Sittings · Document
On the proposal for a regulation of the European Parliament and of the Council on the collection and transfer of advance passenger information for the prevention, detection, investigation and prosecution of terrorist offences and serious crime, and amending Regulation (EU) 2019/818
Committee on Transport and Tourism · Rapporteur: JanChristoph Oetjen
on the proposal for a regulation of the European Parliament and of the Council on the collection and transfer of advance passenger information for the prevention, detection, investigation and prosecution of terrorist offences and serious crime, and amending Regulation (EU) 2019/818
SHORT JUSTIFICATION
This Regulation sets new uniform rules on the collection and transfer of Advance Passenger Information (API), which includes a closed list of API data, the means to collect them and a single point for the transfer of these data, for the prevention of, detention, investigation and prosecution of terrorist offences and serious crime.
Serious and organised crime has continued to increase over the last decades and airports are often the transit points for drug trafficking, smuggling of persons or other illicit goods. Therefore, good information on travellers is a key tool for law enforcement authorities in the prevention of, detention, investigation and prosecution of terrorist offences and serious crime.
Advance Passenger Information (API) and Passenger Name Records (PNR) are two types of air passenger data, that, when combined, are particularly useful for identifying high-risk travellers and their travel patterns.
Under the current PNR Directive, air carriers are not obliged and do not have any commercial interest in collecting the full set of API data. Therefore, for the purposes of fighting terrorism and serious crime, this Regulation sets complementary and harmonised rules to collect and transfer API data and extends its application to the same flights, covered by the PNR directive, notably extra-EU flights and selected intra-EU flights.
Overall, the proposal for a regulation introduces:
1. provisions to collect API data by air carriers and streamline the transfer and transmission of API data by air carriers to national authorities through a single router, which will be managed by the EU Agency eu-LISA. It also sets the rules for the transmission of API data to the competent authorities, notably the Passenger Information Units (‘PIUs’), by the router.
2. a requirement to provide better quality API data, as air carriers will have “to collect API data by automated means only" putting an end to the laborious and, more importantly, error-prone experience of passengers who must manually type in travel document information between the purchase of tickets and check-in.
3. provisions on the protection of personal data, as well as security and self-monitoring by air carriers and PIUs.
4. requirements on supervision and possible penalties in case of non-compliance by air carriers.
The regulation also includes budgetary provisions that will finance the establishment and functioning of the router and the costs incurred by the Member States (with some exceptions) in relation to their connections to, and integration with, the router, under the Union budget.
Rapporteur’s position
The Rapporteur welcomes this streamlined and simpler method for air carriers to provide API data, especially through a centralised system. He also shares the view that digitalisation and automation can be an useful tool to mitigate errors and to allow for a better travel experience of legitimate travellers.
The Rapporteur also shares the need to ensure better quality API data for law enforcement, in full respect of personal data protection. However, this Regulation should avoid going to the detriment of the travel experience of the legitimate traveller. It should also allow authorities to estimate in advance the necessary control capacity at airports and should enable air carriers to process the information at the check-in in a more efficient and faster way. The Rapporteur believes that this legislation should facilitate people travelling, with reduced times at disembarkation. Therefore, the Rapporteur introduces a provision in Article 20, which imposes a requirement on the Commission to carry out an assessment on the impact of this Regulation on the travel experience of legitimate travellers.
The Rapporteur understands that in certain cases air carriers may need to keep logs for longer than for procedures for monitoring or ensuring the security and integrity of the API data or the lawfulness of the processing operations. However to avoid any missuse or abuse, the air carriers should inform and justify to the Commission the reason for keeping the logs longer.
The Rapporteur believes that the financial appropriation to the functioning of the router will determine its success, therefore the eu-LISA should be provided with the necessary resources. Moreover, eu-LISA should also provide training to air carriers and PIUs to facilitate the correct connection and integration to the router, and to effectively transfer and receive API data. To that effect, eu-LISA should develop the router to enable the air carriers’ systems to connect and transmit API data to the router in accordance with existing standard and technical requirements.
AMENDMENTS
The Committee on Transport and Tourism calls on the Committee on Civil Liberties, Justice and Home Affairs, as the committee responsible, to take the following into account:
Amendment 1
Proposal for a regulation
Recital 6 a (new)
| Text proposed by the Commission | Amendment |
| (6 a) This Regulation should be subject to regular evaluations to ensure the monitoring of its effective application. In particular, the collection of API data should not be to the detriment of the travel experience of legitimate travellers. Therefore, the Commission should include in its regular evaluation reports on the application of this Regulation an assessment of the impact of this Regulation on the travel experience of legitimate travellers. |
Amendment 2
Proposal for a regulation
Recital 6 b (new)
| Text proposed by the Commission | Amendment |
| (6 b) Given that this Regulation requires additional adjustment and administrative costs by the air carriers, the overall regulatory burden for the aviation sector should be kept under close review. Against this backdrop, the report evaluating the functioning of this Regulation should assess the extent to which the objectives of the Regulation have been met and to which extent it has impacted the competitiveness of the sector. Therefore, the Commission’s report should also conduct a holistic assessment and refer to the interaction of this Regulation with other relevant EU legislative acts, notably Regulation (EU) 2017/2226, Regulation (EU) 2018/1240 and Regulation (EC) 767/2008. The report should assess the overall impact of related reporting obligations on air carriers, identifying provisions that may be updated and simplified, where appropriate, to mitigate the burden on air carriers, as well as actions and measures that have been or could be taken to reduce the total cost pressure on the aviation sector |
Amendment 3
Proposal for a regulation
Recital 7
| Text proposed by the Commission | Amendment |
| (7) In view of the complementary nature of this Regulation in relation to Directive (EU) 2016/681, the obligations of air carriers under this Regulation should apply in respect of all flights for which Member States are to require air carriers to transmit PNR data under Directive (EU) 2016/681, namely flights, including both scheduled and non-scheduled flights, both between Member States and third countries (extra-EU flights), and between several Member States (intra-EU flights) insofar as those flights have been selected in accordance with Directive (EU) 2016/681, irrespective of the place of establishment of the air carriers conducting those flights. | (7) In view of the complementary nature of this Regulation in relation to Directive (EU) 2016/681, the obligations of air carriers under this Regulation should apply in respect of all flights for which Member States are to require air carriers to transmit PNR data under Directive (EU) 2016/681, namely flights, including both scheduled and non-scheduled flights, both between Member States and third countries (extra-EU flights), irrespective of the place of establishment of the air carriers conducting those flights. |
Amendment 4
Proposal for a regulation
Recital 10
| Text proposed by the Commission | Amendment |
| (10) In particular, the items of information that jointly constitute the API data to be collected and subsequently transferred under this Regulation should be those listed clearly and exhaustively in Regulation (EU) API [border management], covering both information relating to each passenger and information on the flight of that traveller. Under this Regulation, such flight information should cover information on the border crossing point of entry into the territory of the Member State concerned only where applicable, that is, not when the API data relate to intra-EU flights. | (10) In particular, the items of information that jointly constitute the API data to be collected and subsequently transferred under this Regulation should be those listed clearly and exhaustively in Regulation (EU) API [border management], covering both information relating to each passenger and information on the flight of that traveller. Under this Regulation, such flight information should cover information on the border crossing point of entry into the territory of the Member State concerned. |
Amendment 5
Proposal for a regulation
Recital 11
| Text proposed by the Commission | Amendment |
| (11) In order to ensure a consistent approach on the collection and transfer of API data by air carriers as much as possible, the rules set out in this Regulation should be aligned with those set out in the Regulation (EU) [API border management] where appropriate. That concerns, in particular, the rules on data quality, the air carriers’ use of automated means for such collection, the precise manner in which they are to transfer the collected API data to the router and the deletion of the API data. | (11) In order to ensure a consistent approach on the collection and transfer of API data by air carriers as much as possible, the rules set out in this Regulation should be aligned with those set out in the Regulation (EU) [API border management] where appropriate. That concerns, in particular, the rules on data quality, the air carriers’ use of automated means for such collection, the precise manner in which they are to transfer the collected API data to the router and the deletion of the API data. In order to reduce the impact on air carriers, and with a view to create synergies with other reporting obligations on air carriers in Regulation (EU) 2017/2226, Regulation (EU) 2018/1240 and Regulation (EC) 767/2008 and avoid duplication, air carriers should transfer the API data at the moment of check-in of each traveller by way of interactive API in accordance with international standards, using the existing carrier gateway. Air carriers should receive an acknowledgement of receipt to the transfer of interactive API, in line with international standards. |
Amendment 6
Proposal for a regulation
Recital 11 a (new)
| Text proposed by the Commission | Amendment |
| (11 a) The automatic data collection systems and other processes established under this Regulation should not negatively impact the employees in the aviation industry, who should benefit from upskilling and reskilling opportunities that would increase the efficiency and reliability of data collection and transfer as well as the working conditions in the sector. |
Amendment 7
Proposal for a regulation
Recital 11 b (new)
| Text proposed by the Commission | Amendment |
| (11 b) In order to enhance data quality, the router should verify whether the API data transferred to it by the air carriers complies with the supported data formats. Where the router has verified that the data is not compliant with the supported data formats, the router should, immediately and in an automated manner, notify the air carrier concerned. |
Amendment 8
Proposal for a regulation
Recital 12 a (new)
| Text proposed by the Commission | Amendment |
| (12 a) With a view to guaranteeing the fulfilment of the rights provided for under the Charter of Fundamental Rights and to ensuring accessible and inclusive travel options, especially for vulnerable groups and persons with disabilities, air carriers, supported by the Member States, shall ensure that an offline alternative for the check-in and for the provision of the necessary data by the passengers is possible at all times. |
Amendment 9
Proposal for a regulation
Recital 14
| Text proposed by the Commission | Amendment |
| (14) As regards intra-EU flights, in line with the case law of the Court of Justice of the European Union (CJEU), in order to avoid unduly interfering with the relevant fundamental rights protected under the Charter and to ensure compliance with the requirements of Union law on the free movement of persons and the abolition of internal border controls, a selective approach should be provided for. In view of the importance of ensuring that API data can be processed together with PNR data, that approach should be aligned with that of Directive (EU) 2016/681. For those reasons, API data on those flights should only be transmitted from the router to the relevant PIUs, where the Member States have selected the flights concerned in application of Article 2 of Directive (EU) 2016/681. As recalled by the CJEU, the selection entails Member States targeting the obligations in question only at, inter alia, certain routes, travel patterns or airports, subject to the regular review of that selection. | deleted |
Amendment 10
Proposal for a regulation
Recital 15
| Text proposed by the Commission | Amendment |
| (15) In order to enable the application of that selective approach under this Regulation in respect of intra-EU flights, the Member States should be required to draw up and submit to eu-LISA the lists of the flights they selected, so that eu-LISA can ensure that only for those flights API data is transmitted from the router to the relevant PIUs and that the API data on other intra-EU flights is immediately and permanently deleted. | deleted |
Amendment 11
Proposal for a regulation
Recital 16
| Text proposed by the Commission | Amendment |
| (16) In order not to endanger the effectiveness of the system that relies on the collection and transfer of API data set up by this Regulation, and of PNR data under the system set up by Directive (EU) 2016/681, for the purpose of preventing, detecting, investigating and prosecuting terrorist offences and serious crime, in particular by creating the risk of circumvention, information on which intra-EU flights the Member States selected should be treated in a confidential manner. For that reason, such information should not be shared with the air carriers and they should therefore be required to collect API data on all flights covered by this Regulation, including all intra-EU flights, and then transfer it to the router, where the necessary selection should be enacted. Moreover, by collecting API data on all intra-EU flights, passengers are not made aware on which selected intra-EU flights API data, and hence also PNR data, is transmitted to PIUs in accordance with Member States’ assessment. That approach also ensures that any changes relating to that selection can be implemented swiftly and effectively, without imposing any undue economic and operational burdens on the air carriers. | deleted |
Amendment 12
Proposal for a regulation
Recital 19
| Text proposed by the Commission | Amendment |
| (19) In view of the Union interests at stake, appropriate costs incurred by the Member States in relation to their connections to, and integration with, the router, as required under this Regulation, should be borne by the Union budget, in accordance with the applicable legislation and subject to certain exceptions. The costs covered by those exceptions should be borne by each Member State concerned itself. | (19) In view of the Union interests at stake, appropriate costs incurred by the Member States in relation to their connections to, and integration with, the router, as required under this Regulation, should be borne by the Union budget, in accordance with the applicable legislation and subject to certain exceptions. The costs covered by those exceptions should be borne by each Member State concerned itself. The Union budget should also cover the support, such as training, by eu-LISA to air carriers and PIUs to enable effective transfer and transmission of API data through the router. |
Amendment 13
Proposal for a regulation
Recital 23 a (new)
| Text proposed by the Commission | Amendment |
| (23 a) When providing for the penalties applicable to air carriers under this Regulation, Member States shall take into account the technical, operational and economic feasibility of ensuring complete data accuracy. Additionally, when fines are imposed, their application and value shall be established taking into consideration the actions undertaken by the air carrier to mitigate the issue as well as its repeated failure to cooperate with national authorities. |
Amendment 14
Proposal for a regulation
Recital 26 a (new)
| Text proposed by the Commission | Amendment |
| (26 a) With a view to ensuring increased data quality and accuracy, the setting up of travel document validation systems, able to automatically verify carrier-submitted passenger data, should be considered. |
Amendment 15
Proposal for a regulation
Article 1 – paragraph 1 – point a
| Text proposed by the Commission | Amendment |
| (a) the collection by air carriers of advance passenger information data (‘API data’) on extra EU flights and selected intra EU flights; | (a) the collection by air carriers of advance passenger information data (‘API data’) on extra EU flights. |
Amendment 16
Proposal for a regulation
Article 1 – paragraph 1 – point c
| Text proposed by the Commission | Amendment |
| (c) the transmission from the router to the Passenger Information Units (‘PIUs’) of the API data on extra-EU flights and selected intra-EU flights. | (c) the transmission from the router to the Passenger Information Units (‘PIUs’) of the API data on extra-EU flights. |
Amendment 17
Proposal for a regulation
Article 2 – paragraph 1
| Text proposed by the Commission | Amendment |
| This Regulation applies to air carriers conducting scheduled or non-scheduled extra-EU flights or intra-EU flights. | This Regulation applies to air carriers conducting scheduled or non-scheduled extra-EU flights |
Amendment 18
Proposal for a regulation
Article 3 – paragraph 1 – point c
| Text proposed by the Commission | Amendment |
| (c) ‘intra-EU flight’ means any flight as defined in Article 3, point (3), of Directive (EU) 2016/681; | deleted |
Amendment 19
Proposal for a regulation
Article 3 – paragraph 1 – point h
| Text proposed by the Commission | Amendment |
| (h) ‘traveller’ means any person as defined in Article 3, point (i), of Regulation (EU) [API border management]; | (h) ‘traveller’ means any person as defined in Article 3, point (j), of Regulation (EU) [API border management]; |
Amendment 20
Proposal for a regulation
Article 3 – paragraph 1 – point n
| Text proposed by the Commission | Amendment |
| (n) ‘the router’ means the router as defined in Article 3, point (k) of Regulation (EU) [API border management]; | (n) ‘the router’ means the router as defined in Article 3, point (m) of Regulation (EU) [API border management]; |
Amendment 21
Proposal for a regulation
Article 4 – paragraph 3 – subparagraph 1
| Text proposed by the Commission | Amendment |
| Air carriers shall collect the API data referred to Article 4(2), points (a) to (d), of Regulation (EU) [API border management] using automated means to collect the machine-readable data of the travel document of the traveller concerned. They shall do so in accordance with the detailed technical requirements and operational rules referred paragraph 5, where such rules have been adopted and are applicable. | Air carriers shall collect the API data referred to Article 4(2), points (a) to (d), of Regulation (EU) [API border management] using automated means to collect the machine-readable data of the travel document of the traveller concerned. They shall do so in accordance with the detailed technical requirements and operational rules referred to in paragraph 5, where such rules have been adopted and are applicable. |
Amendment 22
Proposal for a regulation
Article 4 – paragraph 7
| Text proposed by the Commission | Amendment |
| 7. Air carriers shall transfer the API data both at the moment of check-in and immediately after flight closure, that is, once the travellers have boarded the aircraft in preparation for departure and it is no longer possible for travellers to board or to leave the aircraft. | 7. Air carriers shall transfer the API data both at the moment of check-in and immediately after flight closure, that is, once the travellers have boarded the aircraft in preparation for departure and it is no longer possible for travellers to board or to leave the aircraft. At the moment of check-in, air carriers shall transfer the API data by way of interactive API in accordance with international standards. Air carriers shall receive an acknowledgement of receipt to the transfer of interactive API, as applicable, depending on the flight in scope. |
Amendment 23
Proposal for a regulation
Article 4 – paragraph 7 a (new)
| Text proposed by the Commission | Amendment |
| 7 a. The router shall verify whether the API data transferred to it in accordance with paragraph 6 complies with the detailed rules on the supported data formats. Where the router has verified that the data is not compliant with the detailed rules, the router shall, immediately and in an automated manner, notify the air carrier concerned. |
Amendment 24
Proposal for a regulation
Article 4 – paragraph 9
| Text proposed by the Commission | Amendment |
| 9. The Commission is empowered to adopt delegated acts in accordance with Article 19 to supplement this Regulation by laying down the necessary detailed rules on the common protocols and supported data formats to be used for the transfers of API data to the router referred to in paragraph 6. | 9. The Commission is empowered to adopt delegated acts in accordance with Article 19 to supplement this Regulation by laying down the necessary detailed rules on the common protocols and supported data formats to be used for the transfers of API data to the router referred to in paragraph 6 including the use of interactive API for the transfer of API data at the moment of check-in. |
Amendment 25
Proposal for a regulation
Article 5 – paragraph 1 – subparagraph 1
| Text proposed by the Commission | Amendment |
| The router shall, immediately and in an automated manner, transmit the API data, transferred to it by air carriers pursuant to Article 4, to the PIUs of the Member State on the territory of which the flight will land or from the territory of which the flight will depart, or to both in the case of intra-EU-flights. Where a flight has one or more stop-overs at the territory of other Member States than the one from which it departed, the router shall transmit the API data to the PIUs of all the Member States concerned. | The router shall, immediately and in an automated manner, transmit the API data, transferred to it by air carriers pursuant to Article 4, to the PIUs of the Member State on the territory of which the flight will land or from the territory of which the flight will depart. Where a flight has one or more stop-overs at the territory of other Member States than the one from which it departed, the router shall transmit the API data to the PIUs of all the Member States concerned. |
Amendment 26
Proposal for a regulation
Article 5 – paragraph 1 – subparagraph 3
| Text proposed by the Commission | Amendment |
| However, for intra-EU flights, the router shall only transmit the API data to that PIU in respect of the flights included in the list referred to in paragraph 2. | deleted |
Amendment 27
Proposal for a regulation
Article 5 – paragraph 2
| Text proposed by the Commission | Amendment |
| 2. Member States that decide to apply Directive (EU) 2016/681 to intra-EU flights in accordance with Article 2 of that Directive shall each establish a list of the intra-EU flights concerned and shall, by the date of application of this Regulation referred to in Article 21, second subparagraph, provide eu-LISA with that list. Those Member States shall, in accordance with Article 2 of that Directive, regularly review and where necessary update those lists and shall immediately provide eu-LISA with any such updated lists. The information contained on those lists shall be treated confidentially. | deleted |
Amendment 28
Proposal for a regulation
Article 6 – paragraph 4 – subparagraph 2
| Text proposed by the Commission | Amendment |
| However, if those logs are needed for procedures for monitoring or ensuring the security and integrity of the API data or the lawfulness of the processing operations, as referred to in paragraph 2, and those procedures have already begun at the moment of the expiry of the time period referred to in the first subparagraph, air carriers may keep those logs for as long as necessary for those procedures. In that case, they shall immediately delete those logs when they are no longer necessary for those procedures. | However, if those logs are needed for procedures for monitoring or ensuring the security and integrity of the API data or the lawfulness of the processing operations, as referred to in paragraph 2, and those procedures have already begun at the moment of the expiry of the time period referred to in the first subparagraph, air carriers may keep those logs for as long as necessary for those procedures after informing and justifying it to the Commission. In that case, they shall immediately delete those logs when they are no longer necessary for those procedures. |
Amendment 29
Proposal for a regulation
Article 11 a (new)
| Text proposed by the Commission | Amendment |
| Article 11 a | |
| eu-LISA's support tasks relating to the router | |
| eu-LISA shall, upon their request, provide support to competent border authorities, PIUs and other relevant Member States’ authorities and air carriers on the connection and integration to the router. |
Amendment 30
Proposal for a regulation
Article 20 – paragraph 1 – point c a (new)
| Text proposed by the Commission | Amendment |
| (c a) the impact of this Regulation on the travel experience of legitimate travellers; |
Amendment 31
Proposal for a regulation
Article 20 – paragraph 1 – point c b (new)
| Text proposed by the Commission | Amendment |
| (c b) the impact of this Regulation on the competitiveness of the aviation sector and the burden incurred by businesses. The Commission’s report shall also address this Regulation’s interaction with other relevant EU legislative acts, notably Regulation (EU) 2017/2226, Regulation (EU) 2018/1240 and Regulation (EC) 767/2008, with a view to assess the overall impact of related reporting obligations on air carriers, identify provisions that may be updated and simplified, where appropriate, to mitigate the burden on air carriers, and consider actions and measures that could be taken to reduce the total cost pressure on air carriers. |