlined transmission of API data by air carriers to a new router, which will be developed and managed by the EU Agency for the Operational Management of Large-scale IT Systems (eu-LISA).

 An automatic filter in the router executing the automatic transmission from the router of API data of extra-EU flights and selected intra-EU flights to Member State Passenger Information Units (‘PIUs’) and the automatic deletion of all other API data.

In its Opinion 6/2023 on the Proposals for Regulations on the collection and transfer of advance passenger information (API), the European Data Protection Supervisor (EDPS) assessed the proposal to collect API data from all flights and to have this data automatically filtered by the proposed router on the basis of pre-selected flights positively from a data protection perspective.

3. Rapporteur’s assessment of the proposal

The rapporteur responsible for API law enforcement welcomes the Commission proposal to replace the obsolete API Directive with two new Regulations. The rapporteur agrees with the Commission that it is necessary to remedy the current situation of variable interpretation and application of the API Directive as well as of API elements of the PNR Directive. The rapporteur is of the opinion that API data and PNR data complement each other and that together they can provide more reliable information. This will mean more limited and targeted interventions by law enforcement authorities and less intrusion of travellers’ privacy. By way of example, the rapporteur would like to point out that criminals often book flights (generating PNR data) but without cancellation do not board these flights. The unavailability of API data based on passengers that boarded the flight in such situations leads to unnecessary interventions by law enforcement authorities using limited capacities and sometimes disturbing innocent travellers. Another example is the issue of date of birth, which is often not available to air carriers at the time of booking, but which only becomes available at the time of check in. Date of birth is an extremely important data element, which is crucial in avoiding false hits based on name only.

The rapporteur also supports the collection of API data by air carriers using automated means. Not only does this avoid unnecessary problems due to innocent typos and spelling mistakes. It also stops criminals from playing with such typos, which they currently do enthusiastically to avoid detection. Nevertheless, the rapporteur wants to ensure fair treatment for all passengers in all situations. The rapporteur insists that manual collection of API data remain possible for documents not containing a ‘Machine-Readable Zone’ (MRZ) and for situation of technical impossibility to automatically collect the data. Furthermore, the rapporteur is of the opinion that the Commission should make sure that the obligation to use automated means for the collection of API data does not lead to disproportionate obstacles, such as additional airport check-in fees, for passengers unable to use other means for automated check-in.

The rapporteur strongly supports the inclusion of intra-EU flights in the scope of API law enforcement. With the CJEU, the rapporteur believes that this is proportionate, taking into account the security situation and travel patterns of criminals and terrorists. However, the rapporteur also believes that the selection of intra-EU flights must be strictly limited as indeed demanded by the CJEU. Therefore, the rapporteur introduces some parameters for Member States based on the Court ruling. Furthermore, the rapporteur instructs the Commission to facilitate further steps to increase cohesion among the Member States regarding their selection of intra-EU flights.

The rapporteur believes that the router solution, once operational, could be useful for the transfer of PNR data as well as a secure and reliable and, for the airlines cost-effective, solution. Such a step would be in line with the requirement that Member States take one decision regarding the selection of intra-EU flights for the application of both the PNR Directive and the proposed API Regulations.

The rapporteur insists on stringent data security requirements, which should be embedded in the API borders Regulation.

The rapporteur believes that Member States can use the Internal Security Fund to claim compensation for costs made related to the proposed new technical solution (the router).

The rapporteur believes that delegation of powers to the Commission is appropriate in a number of cases described in the Regulation. The rapporteur insists that this is done via delegated acts, because it gives airline industry representatives more of a voice in technical decisions such regarding the choice of data formats and it places Parliament on an equal footing with the Council.

The rapporteur insists on including in the regular Commission evaluation the impact of this Regulation, also in combination with other legislation applying to passenger air travel, on passengers and on air carriers.

ANNEX: ENTITIES OR PERSONS FROM WHOM THE RAPPORTEUR HAS RECEIVED INPUT

Pursuant to Article 8 of Annex I to the Rules of Procedure, the rapporteur declares that she has received input from the following entities or persons in the preparation of the report, until the adoption thereof in committee:

Entity and/or person
IATA
A4E

The list above is drawn up under the exclusive responsibility of the rapporteur.

19.7.2023

OPINION OF THE COMMITTEE ON TRANSPORT AND TOURISM

for the Committee on Civil Liberties, Justice and Home Affairs

(COM(2022)0731 – C90427/2022 – 2022/0425(COD))

Rapporteur for opinion: JanChristoph Oetjen

SHORT JUSTIFICATION

This Regulation sets new uniform rules on the collection and transfer of Advance Passenger Information (API), which includes a closed list of API data, the means to collect them and a single point for the transfer of these data, for the prevention of, detention, investigation and prosecution of terrorist offences and serious crime.

Serious and organised crime has continued to increase over the last decades and airports are often the transit points for drug trafficking, smuggling of persons or other illicit goods. Therefore, good information on travellers is a key tool for law enforcement authorities in the prevention of, detention, investigation and prosecution of terrorist offences and serious crime.

Advance Passenger Information (API) and Passenger Name Records (PNR) are two types of air passenger data, that, when combined, are particularly useful for identifying high-risk travellers and their travel patterns.

Under the current PNR Directive, air carriers are not obliged and do not have any commercial interest in collecting the full set of API data. Therefore, for the purposes of fighting terrorism and serious crime, this Regulation sets complementary and harmonised rules to collect and transfer API data and extends its application to the same flights, covered by the PNR directive, notably extra-EU flights and selected intra-EU flights.

Overall, the proposal for a regulation introduces:

1. provisions to collect API data by air carriers and streamline the transfer and transmission of API data by air carriers to national authorities through a single router, which will be managed by the EU Agency eu-LISA. It also sets the rules for the transmission of API data to the competent authorities, notably the Passenger Information Units (‘PIUs’), by the router.

2. a requirement to provide better quality API data, as air carriers will have “to collect API data by automated means only" putting an end to the laborious and, more importantly, error-prone experience of passengers who must manually type in travel document information between the purchase of tickets and check-in.

3. provisions on the protection of personal data, as well as security and self-monitoring by air carriers and PIUs.

4. requirements on supervision and possible penalties in case of non-compliance by air carriers.

The regulation also includes budgetary provisions that will finance the establishment and functioning of the router and the costs incurred by the Member States (with some exceptions) in relation to their connections to, and integration with, the router, under the Union budget.

Rapporteur’s position

The Rapporteur welcomes this streamlined and simpler method for air carriers to provide API data, especially through a centralised system. He also shares the view that digitalisation and automation can be an useful tool to mitigate errors and to allow for a better travel experience of legitimate travellers.

The Rapporteur also shares the need to ensure better quality API data for law enforcement, in full respect of personal data protection. However, this Regulation should avoid going to the detriment of the travel experience of the legitimate traveller. It should also allow authorities to estimate in advance the necessary control capacity at airports and should enable air carriers to process the information at the check-in in a more efficient and faster way. The Rapporteur believes that this legislation should facilitate people travelling, with reduced times at disembarkation. Therefore, the Rapporteur introduces a provision in Article 20, which imposes a requirement on the Commission to carry out an assessment on the impact of this Regulation on the travel experience of legitimate travellers.

The Rapporteur understands that in certain cases air carriers may need to keep logs for longer than for procedures for monitoring or ensuring the security and integrity of the API data or the lawfulness of the processing operations. However to avoid any missuse or abuse, the air carriers should inform and justify to the Commission the reason for keeping the logs longer.

The Rapporteur believes that the financial appropriation to the functioning of the router will determine its success, therefore the eu-LISA should be provided with the necessary resources. Moreover, eu-LISA should also provide training to air carriers and PIUs to facilitate the correct connection and integration to the router, and to effectively transfer and receive API data. To that effect, eu-LISA should develop the router to enable the air carriers’ systems to connect and transmit API data to the router in accordance with existing standard and technical requirements.

AMENDMENTS

The Committee on Transport and Tourism calls on the Committee on Civil Liberties, Justice and Home Affairs, as the committee responsible, to take the following into account:

Amendment 1

Proposal for a regulation

Recital 6 a (new)

Text proposed by the Commission	Amendment
	(6 a) This Regulation should be subject to regular evaluations to ensure the monitoring of its effective application. In particular, the collection of API data should not be to the detriment of the travel experience of legitimate travellers. Therefore, the Commission should include in its regular evaluation reports on the application of this Regulation an assessment of the impact of this Regulation on the travel experience of legitimate travellers.

Amendment 2

Proposal for a regulation

Recital 6 b (new)

Text proposed by the Commission	Amendment
	(6 b) Given that this Regulation requires additional adjustment and administrative costs by the air carriers, the overall regulatory burden for the aviation sector should be kept under close review. Against this backdrop, the report evaluating the functioning of this Regulation should assess the extent to which the objectives of the Regulation have been met and to which extent it has impacted the competitiveness of the sector. Therefore, the Commission’s report should also conduct a holistic assessment and refer to the interaction of this Regulation with other relevant EU legislative acts, notably Regulation (EU) 2017/2226, Regulation (EU) 2018/1240 and Regulation (EC) 767/2008. The report should assess the overall impact of related reporting obligations on air carriers, identifying provisions that may be updated and simplified, where appropriate, to mitigate the burden on air carriers, as well as actions and measures that have been or could be taken to reduce the total cost pressure on the aviation sector

Amendment 3

Proposal for a regulation

Recital 7

Text proposed by the Commission	Amendment
(7) In view of the complementary nature of this Regulation in relation to Directive (EU) 2016/681, the obligations of air carriers under this Regulation should apply in respect of all flights for which Member States are to require air carriers to transmit PNR data under Directive (EU) 2016/681, namely flights, including both scheduled and non-scheduled flights, both between Member States and third countries (extra-EU flights), and between several Member States (intra-EU flights) insofar as those flights have been selected in accordance with Directive (EU) 2016/681, irrespective of the place of establishment of the air carriers conducting those flights.	(7) In view of the complementary nature of this Regulation in relation to Directive (EU) 2016/681, the obligations of air carriers under this Regulation should apply in respect of all flights for which Member States are to require air carriers to transmit PNR data under Directive (EU) 2016/681, namely flights, including both scheduled and non-scheduled flights, both between Member States and third countries (extra-EU flights), irrespective of the place of establishment of the air carriers conducting those flights.

Amendment 4

Proposal for a regulation

Recital 10

Text proposed by the Commission	Amendment
(10) In particular, the items of information that jointly constitute the API data to be collected and subsequently transferred under this Regulation should be those listed clearly and exhaustively in Regulation (EU) API [border management], covering both information relating to each passenger and information on the flight of that traveller. Under this Regulation, such flight information should cover information on the border crossing point of entry into the territory of the Member State concerned only where applicable, that is, not when the API data relate to intra-EU flights.	(10) In particular, the items of information that jointly constitute the API data to be collected and subsequently transferred under this Regulation should be those listed clearly and exhaustively in Regulation (EU) API [border management], covering both information relating to each passenger and information on the flight of that traveller. Under this Regulation, such flight information should cover information on the border crossing point of entry into the territory of the Member State concerned.

Amendment 5

Proposal for a regulation

Recital 11

Text proposed by the Commission	Amendment
(11) In order to ensure a consistent approach on the collection and transfer of API data by air carriers as much as possible, the rules set out in this Regulation should be aligned with those set out in the Regulation (EU) [API border management] where appropriate. That concerns, in particular, the rules on data quality, the air carriers’ use of automated means for such collection, the precise manner in which they are to transfer the collected API data to the router and the deletion of the API data.	(11) In order to ensure a consistent approach on the collection and transfer of API data by air carriers as much as possible, the rules set out in this Regulation should be aligned with those set out in the Regulation (EU) [API border management] where appropriate. That concerns, in particular, the rules on data quality, the air carriers’ use of automated means for such collection, the precise manner in which they are to transfer the collected API data to the router and the deletion of the API data. In order to reduce the impact on air carriers, and with a view to create synergies with other reporting obligations on air carriers in Regulation (EU) 2017/2226, Regulation (EU) 2018/1240 and Regulation (EC) 767/2008 and avoid duplication, air carriers should transfer the API data at the moment of check-in of each traveller by way of interactive API in accordance with international standards, using the existing carrier gateway. Air carriers should receive an acknowledgement of receipt to the transfer of interactive API, in line with international standards.

Amendment 6

Proposal for a regulation

Recital 11 a (new)

Text proposed by the Commission	Amendment
	(11 a) The automatic data collection systems and other processes established under this Regulation should not negatively impact the employees in the aviation industry, who should benefit from upskilling and reskilling opportunities that would increase the efficiency and reliability of data collection and transfer as well as the working conditions in the sector.

Amendment 7

Proposal for a regulation

Recital 11 b (new)

Text proposed by the Commission	Amendment
	(11 b) In order to enhance data quality, the router should verify whether the API data transferred to it by the air carriers complies with the supported data formats. Where the router has verified that the data is not compliant with the supported data formats, the router should, immediately and in an automated manner, notify the air carrier concerned.

Amendment 8

Proposal for a regulation

Recital 12 a (new)

Text proposed by the Commission	Amendment
	(12 a) With a view to guaranteeing the fulfilment of the rights provided for under the Charter of Fundamental Rights and to ensuring accessible and inclusive travel options, especially for vulnerable groups and persons with disabilities, air carriers, supported by the Member States, shall ensure that an offline alternative for the check-in and for the provision of the necessary data by the passengers is possible at all times.

Amendment 9

Proposal for a regulation

Recital 14

Text proposed by the Commission	Amendment
(14) As regards intra-EU flights, in line with the case law of the Court of Justice of the European Union (CJEU), in order to avoid unduly interfering with the relevant fundamental rights protected under the Charter and to ensure compliance with the requirements of Union law on the free movement of persons and the abolition of internal border controls, a selective approach should be provided for. In view of the importance of ensuring that API data can be processed together with PNR data, that approach should be aligned with that of Directive (EU) 2016/681. For those reasons, API data on those flights should only be transmitted from the router to the relevant PIUs, where the Member States have selected the flights concerned in application of Article 2 of Directive (EU) 2016/681. As recalled by the CJEU, the selection entails Member States targeting the obligations in question only at, inter alia, certain routes, travel patterns or airports, subject to the regular review of that selection.	deleted

Amendment 10

Proposal for a regulation

Recital 15

Text proposed by the Commission	Amendment
(15) In order to enable the application of that selective approach under this Regulation in respect of intra-EU flights, the Member States should be required to draw up and submit to eu-LISA the lists of the flights they selected, so that eu-LISA can ensure that only for those flights API data is transmitted from the router to the relevant PIUs and that the API data on other intra-EU flights is immediately and permanently deleted.	deleted

Amendment 11

Proposal for a regulation

Recital 16

Text proposed by the Commission	Amendment
(16) In order not to endanger the effectiveness of the system that relies on the collection and transfer of API data set up by this Regulation, and of PNR data under the system set up by Directive (EU) 2016/681, for the purpose of preventing, detecting, investigating and prosecuting terrorist offences and serious crime, in particular by creating the risk of circumvention, information on which intra-EU flights the Member States selected should be treated in a confidential manner. For that reason, such information should not be shared with the air carriers and they should therefore be required to collect API data on all flights covered by this Regulation, including all intra-EU flights, and then transfer it to the router, where the necessary selection should be enacted. Moreover, by collecting API data on all intra-EU flights, passengers are not made aware on which selected intra-EU flights API data, and hence also PNR data, is transmitted to PIUs in accordance with Member States’ assessment. That approach also ensures that any changes relating to that selection can be implemented swiftly and effectively, without imposing any undue economic and operational burdens on the air carriers.	deleted

Amendment 12

Proposal for a regulation

Recital 19

Text proposed by the Commission	Amendment
(19) In view of the Union interests at stake, appropriate costs incurred by the Member States in relation to their connections to, and integration with, the router, as required under this Regulation, should be borne by the Union budget, in accordance with the applicable legislation and subject to certain exceptions. The costs covered by those exceptions should be borne by each Member State concerned itself.	(19) In view of the Union interests at stake, appropriate costs incurred by the Member States in relation to their connections to, and integration with, the router, as required under this Regulation, should be borne by the Union budget, in accordance with the applicable legislation and subject to certain exceptions. The costs covered by those exceptions should be borne by each Member State concerned itself. The Union budget should also cover the support, such as training, by eu-LISA to air carriers and PIUs to enable effective transfer and transmission of API data through the router.

Amendment 13

Proposal for a regulation

Recital 23 a (new)

Text proposed by the Commission	Amendment
	(23 a) When providing for the penalties applicable to air carriers under this Regulation, Member States shall take into account the technical, operational and economic feasibility of ensuring complete data accuracy. Additionally, when fines are imposed, their application and value shall be established taking into consideration the actions undertaken by the air carrier to mitigate the issue as well as its repeated failure to cooperate with national authorities.

Amendment 14

Proposal for a regulation

Recital 26 a (new)

Text proposed by the Commission	Amendment
	(26 a) With a view to ensuring increased data quality and accuracy, the setting up of travel document validation systems, able to automatically verify carrier-submitted passenger data, should be considered.

Amendment 15

Proposal for a regulation

Article 1 – paragraph 1 – point a

Text proposed by the Commission	Amendment
(a) the collection by air carriers of advance passenger information data (‘API data’) on extra EU flights and selected intra EU flights;	(a) the collection by air carriers of advance passenger information data (‘API data’) on extra EU flights.

Amendment 16

Proposal for a regulation

Article 1 – paragraph 1 – point c

Text proposed by the Commission	Amendment
(c) the transmission from the router to the Passenger Information Units (‘PIUs’) of the API data on extra-EU flights and selected intra-EU flights.	(c) the transmission from the router to the Passenger Information Units (‘PIUs’) of the API data on extra-EU flights.

Amendment 17

Proposal for a regulation

Article 2 – paragraph 1

Text proposed by the Commission	Amendment
This Regulation applies to air carriers conducting scheduled or non-scheduled extra-EU flights or intra-EU flights.	This Regulation applies to air carriers conducting scheduled or non-scheduled extra-EU flights

Amendment 18

Proposal for a regulation

Article 3 – paragraph 1 – point c

Text proposed by the Commission	Amendment
(c) ‘intra-EU flight’ means any flight as defined in Article 3, point (3), of Directive (EU) 2016/681;	deleted

Amendment 19

Proposal for a regulation

Article 3 – paragraph 1 – point h

Text proposed by the Commission	Amendment
(h) ‘traveller’ means any person as defined in Article 3, point (i), of Regulation (EU) [API border management];	(h) ‘traveller’ means any person as defined in Article 3, point (j), of Regulation (EU) [API border management];

Amendment 20

Proposal for a regulation

Article 3 – paragraph 1 – point n

Text proposed by the Commission	Amendment
(n) ‘the router’ means the router as defined in Article 3, point (k) of Regulation (EU) [API border management];	(n) ‘the router’ means the router as defined in Article 3, point (m) of Regulation (EU) [API border management];

Amendment 21

Proposal for a regulation

Article 4 – paragraph 3 – subparagraph 1

Text proposed by the Commission	Amendment
Air carriers shall collect the API data referred to Article 4(2), points (a) to (d), of Regulation (EU) [API border management] using automated means to collect the machine-readable data of the travel document of the traveller concerned. They shall do so in accordance with the detailed technical requirements and operational rules referred paragraph 5, where such rules have been adopted and are applicable.	Air carriers shall collect the API data referred to Article 4(2), points (a) to (d), of Regulation (EU) [API border management] using automated means to collect the machine-readable data of the travel document of the traveller concerned. They shall do so in accordance with the detailed technical requirements and operational rules referred to in paragraph 5, where such rules have been adopted and are applicable.

Amendment 22

Proposal for a regulation

Article 4 – paragraph 7

Text proposed by the Commission	Amendment
7. Air carriers shall transfer the API data both at the moment of check-in and immediately after flight closure, that is, once the travellers have boarded the aircraft in preparation for departure and it is no longer possible for travellers to board or to leave the aircraft.	7. Air carriers shall transfer the API data both at the moment of check-in and immediately after flight closure, that is, once the travellers have boarded the aircraft in preparation for departure and it is no longer possible for travellers to board or to leave the aircraft. At the moment of check-in, air carriers shall transfer the API data by way of interactive API in accordance with international standards. Air carriers shall receive an acknowledgement of receipt to the transfer of interactive API, as applicable, depending on the flight in scope.

Amendment 23

Proposal for a regulation

Article 4 – paragraph 7 a (new)

Text proposed by the Commission	Amendment
	7 a. The router shall verify whether the API data transferred to it in accordance with paragraph 6 complies with the detailed rules on the supported data formats. Where the router has verified that the data is not compliant with the detailed rules, the router shall, immediately and in an automated manner, notify the air carrier concerned.

Amendment 24

Proposal for a regulation

Article 4 – paragraph 9

Text proposed by the Commission	Amendment
9. The Commission is empowered to adopt delegated acts in accordance with Article 19 to supplement this Regulation by laying down the necessary detailed rules on the common protocols and supported data formats to be used for the transfers of API data to the router referred to in paragraph 6.	9. The Commission is empowered to adopt delegated acts in accordance with Article 19 to supplement this Regulation by laying down the necessary detailed rules on the common protocols and supported data formats to be used for the transfers of API data to the router referred to in paragraph 6 including the use of interactive API for the transfer of API data at the moment of check-in.

Amendment 25

Proposal for a regulation

Article 5 – paragraph 1 – subparagraph 1

Text proposed by the Commission	Amendment
The router shall, immediately and in an automated manner, transmit the API data, transferred to it by air carriers pursuant to Article 4, to the PIUs of the Member State on the territory of which the flight will land or from the territory of which the flight will depart, or to both in the case of intra-EU-flights. Where a flight has one or more stop-overs at the territory of other Member States than the one from which it departed, the router shall transmit the API data to the PIUs of all the Member States concerned.	The router shall, immediately and in an automated manner, transmit the API data, transferred to it by air carriers pursuant to Article 4, to the PIUs of the Member State on the territory of which the flight will land or from the territory of which the flight will depart. Where a flight has one or more stop-overs at the territory of other Member States than the one from which it departed, the router shall transmit the API data to the PIUs of all the Member States concerned.

Amendment 26

Proposal for a regulation

Article 5 – paragraph 1 – subparagraph 3

Text proposed by the Commission	Amendment
However, for intra-EU flights, the router shall only transmit the API data to that PIU in respect of the flights included in the list referred to in paragraph 2.	deleted

Amendment 27

Proposal for a regulation

Article 5 – paragraph 2

Text proposed by the Commission	Amendment
2. Member States that decide to apply Directive (EU) 2016/681 to intra-EU flights in accordance with Article 2 of that Directive shall each establish a list of the intra-EU flights concerned and shall, by the date of application of this Regulation referred to in Article 21, second subparagraph, provide eu-LISA with that list. Those Member States shall, in accordance with Article 2 of that Directive, regularly review and where necessary update those lists and shall immediately provide eu-LISA with any such updated lists. The information contained on those lists shall be treated confidentially.	deleted

Amendment 28

Proposal for a regulation

Article 6 – paragraph 4 – subparagraph 2

Text proposed by the Commission	Amendment
However, if those logs are needed for procedures for monitoring or ensuring the security and integrity of the API data or the lawfulness of the processing operations, as referred to in paragraph 2, and those procedures have already begun at the moment of the expiry of the time period referred to in the first subparagraph, air carriers may keep those logs for as long as necessary for those procedures. In that case, they shall immediately delete those logs when they are no longer necessary for those procedures.	However, if those logs are needed for procedures for monitoring or ensuring the security and integrity of the API data or the lawfulness of the processing operations, as referred to in paragraph 2, and those procedures have already begun at the moment of the expiry of the time period referred to in the first subparagraph, air carriers may keep those logs for as long as necessary for those procedures after informing and justifying it to the Commission. In that case, they shall immediately delete those logs when they are no longer necessary for those procedures.

Amendment 29

Proposal for a regulation

Article 11 a (new)

Text proposed by the Commission	Amendment
	Article 11 a
	eu-LISA's support tasks relating to the router
	eu-LISA shall, upon their request, provide support to competent border authorities, PIUs and other relevant Member States’ authorities and air carriers on the connection and integration to the router.

Amendment 30

Proposal for a regulation

Article 20 – paragraph 1 – point c a (new)

Text proposed by the Commission	Amendment
	(c a) the impact of this Regulation on the travel experience of legitimate travellers;

Amendment 31

Proposal for a regulation

Article 20 – paragraph 1 – point c b (new)

Text proposed by the Commission	Amendment
	(c b) the impact of this Regulation on the competitiveness of the aviation sector and the burden incurred by businesses. The Commission’s report shall also address this Regulation’s interaction with other relevant EU legislative acts, notably Regulation (EU) 2017/2226, Regulation (EU) 2018/1240 and Regulation (EC) 767/2008, with a view to assess the overall impact of related reporting obligations on air carriers, identify provisions that may be updated and simplified, where appropriate, to mitigate the burden on air carriers, and consider actions and measures that could be taken to reduce the total cost pressure on air carriers.