Sittings · Document
On the proposal for a regulation of the European Parliament and of the Council on the collection and transfer of advance passenger information (API) for enhancing and facilitating external border controls, amending Regulation (EU) 2019/817 and Regulation (EU) 2018/1726, and repealing Council Directive 2004/82/EC
Committee on Civil Liberties, Justice and Home Affairs · Rapporteur: JanChristoph Oetjen
DRAFT EUROPEAN PARLIAMENT LEGISLATIVE RESOLUTION
on the proposal for a regulation of the European Parliament and of the Council on the collection and transfer of advance passenger information (API) for enhancing and facilitating external border controls, amending Regulation (EU) 2019/817 and Regulation (EU) 2018/1726, and repealing Council Directive 2004/82/EC
(COM(2022)0729 – C90428/2022 – 2022/0424(COD))
(Ordinary legislative procedure: first reading)
The European Parliament,
– having regard to the Commission proposal to Parliament and the Council (COM(2022)0729),
– having regard to Article 294(2) and Articles 77(2) points (b) and (d) and 79(2) point (c) of the Treaty on the Functioning of the European Union, pursuant to which the Commission submitted the proposal to Parliament (C90428/2022),
– having regard to Article 294(3) of the Treaty on the Functioning of the European Union,
– having regard to the opinion of the European Economic and Social Committee of 27 April 2023,
– having regard to Rule 59 of its Rules of Procedure,
– having regard to the opinion of the Committee on Transport and Tourism,
– having regard to the report of the Committee on Civil Liberties, Justice and Home Affairs (A90000/2023),
1. Adopts its position at first reading hereinafter set out;
2. Calls on the Commission to refer the matter to Parliament again if it replaces, substantially amends or intends to substantially amend its proposal;
3. Instructs its President to forward its position to the Council, the Commission and the national parliaments.
Amendment 1
Proposal for a regulation
Recital 2
| Text proposed by the Commission | Amendment |
| (2) The use of traveller data and flight information transferred ahead of the arrival of travellers, known as advance passenger information (‘API’) data, contributes to speeding up the process of carrying out the required checks during the border-crossing process. For the purposes of this Regulation that process concerns, more specifically, the crossing of borders between a third country or a Member State not participating in this Regulation, on the one hand, and a Member State participating in this Regulation, on the other hand. Such use strengthens checks at those external borders by providing sufficient time to enable detailed and comprehensive checks to be carried out on all travellers, without having a disproportionate negative effect on persons travelling in good faith. Therefore, in the interest of the effectiveness and efficiency of checks at external borders, an appropriate legal framework should be provided for to ensure that Member States’ competent border authorities at such external border crossing points have access to API data prior to the arrival of travellers. | (2) The use of passenger data and flight information transferred ahead of the arrival of passengers, known as advance passenger information (‘API’) data, contributes to speeding up the process of carrying out the required checks during the border-crossing process. For the purposes of this Regulation that process concerns, more specifically, the crossing of borders between a third country or a Member State not participating in this Regulation, on the one hand, and a Member State participating in this Regulation, on the other hand. Such use strengthens checks at those external borders by providing sufficient time to enable detailed and comprehensive checks to be carried out on all passengers, without having a disproportionate negative effect on persons travelling in good faith. Therefore, in the interest of the effectiveness and efficiency of checks at external borders, an appropriate legal framework should be provided for to ensure that Member States’ competent border authorities at such external border crossing points have access to API data prior to the arrival of passengers. |
Or. en
Amendment 2
Proposal for a regulation
Recital 7
| Text proposed by the Commission | Amendment |
| (7) In order to achieve its objectives, this Regulation should apply to all carriers conducting flights into the Union, as defined in this Regulation, covering both scheduled and non-scheduled flights, irrespective of the place of establishment of the air carriers conducting those flights. | (7) In order to achieve its objectives, this Regulation should apply to all commercial carriers conducting flights into the Union, as defined in this Regulation, covering both scheduled and non-scheduled flights, irrespective of the place of establishment of the air carriers conducting those flights. General aviation such as flight schools, military or medical flights, should be exempted from this Regulation. |
Or. en
Amendment 3
Proposal for a regulation
Recital 7 a (new)
| Text proposed by the Commission | Amendment |
| (7a) For transit passengers whose initial point of departure and final destination are outside of the territory of the Member States participating in this Regulation, and who therefore will not cross the external borders, air carriers should not be under the obligation to transfer API data. |
Or. en
Amendment 4
Proposal for a regulation
Recital 8
| Text proposed by the Commission | Amendment |
| (8) In the interest of effectiveness and legal certainty, the items of information that jointly constitute the API data to be collected and subsequently transferred under this Regulation should be listed clearly and exhaustively, covering both information relating to each traveller and information on the flight of that traveller. Such flight information should cover information on the border crossing point of entry into the territory of the Member State concerned in all cases covered by this Regulation, but that information should be collected only where applicable under Regulation (EU) [API law enforcement], that is, not when the API data relate to intra-EU flights. | (8) In the interest of effectiveness and legal certainty, the items of information that jointly constitute the API data to be collected and subsequently transferred under this Regulation should be listed clearly and exhaustively, covering both information relating to each passenger and information on the flight of that passenger. Such flight information should cover information on the border crossing point of entry into the territory of the Member State concerned in all cases covered by this Regulation, but that information should be collected only where applicable under Regulation (EU) [API law enforcement]. |
Or. en
Amendment 5
Proposal for a regulation
Recital 10
| Text proposed by the Commission | Amendment |
| (10) Automated means enable travellers to provide certain API data themselves during an online check-in process. Such means could, for example, include a secure app on a travellers’ smartphone, computer or webcam with the capability to read the machine-readable data of the travel document. Where the travellers did not check-in online, air carriers should in practice provide them with the possibility to provide the machine-readable API data concerned during check-in at the airport with the assistance of a self-service kiosk or of airline staff at the counter. | (10) The passenger should be enabled to provide certain API data themselves during an online check-in process, either manually or by using automated means. Such means could, for example, include a secure app on a passengers’ smartphone, computer or webcam with the capability to read the machine-readable data of the travel document. Where the passenger did not check-in online, air carriers should in practice provide them with the possibility to provide the machine-readable API data concerned during check-in at the airport with the assistance of a self-service kiosk or of airline staff at the counter. This provision of data by the passenger should be made possible at no cost to the passenger. |
Or. en
Amendment 6
Proposal for a regulation
Recital 13
| Text proposed by the Commission | Amendment |
| (13) In view of ensuring that the pre-checks carried out in advance by competent border authorities are effective and efficient, the API data transferred to those authorities should contain data of travellers that are effectively set to cross the external borders, that is, of travellers that are effectively on board of the aircraft. Therefore, the air carriers should transfer API data directly after flight closure. Moreover, API data helps the competent border authorities to distinguish legitimate travellers from travellers who may be of interest and therefore may require additional verifications, which would necessitate further coordination and preparation of follow-up measures to be taken upon arrival. That could occur, for example, in cases of unexpected number of travellers of interest whose physical checks at the borders could adversely affect the border checks and waiting times at the borders of other legitimate travellers. To provide the competent border authorities with an opportunity to prepare adequate and proportionate measures at the border, such as temporarily reinforcing or reaffecting staff, particularly for flights where the time between the flight closure and the arrival at the external borders is insufficient to allow the competent border authorities to prepare the most appropriate response, API data should also be transmitted prior to boarding, at the moment of check-in of each traveller. | (13) In view of ensuring that the pre-checks carried out in advance by competent border authorities are effective and efficient, the API data transferred to those authorities should contain data of passengers that are effectively set to cross the external borders, that is, of passengers that are effectively on board of the aircraft. Therefore, the air carriers should transfer API data directly after flight closure. Moreover, API data helps the competent border authorities to distinguish legitimate passengers from passengers who may be of interest and therefore may require additional verifications, which would necessitate further coordination and preparation of follow-up measures to be taken upon arrival. That could occur, for example, in cases of unexpected number of passengers of interest whose physical checks at the borders could adversely affect the border checks and waiting times at the borders of other legitimate passengers. To provide the competent border authorities with an opportunity to prepare adequate and proportionate measures at the border, such as temporarily reinforcing or reaffecting staff, particularly for flights where the time between the flight closure and the arrival at the external borders is insufficient to allow the competent border authorities to prepare the most appropriate response, API data should also be transmitted prior to boarding, at the moment of check-in of each passenger. In order to reduce the impact on air carriers, and with a view to create synergies with other reporting obligations on air carriers in Regulations (EU) 2017/2226, (EU) 2018/1240 and (EC) 767/2008 and avoid duplication, air carriers should transfer the API data at the moment of check-in of each passenger by way of interactive API in accordance with international standards, using the existing carrier gateway. Air carriers should receive a meaningful reply to the transfer of interactive API in accordance with Regulations (EU) 2017/2226, (EU) 2018/1240 and (EC) 767/2008. |
Or. en
Amendment 7
Proposal for a regulation
Recital 13 a (new)
| Text proposed by the Commission | Amendment |
| (13a) In order to enhance data quality, the router should verify whether the API data transferred to it by the air carriers comply with the supported data formats. Where the router has verified that the data are not compliant with the supported data formats, the router should, immediately and in an automated manner, notify the air carrier concerned. |
Or. en
Amendment 8
Proposal for a regulation
Recital 16
| Text proposed by the Commission | Amendment |
| (16) To ensure that competent border authorities have sufficient time to carry out pre-checks effectively on all travellers, including travellers on long-haul flights and those travelling on connecting flights, as well as sufficient time to ensure that the API data collected and transferred by the air carriers is complete, accurate and up-to-date, and where necessary to request additional clarifications, corrections or completions from the air carriers, the competent border authorities should store the API data that they received under this Regulation for a fixed time period that remains limited to what is strictly necessary for those purposes. Similarly, to be able to respond to such requests, air carriers should store the API data that they transferred under this Regulation for the same fixed and strictly necessary time period. | (16) To ensure that competent border authorities have sufficient time to carry out pre-checks effectively on all passengers, including passengers on long-haul flights and those travelling on connecting flights, as well as sufficient time to ensure that the API data collected and transferred by the air carriers is complete, accurate and up-to-date, and where necessary to request additional clarifications, corrections or completions from the air carriers, the competent border authorities should store the API data that they received under this Regulation for a fixed time period that remains limited to what is strictly necessary for those purposes. Similarly, to be able to respond to such requests, air carriers should store the API data that they transferred under this Regulation for the same fixed and strictly necessary time period. |
Or. en
Amendment 9
Proposal for a regulation
Recital 19
| Text proposed by the Commission | Amendment |
| (19) The router should serve only to facilitate the transmission of API data from the air carriers to the competent border authorities in accordance with this Regulation and to PIUs in accordance with Regulation (EU) [API law enforcement], and should not be a repository of API data. Therefore, and in order to minimise any risk of unauthorised access or other misuse and in accordance with the principle of data minimisation, any storage of the API data on the router should remain limited to what is strictly necessary for technical purposes related to the transmission and the API data should be deleted from the router, immediately, permanently and in an automated manner, from the moment that the transmission has been completed or, where relevant under Regulation (EU) [API law enforcement], the API data is not to be transmitted at all. | (19) The router should serve only to facilitate the transmission of API data from the air carriers to the competent border authorities in accordance with this Regulation and to PIUs in accordance with Regulation (EU) [API law enforcement], and should not be a repository of API data. Therefore, and in order to minimise any risk of unauthorised access or other misuse and in accordance with the principle of data minimisation, any storage of the API data on the router should remain limited to what is strictly necessary for technical purposes related to the transmission and the API data should be deleted from the router, immediately, permanently and in an automated manner, from the moment that the transmission has been completed. |
Or. en
Amendment 10
Proposal for a regulation
Recital 23
| Text proposed by the Commission | Amendment |
| (23) In view of the Union interests at stake, the costs incurred by eu-LISA for the performance of its tasks under this Regulation and Regulation (EU) [API law enforcement] in respect of the router should be borne by the Union budget. The same should go for appropriate costs incurred by the Member States in relation to their connections to, and integration with, the router, as required under this Regulation and in accordance with the applicable legislation, subject to certain exceptions. The costs covered by those exceptions should be borne by each Member State concerned itself. | (23) In view of the Union interests at stake, the costs incurred by the European Data Protection Supervisor and eu-LISA for the performance of its tasks under this Regulation and Regulation (EU) [API law enforcement] should be borne by the Union budget. The same should go for appropriate costs incurred by the Member States in relation to their connections to, and integration with, the router, as required under this Regulation and in accordance with the applicable legislation, subject to certain exceptions. The costs covered by those exceptions should be borne by each Member State concerned itself. The costs incurred by the independent national supervisory authorities in relation to the tasks entrusted to them under this Regulation and Regulation (EU) [API law enforcement] shall be borne by the respective Member States as well. |
Or. en
Amendment 11
Proposal for a regulation
Recital 35
| Text proposed by the Commission | Amendment |
| (35) This Regulation should not affect the possibility for Member States to provide, under their national law, for a system of collecting API data from transportation providers other than those specified in this Regulation, provided that such national law complies with Union law. | deleted |
Or. en
Amendment 12
Proposal for a regulation
Article 2 – paragraph 1
| Text proposed by the Commission | Amendment |
| This Regulation applies to air carriers conducting scheduled or non-scheduled flights into the Union. | This Regulation applies to air carriers conducting scheduled or non-scheduled flights into the Union. General aviation shall be exempted from this Regulation. |
Or. en
Amendment 13
Proposal for a regulation
Article 3 – paragraph 1 – point a
| Text proposed by the Commission | Amendment |
| (a) ‘air carrier’ means an air transport undertaking as defined in Article 3, point 1, of Directive (EU) 2016/681; | (a) ‘air carrier’ means an air transport undertaking as defined in Article 3, point 1, of Directive (EU) 2016/681, other than air transport undertakings performing general aviation operations; |
Or. en
Amendment 14
Proposal for a regulation
Article 3 – paragraph 1 – point a a (new)
| Text proposed by the Commission | Amendment |
| (aa) 'general aviation' means all civil aviation operations other than scheduled air services and non-scheduled air transport operations for remuneration or hire as defined in the classification of the International Civil Aviation Organization (ICAO); |
Or. en
Amendment 15
Proposal for a regulation
Article 3 – paragraph 1 – point e
| Text proposed by the Commission | Amendment |
| (e) ‘scheduled flight’ means a flight that operates according to a fixed timetable, for which tickets can be purchased by the general public; | (e) ‘scheduled flight’ means a commercial flight that operates according to a fixed timetable, for which tickets can be purchased by the general public; |
Or. en
Amendment 16
Proposal for a regulation
Article 3 – paragraph 1 – point f
| Text proposed by the Commission | Amendment |
| (f) ‘non-scheduled flight’ means a flight that does not operate according to a fixed timetable and that is not necessarily part of a regular or scheduled route; | (f) ‘non-scheduled flight’ means a commercial flight that does not operate according to a fixed timetable and that is not necessarily part of a regular or scheduled route; |
Or. en
Amendment 17
Proposal for a regulation
Article 3 – paragraph 1 – point h
| Text proposed by the Commission | Amendment |
| (h) ‘passenger’ means any person, excluding members of the crew, carried or to be carried in an aircraft with the consent of the air carrier, such consent being manifested by that person's registration in the passengers list; | (h) (h) ‘passenger’ means any person,excluding members of the crew unless they are off duty, carried or to be carried in an aircraft with the consent of the air carrier, such consent being manifested by that person's registration in the passengers list; |
Or. en
Amendment 18
Proposal for a regulation
Article 3 – paragraph 1 – point j
| Text proposed by the Commission | Amendment |
| (j) ‘traveller’ means a passenger or crew member; | deleted |
Or. en
Amendment 19
Proposal for a regulation
Article 3 – paragraph 1 – point k
| Text proposed by the Commission | Amendment |
| (k) ‘Advance Passenger Information data’ or ‘API data’ means the traveller data and the flight information referred to in Article 4(2) and (3) respectively; | (k) ‘Advance Passenger Information data’ or ‘API data’ means the passenger data and the flight information referred to in Article 4(2) and (3) respectively; |
Or. en
Amendment 20
Proposal for a regulation
Article 4 – paragraph 1
| Text proposed by the Commission | Amendment |
| 1. Air carriers shall collect API data of travellers, consisting of the traveller data and the flight information specified in paragraphs 2 and 3 of this Article, respectively, on the flights referred to in Article 2, for the purpose of transferring that API data to the router in accordance with Article 6. | 1. Air carriers shall collect API data of passengers, consisting of the passenger data and the flight information specified in paragraphs 2 and 3 of this Article, respectively, on the flights referred to in Article 2, for the purpose of transferring that API data to the router in accordance with Article 6. Where the flight is code-shared between one or more air carriers, the obligation to transfer the API data shall be on the air carrier that operates the flight. |
Or. en
Amendment 21
Proposal for a regulation
Article 4 – paragraph 2 – introductory part
| Text proposed by the Commission | Amendment |
| 2. The API data shall consist of the following traveller data relating to each traveller on the flight: | 2. The API data shall consist of only the following passenger data relating to each passenger on the flight: |
Or. en
Amendment 22
Proposal for a regulation
Article 4 – paragraph 2 – point e
| Text proposed by the Commission | Amendment |
| (e) whether the traveller is a passenger or a crew member (traveller’s status); | deleted |
Or. en
Amendment 23
Proposal for a regulation
Article 4 – paragraph 2 – point g
| Text proposed by the Commission | Amendment |
| (g) the seating information, such as the number of the seat in the aircraft assigned to a passenger, where the air carrier collects such information; | (g) the number of the seat in the aircraft assigned to a passenger, where the air carrier collects such information; |
Or. en
Amendment 24
Proposal for a regulation
Article 4 – paragraph 2 – point h
| Text proposed by the Commission | Amendment |
| (h) baggage information, such as number of checked bags, where the air carrier collects such information. | (h) number and the weight of checked bags, where the air carrier collects such information. |
Or. en
Amendment 25
Proposal for a regulation
Article 4 – paragraph 3 – introductory part
| Text proposed by the Commission | Amendment |
| 3. The API data shall also consist of the following flight information relating to the flight of each traveller: | 3. The API data shall also only consist of the following flight information relating to the flight of each passenger: |
Or. en
Amendment 26
Proposal for a regulation
Article 4 – paragraph 3 – point a
| Text proposed by the Commission | Amendment |
| (a) the flight identification number or, if no such number exists, other clear and suitable means to identify the flight; | (a) the flight identification number or, where the flight is code-shared between one or more air carriers, the, flights identification numbers, or if no such number exists, other clear and suitable means to identify the flight; |
Or. en
Amendment 27
Proposal for a regulation
Article 5 – paragraph 2 – subparagraph 1
| Text proposed by the Commission | Amendment |
| Air carriers shall collect the API data referred to Article 4(2), points (a) to (d), using automated means to collect the machine-readable data of the travel document of the traveller concerned. They shall do so in accordance with the detailed technical requirements and operational rules referred to in paragraph 4, where such rules have been adopted and are applicable. | Air carriers shall collect the API data referred to Article 4(2), points (a) to (d), using automated means to collect the machine-readable data of the travel document of the passenger concerned. They shall do so in accordance with the detailed technical requirements and operational rules referred to in paragraph 4, where such rules have been adopted and are applicable. |
Or. en
Amendment 28
Proposal for a regulation
Article 5 – paragraph 2 – subparagraph 1 a (new)
| Text proposed by the Commission | Amendment |
| Where air carriers provide an online check-in process, they shall enable passengers to provide the API data referred to in Article 4(2), points (a) to (d) during the online check-in process. |
Or. en
Amendment 29
Proposal for a regulation
Article 6 – paragraph 1
| Text proposed by the Commission | Amendment |
| 1. Air carriers shall transfer the API data to the router by electronic means. They shall do so in accordance with the detailed rules referred to in paragraph 3, where such rules have been adopted and are applicable. | 1. Air carriers shall transfer the encrypted API data to the router by electronic means. They shall do so in accordance with the detailed rules referred to in paragraph 3, where such rules have been adopted and are applicable. |
Or. en
Amendment 30
Proposal for a regulation
Article 6 – paragraph 2
| Text proposed by the Commission | Amendment |
| 2. Air carriers shall transfer the API data both at the moment of check-in and immediately after flight closure, that is, once the passengers have boarded the aircraft in preparation for departure and it is no longer possible for passengers to board or to leave the aircraft. | 2. Air carriers shall transfer the API data both at the moment of check-in and immediately after flight closure, that is, once the passengers have boarded the aircraft in preparation for departure and it is no longer possible for passengers to board or to leave the aircraft. At the moment of check-in, air carriers shall transfer the API data by way of interactive API in accordance with international standards. Where an air carrier transfers the API data by way of interactive API, it shall receive a meaningful reply in accordance with Regulations (EU) 2017/2226, (EU) 2018/1240 and (EC) 767/2008. |
Or. en
Amendment 31
Proposal for a regulation
Article 6 – paragraph 3
| Text proposed by the Commission | Amendment |
| 3. The Commission is empowered to adopt delegated acts in accordance with Article 37 to supplement this Regulation by laying down the necessary detailed rules on the common protocols and supported data formats to be used for the transfers of API data to the router referred to in paragraph 1. | 3. The Commission is empowered to adopt delegated acts in accordance with Article 37 to supplement this Regulation by laying down the necessary detailed rules on the common protocols and supported data formats to be used for the encrypted transfers of API data to the router referred to in paragraph 1. |
Or. en
Amendment 32
Proposal for a regulation
Article 8 – paragraph 1
| Text proposed by the Commission | Amendment |
| 1. Air carriers shall store, for a time period of 48 hours from the moment of departure of the flight, the API data relating to that passenger that they collected pursuant to Article 4. They shall immediately and permanently delete that API data after the expiry of that time period. | 1. Air carriers shall store, for a time period of 24 hours from the moment of departure of the flight, the API data relating to that passenger that they collected pursuant to Article 4. They shall immediately and permanently delete that API data after the expiry of that time period. |
Or. en
Amendment 33
Proposal for a regulation
Article 8 – paragraph 2
| Text proposed by the Commission | Amendment |
| 2. The competent border authorities shall store, for a time period of 48 hours from the moment of departure of the flight, the API data relating to that passenger that they received through the router pursuant to Article 11. They shall immediately and permanently delete that API data after the expiry of that time period. | 2. The competent border authorities shall store, for a time period of 24 hours from the moment of departure of the flight, the API data relating to that passenger that they received through the router pursuant to Article 11. They shall immediately and permanently delete that API data after the expiry of that time period. |
Or. en
Amendment 34
Proposal for a regulation
Article 8 a (new)
| Text proposed by the Commission | Amendment |
| Article 8a | |
| Non-discrimination and fundamental rights | |
| Processing of personal data in accordance with this Regulation and Regulation (EU) [API law enforcement] shall not result in discrimination against data subjects on the grounds of sex, race, colour, ethnic or social origin, genetic features, language, religion or belief, political or any other opinion, membership of a national minority, property, birth, disability, age or sexual orientation. It shall fully respect human dignity and integrity and fundamental rights, including the right to respect for one’s private life and to the protection of personal data. Particular attention shall be paid to children, the elderly and persons with a disability. The best interests of the child shall be a primary consideration. |
Or. en
Amendment 35
Proposal for a regulation
Article 8 b (new)
| Text proposed by the Commission | Amendment |
| Article 8b | |
| Legal remedies | |
| Member States shall ensure that the persons affected by the measures provided for under this Regulation have the right to an effective legal remedy in order to uphold their rights. |
Or. en
Amendment 36
Proposal for a regulation
Article 9 – paragraph 2 – point b
| Text proposed by the Commission | Amendment |
| (b) a secure communication channel between the central infrastructure and the competent border authorities and the PIUs, and a secure communication channel between the central infrastructure and the air carriers, for the transfer of API data and for any communications relating thereto. | (b) a secure communication channel between the central infrastructure and the competent border authorities and the PIUs, and a secure communication channel between the central infrastructure and the air carriers, for the transfer and transmission of API data and for any communications relating thereto. |
Or. en
Amendment 37
Proposal for a regulation
Article 9 – paragraph 2 a (new)
| Text proposed by the Commission | Amendment |
| 2a. The router shall allow for the reception and transmission of encrypted API data. |
Or. en
Amendment 38
Proposal for a regulation
Article 10 – paragraph 1
| Text proposed by the Commission | Amendment |
| The router shall only be used by air carriers to transfer API data and by competent border authorities and PIUs to receive API data, in accordance with this Regulation and Regulation (EU) [API law enforcement], respectively. | The router shall only be used by air carriers to transfer encrypted API data and by competent border authorities and PIUs to receive encrypted API data, in accordance with this Regulation and Regulation (EU) [API law enforcement], respectively. |
Or. en
Amendment 39
Proposal for a regulation
Article 11 – paragraph 1 – subparagraph 1
| Text proposed by the Commission | Amendment |
| The router shall, immediately and in an automated manner, transmit the API data, transferred to it pursuant to Article 6, to the competent border authorities of the Member State referred to in Article 4(3), point (c). It shall do so in accordance with the detailed rules referred to in paragraph 4 of this Article, where such rules have been adopted and are applicable. | The router shall, immediately and in an automated manner, transmit the encrypted API data, transferred to it pursuant to Article 6, to the competent border authorities of the Member State referred to in Article 4(3), point (c). It shall do so in accordance with the detailed rules referred to in paragraph 4 of this Article, where such rules have been adopted and are applicable. |
Or. en
Amendment 40
Proposal for a regulation
Article 11 – paragraph 3
| Text proposed by the Commission | Amendment |
| 3. The Member States shall ensure that only the duly authorised staff of the competent border authorities have access to the API data transmitted to them through the router. They shall lay down the necessary rules to that effect. Those rules shall include rules on the creation and regular update of a list of those staff and their profiles. | 3. The Member States shall ensure that only the duly authorised and trained staff of the competent border authorities have access to the API data transmitted to them through the router. They shall lay down the necessary rules to that effect. Those rules shall include rules on the creation and regular update of a list of those staff and their profiles. |
Or. en
Amendment 41
Proposal for a regulation
Article 11 – paragraph 4
| Text proposed by the Commission | Amendment |
| 4. The Commission is empowered to adopt delegated acts in accordance with Article 37 to supplement this Regulation by laying down the necessary detailed technical and procedural rules for the transmissions of API data from the router referred to in paragraph 1. | 4. The Commission is empowered to adopt delegated acts in accordance with Article 37 to supplement this Regulation by laying down the necessary detailed technical and procedural rules for the transmissions of encrypted API data from the router referred to in paragraph 1. |
Or. en
Amendment 42
Proposal for a regulation
Article 12 – paragraph 1 – introductory part
| Text proposed by the Commission | Amendment |
| API data, transferred to the router pursuant to this Regulation and Regulation (EU) [API law enforcement], shall be stored on the router only insofar as necessary to complete the transmission to the relevant competent borders authorities or PIUs, as applicable, in accordance with those Regulations and shall be deleted from the router, immediately, permanently and in an automated manner, in both of the following situations: | API data, transferred to the router pursuant to this Regulation and Regulation (EU) [API law enforcement], shall be stored on the router only insofar as necessary to complete the transmission to the relevant competent borders authorities or PIUs, as applicable, in accordance with those Regulations and shall be deleted from the router, immediately, permanently and in an automated manner, in the following situations: |
Or. en
Amendment 43
Proposal for a regulation
Article 12 – paragraph 1 – point a a (new)
| Text proposed by the Commission | Amendment |
| (aa) in cases of technical impossibility of the router to subsequently transmit the API data to the competent national authorities, after 12 hours; |
Or. en
Amendment 44
Proposal for a regulation
Article 12 – paragraph 1 – point b
| Text proposed by the Commission | Amendment |
| (b) in respect of Regulation (EU) [API law enforcement], where the API data relates to other intra-EU flights than those included the lists referred to in Article 5(2) of that Regulation. | deleted |
Or. en
Amendment 45
Proposal for a regulation
Article 13 – paragraph 1 – subparagraph 1 – introductory part
| Text proposed by the Commission | Amendment |
| eu-LISA shall keep logs of all processing operations relating to the transfer of API data through the router under this Regulation and Regulation (EU) [API law enforcement]. Those logs shall cover the following: | eu-LISA shall keep logs of all processing operations relating to the transfer of API data through the router under this Regulation and Regulation (EU) [API law enforcement]. Those logs shall cover: |
Or. en
Amendment 46
Proposal for a regulation
Article 13 – paragraph 2
| Text proposed by the Commission | Amendment |
| 2. Air carriers shall create logs of all processing operations under this Regulation undertaken by using the automated means referred to in Article 5(2). Those logs shall cover the date, time and place of transfer of the API data. | 2. Air carriers shall create logs of all processing operations under this Regulation undertaken by using the automated means referred to in Article 5(2). Those logs shall cover the date, time and place of transfer of the API data. Those logs shall not contain any personal data. |
Or. en
Amendment 47
Proposal for a regulation
Article 13 – paragraph 5 – subparagraph 2
| Text proposed by the Commission | Amendment |
| However, if those logs are needed for procedures for monitoring or ensuring the security and integrity of the API data or the lawfulness of the processing operations, as referred to in paragraph 2, and these procedures have already begun at the moment of the expiry of the time period referred to in the first subparagraph, eu-LISA and the air carriers may keep those logs for as long as necessary for those procedures. In that case, they shall immediately delete those logs when they are no longer necessary for those procedures. | However, if those logs are needed for procedures for monitoring or ensuring the security and integrity of the API data or the lawfulness of the processing operations, as referred to in paragraph 2, and these procedures have already begun at the moment of the expiry of the time period referred to in the first subparagraph, eu-LISA and the air carriers shall keep those logs for as long as necessary for those procedures after informing and justifying it to the Commission. In that case, they shall immediately delete those logs when they are no longer necessary for those procedures. |
Or. en
Amendment 48
Proposal for a regulation
Article 19 – paragraph 1
| Text proposed by the Commission | Amendment |
| 1. The competent national data protection authorities referred to in Article 51 of Regulation (EU) 2016/679 shall ensure that an audit of processing operations of API data constituting personal data performed by the competent border autorities for the purposes of this Regulation is carried out, in accordance with relevant international auditing standards, at least once every four years. | 1. The independent supervisory authorities referred to in Article 51 of Regulation (EU) 2016/679 shall carry out an audit of processing operations of API data constituting personal data performed by the competent border authorities for the purposes of this Regulation, in accordance with relevant international auditing standards, at least once every four years. |
Or. en
Amendment 49
Proposal for a regulation
Article 19 – paragraph 2
| Text proposed by the Commission | Amendment |
| 2. The European Data Protection Supervisor shall ensure that an audit of processing operations of API data constituting personal data performed by eu-LISA for the purposes of this Regulation and Regulation (EU) [API law enforcement] is carried out in accordance with relevant international auditing standards at least once every year. A report of that audit shall be sent to the European Parliament, to the Council, to the Commission, to the Member States and to eu-LISA. eu-LISA shall be given an opportunity to make comments before the reports are adopted. | 2. The European Data Protection Supervisor shall carry out an audit of processing operations of API data constituting personal data performed by eu-LISA for the purposes of this Regulation and Regulation (EU) [API law enforcement] in accordance with relevant international auditing standards at least once every year. A report of that audit shall be sent to the European Parliament, to the Council, to the Commission, to the Member States and to eu-LISA. eu-LISA shall be given an opportunity to make comments before the reports are adopted. |
Or. en
Amendment 50
Proposal for a regulation
Article 25 – title
| Text proposed by the Commission | Amendment |
| Costs of eu-LISA and of Member States | Costs of eu-LISA, the European Data Protection Supervisor, the national supervisory authorities and of Member States |
Or. en
Amendment 51
Proposal for a regulation
Article 25 – paragraph 2 a (new)
| Text proposed by the Commission | Amendment |
| 2a. Costs incurred by the European Data Protection Supervisor in relation to the tasks entrusted to it under this Regulation shall be borne by the general budget of the Union. |
Or. en
Amendment 52
Proposal for a regulation
Article 25 – paragraph 2 b (new)
| Text proposed by the Commission | Amendment |
| 2b. Costs incurred by independent national supervisory authorities in relation to the tasks entrusted to them under this Regulation shall be borne by the Member States. |
Or. en
Amendment 53
Proposal for a regulation
Article 28 – title
| Text proposed by the Commission | Amendment |
| Voluntary use of the router in application of Directive 2004/81/EC | Voluntary use of the router in application of Directive 2004/82/EC |
Or. en
Amendment 54
Proposal for a regulation
Article 28 – paragraph 2
| Text proposed by the Commission | Amendment |
| 2. Where an air carrier starts using the router in accordance with paragraph 1, it shall continue using the router to transmit such information to the responsible authority concerned until the date of application of this Regulation referred to in Article 39, second subparagraph. However, that use shall be discontinued, from an appropriate date set by that authority, where that authority considers that there are objective reasons that require such discontinuation and has informed the air carrier accordingly. | 2. Where an air carrier starts using the router in accordance with paragraph 1, it shall continue using the router to transmit such information to the responsible authorities of the Member State concerned until the date of application of this Regulation referred to in Article 39, second subparagraph. However, that use shall be discontinued, from an appropriate date set by that authority, where that authority considers that there are objective reasons that require such discontinuation and has informed the air carrier accordingly. |
Or. en
Amendment 55
Proposal for a regulation
Article 29 – paragraph 3
| Text proposed by the Commission | Amendment |
| 3. Member States shall, by the date of application of this Regulation referred to in Article 21, second subparagraph, notify the Commission of the name and the contact details of the authorities that they designated under paragraph 1 and of the detailed rules that they laid down pursuant to paragraph 2. They shall notify the Commission without delay of any subsequent changes or amendments thereto. | 3. Member States shall, by the date of application of this Regulation referred to in Article 39, second subparagraph, notify the Commission of the name and the contact details of the authorities that they designated under paragraph 1 and of the detailed rules that they laid down pursuant to paragraph 2. They shall notify the Commission without delay of any subsequent changes or amendments thereto. |
Or. en
Amendment 56
Proposal for a regulation
Article 30 – paragraph 2 a (new)
| Text proposed by the Commission | Amendment |
| Member States shall ensure that a systematic or persistent failure to comply with the obligations set in this Regulation is subject to financial penalties of up to EUR 10 million, notwithstanding the Member States’ right to impose non-financial penalties in addition. |
Or. en
Amendment 57
Proposal for a regulation
Article 31 – paragraph 1
| Text proposed by the Commission | Amendment |
| 1. Every quarter, eu-LISA shall publish statistics on the functioning of the router, showing in particular the number, the nationality and the country of departure of the travellers, and specifically of the travellers who boarded the aircraft with inaccurate, incomplete or no longer up-to-date API data, with a non-recognised travel document, without a valid visa, without a valid travel authorization, or reported as overstay, the number and nationality of travellers. | 1. Every quarter, eu-LISA shall publish statistics on the functioning of the router, showing in particular the number, the nationality and the country of departure of the passengers, and specifically of the passengers who boarded the aircraft with inaccurate, incomplete or no longer up-to-date API data, with a non-recognised travel document, without a valid visa, without a valid travel authorization, or reported as overstay, the number and nationality of passengers. |
Or. en
Amendment 58
Proposal for a regulation
Article 31 – paragraph 5 – introductory part
| Text proposed by the Commission | Amendment |
| 5. eu-LISA shall have the right to access the following API data transmitted through to the router, solely for the purposes of the reporting referred to in Article 38 and for generating statistics in accordance with the present Article, without however such access allowing for the identification of the travellers concerned: | 5. eu-LISA shall have the right to access the following API data transmitted through to the router, solely for the purposes of the reporting referred to in Article 38 and for generating statistics in accordance with the present Article, without however such access allowing for the identification of the passengers concerned: |
Or. en
Amendment 59
Proposal for a regulation
Article 31 – paragraph 5 – point a
| Text proposed by the Commission | Amendment |
| (a) whether the traveller is passenger or a crew member; | deleted |
Or. en
Amendment 60
Proposal for a regulation
Article 31 – paragraph 5 – point b
| Text proposed by the Commission | Amendment |
| (b) the nationality, sex and year of birth of the traveller; | (b) the nationality, sex and year of birth of the passenger; |
Or. en
Amendment 61
Proposal for a regulation
Article 31 – paragraph 5 – point e
| Text proposed by the Commission | Amendment |
| (e) the number of travellers checked-in on the same flight; | (e) the number of passengers checked-in on the same flight; |
Or. en
Amendment 62
Proposal for a regulation
Article 31 – paragraph 5 – point g
| Text proposed by the Commission | Amendment |
| (g) whether the personal data of the traveller is accurate, complete and up-to-date. | (g) whether the personal data of the passenger is accurate, complete and up-to-date. |
Or. en
Amendment 63
Proposal for a regulation
Article 31 – paragraph 5 – subparagraph 1 a (new)
| Text proposed by the Commission | Amendment |
| Nothing in this paragraph shall affect the anonymized nature of the statistical data. |
Or. en
Amendment 64
Proposal for a regulation
Article 31 – paragraph 6 a (new)
| Text proposed by the Commission | Amendment |
| 6a. The use of the data referred to in paragraph 5 of this Article for automated or non-automated risk analysis, profiling or predictive risk assessment shall be prohibited. |
Or. en
Amendment 65
Proposal for a regulation
Article 32 – paragraph 1
| Text proposed by the Commission | Amendment |
| The Commission shall, in close cooperation with the competent border authorities, other relevant Member States’ authorities, the air carriers and relevant Union agencies, prepare and make publicly available a practical handbook, containing guidelines, recommendations and best practices for the implementation of this Regulation. | The Commission shall, in close cooperation with the competent border authorities, other relevant Member States’ authorities, the air carriers and relevant Union agencies, in particular the European Data Protection Supervisor and the Fundamental Rights Agency, prepare and make publicly available a practical handbook, containing guidelines, recommendations and best practices for the implementation of this Regulation, including on fundamental rights compliance as well as on penalties in accordance with Article 30. |
Or. en
Amendment 66
Proposal for a regulation
Article 32 a (new)
| Text proposed by the Commission | Amendment |
| Article 32a | |
| API Contact Group | |
| 1. An API Contact Group shall be established with effect from [one month after the entry into force of this Regulation] in accordance with the horizontal rules on the creation and operation of Commission expert groups. It shall facilitate cooperation and the exchange of information on obligations stemming from and issues relating to this Regulation among Member States, EU institutions and stakeholders. | |
| 2. The API Contact Group shall be composed of representatives of the European Commission, of Member States’ relevant authorities, of the European Parliament and of eu-LISA. Where relevant for the performance of its tasks, the API Contact Group may invite relevant stakeholders, in particular representatives of air carriers, the EDPS and the independent national supervisory authorities, to participate in its work. The Commission’s representative shall chair the API Contact Group. |
Or. en
Amendment 67
Proposal for a regulation
Article 35 – paragraph 1
Regulation (EU) 2019/817
Article 39 – paragraph 2
| Text proposed by the Commission | Amendment |
| 2. eu-LISA shall establish, implement and host in its technical sites the CRRS containing the data and statistics referred to in Article 63 of Regulation (EU) 2017/2226, Article 17 of Regulation (EC) No 767/2008, Article 84 of Regulation (EU) 2018/1240, Article 60 of Regulation (EU) 2018/1861 and Article 16 of Regulation (EU) 2018/1860, logically separated by EU information system. eu-LISA shall also collect the data and statistics from the router referred to in Article 31(1) of Regulation (EU) …/… * [this Regulation]. Access to the CRRS shall be granted by means of controlled, secured access and specific user profiles, solely for the purpose of reporting and statistics, to the authorities referred to in Article 63 of Regulation (EU) 2017/2226, Article 17 of Regulation (EC) No 767/2008, Article 84 of Regulation (EU) 2018/1240, Article 60 of Regulation (EU) 2018/1861 and Article 38(2) of Regulation (EU) …/… [this Regulation ]. | 2. eu-LISA shall establish, implement and host in its technical sites the CRRS containing the data and statistics referred to in Article 63 of Regulation (EU) 2017/2226, Article 17 of Regulation (EC) No 767/2008, Article 84 of Regulation (EU) 2018/1240, Article 60 of Regulation (EU) 2018/1861 and Article 16 of Regulation (EU) 2018/1860, logically separated by EU information system. eu-LISA shall also collect the data and statistics from the router referred to in Article 31(1) of Regulation (EU) …/… * [this Regulation]. Access to the CRRS shall be granted by means of controlled, secured access and specific user profiles, solely for the purpose of reporting and statistics, to the authorities referred to in Article 63 of Regulation (EU) 2017/2226, Article 17 of Regulation (EC) No 767/2008, Article 84 of Regulation (EU) 2018/1240, Article 60 of Regulation (EU) 2018/1861 and Article 38(2) of Regulation (EU) …/… [this Regulation ]. Especially the use of the CRRS for risk analysis, profiling or predictive risk assessment shall be prohibited. |
Or. en
Amendment 68
Proposal for a regulation
Article 38 – paragraph 2
| Text proposed by the Commission | Amendment |
| 2. By [one year after the date of entry into force of this Regulation] and every year thereafter during the development phase of the router, eu-LISA shall produce a report, and submit it to the European Parliament and to the Council on the state of play of the development of the router. That report shall contain detailed information about the costs incurred and about any risks which may impact the overall costs to be borne by the general budget of the Union in accordance with Article 25. | 2. By [one year after the date of entry into force of this Regulation] and every year thereafter during the development phase of the router, eu-LISA shall produce a report, and submit it to the European Parliament and to the Council on the state of play of the development of the router. That report shall contain detailed information about the costs incurred and about any risks which may impact the overall costs to be borne by the general budget of the Union in accordance with Article 25. From the date at which the router starts operations and every year thereafter, the Commission shall assess whether the budget under the MFF budget line 4.11.10.02 (“eu-LISA”) covers the needs necessary for good design, development, hosting and technical management of the router and, if appropriate, immediately propose amendment to the budget appropriations. |
Or. en
EXPLANATORY STATEMENT
This Regulation updates and replaces Directive 2004/82/EC, the existing legal framework on API data that intents to facilitate external border controls, combat illegal immigration and increase internal security. Whereas Directive 2004/82/EC has proven effective in improving border controls, its divergent application at national level has created inconsistencies, which are now being addressed by the new rules proposed by the Commission.
More specifically, this Regulation introduces:
1) provisions for the collection and transfer of API data by air carriers to the router, rules for the processing of API data by competent authorities and the storage and deletion of API data by both air carriers and competent authorities;
2) the establishement of a single point of reception and onward distribution of data, the router, which will be managed by eu-LISA; furthermore rules on the use of the router, on the deletion of the API data from the router and procedure in case of technical impossibilities to use the router;
3) provisions on the protection of personal data, as well as security and self-monitoring by air carriers and competent authorities;
4) rules and conditions on the possibility of an initial voluntary use of the router by air carriers, before its compulsory application;
5) requirements on supervision and possible penalties in case of non-compliance by air carriers.
This Regulation also includes budgetary provisions that will finance the establishment and functioning of the router and the costs incurred by the Member States (with some exceptions) in relation to their connections to and integration with the router, under the Union budget.
Rapporteur’s position
This Regulation should allow authorities to estimate in advance the necessary control capacity at airports and should enable air carriers to process the information and the check-in in a more efficient and faster way. The Rapporteur therefore welcomes this streamlined and simpler method for air carriers to provide API data through a centralised system. He also shares the view that digitalisation and automation can be a useful tool to mitigate errors and to allow for a better travel experience for passengers. Nevertheless, this Regulation should avoid going to the detriment of the travel experience of the legitimate traveller. In that sense, a clarification on the possibility to check in online was introduced, as well as a restriction to apply fees to the passengers when the data is provided at the airport.
The Rapporteur also shares the intention to ensure better quality API data in order to facilitate checks at external borders, while underlining the need to fully respect the citizens' fundamental right to data protection. In view of the sensitive nature of the personal data, the requirement to encrypt the API data when transferred from the air carrier to the router and further on to the competent authorites is introduced. The Rapporteur also proposes a clear restriction of the use of statistical data for specific defined purposes in Art. 31. For reasons of coherence and proportionality, the Rapporteur also intents to exclude both members of the crew and transit passengers from the scope of this Regulation.
The Rapporteur believes that this legislation should facilitate people travelling, with reduced times at disembarkation and at the physical border checks. Therefore, the Rapporteur introduces a provision in Article 38 which imposes a requirement on the Commission to carry out an assessment on the impact of this Regulation on the travel experience of travellers. He also calls for the establishement of a API contact group, to enhance cooperation and information exchange among Member States, EU institutions and stakeholders. The Rapporteur understands that in certain cases air carriers may need to keep logs for longer than for procedures for monitoring or ensuring the security and integrity of the API data or the lawfulness of the processing operations. As the reasons for a prolongation of the temporary storage period has not been made sufficiently clear in relation to the purpose of this Regulation, the Rapporteur prefers to limit the data retention period for both air carriers and competent border authorities to 24 hours.
Regarding the penalties imposed on air carries for non-compliance with the obligations as laid out in this Regulation, the Rapporteur shares the intention to make them effective and dissuasive, but he prefers to introduce a threshold for maximum penalties in order to fully ensure proportionality. The Rapporteur believes that the financial appropriation to the functioning of the router will determine its success, therefore eu-LISA should be provided with the necessary resources. In addition, in view of the expected increase in tasks for the EDPS and national data protection authorities, the Rapporteur includes provisions regarding the coverage of cost costs incurred by them as well.
As regards the provisions and references related to intra-EU flights in the Regulation (EU) [API law enforcement], the Rapporteur prefers to remove them from the text since it is questionable if the proposed filtering mechanism of the router would fully comply with the requirements of the Ligue des droits humains judgment. Moreover, he is of the opinion that separate provisions on non-discrimination and legal remedies are essential fundamental rights safeguards which apply horizontally.
Furthermore, the Rapporteur considers that the obligation to provide API data should not be extented to other means of transport. As such, he does not agree with the introduction of an opening clause in Recital 35, as proposed by the Commission.