Sittings · Document
On the proposal for a regulation of the European Parliament and of the Council on the collection and transfer of advance passenger information (API) for enhancing and facilitating external border controls, amending Regulation (EU) 2019/817 and Regulation (EU) 2018/1726, and repealing Council Directive 2004/82/EC
Committee on Transport and Tourism · Rapporteur: JanChristoph Oetjen
SHORT JUSTIFICATION
This Regulation updates and replaces Directive 2004/82/EC, the existing legal framework on API data that facilitates external border controls, combats illegal immigration and increases internal security.
Whereas Directive 2004/82/EC has proven effective in improving boarder controls, its divergent application at national level has created inconsistencies. Inconsistencies that are takled by the new rules set by the proposed Regulation.
More specifically, this Regulation introduces:
1 provisions for the collection and tranfer of API data by air carriers to the router, the rule for the processing of API data by competent authorities and the storage and deletion of API data by both air carriers and competent authorities;
2 the establishement of a single point of reception and onward distribution of data, the router, which will be managed by an EU Agency, eu-LISA, the rules on the use of the router, on the deletion of the API data from the router and the procedure in case of a partial or full technical impossibility to use the router;
3 provisions on the protection of personal data, as well as security and self-monitoring by air carriers and competent authorities;
4 rules and conditions on the the possibility of an initial voluntary use of the router by air carriers, before its compulsory application;
5 requirements on supervision and possible penalties in case of non-compliance by air carriers.
This Regulation also includes budgetary provisions that will finance the establishment and functioning of the router and the costs incurred by the Member States (with some exceptions) in relation to their connections to and integration with the router, under the Union budget.
Rapporteur’s position
The Rapporteur welcomes this streamlined and simpler method for air carriers to provide API data, especially through a centralised system. He also shares the view that digitalisation and automation can be a useful tool to mitigate errors and to allow for a better travel experience for legitimate travellers.
The Rapporteur also shares the need to ensure better quality API data for law enforcement, in full respect of personal data protection. However, this Regulation should avoid going to the detriment of the travel experience of the legitimate traveller. It should also allow authorities to estimate in advance the necessary control capacity at airports and should enable air carriers to process the information at the check-in in a more efficient and faster way. The Rapporteur believes that this legislation should facilitate people travelling, with reduced times at disembarkation and at the physical border checks. Therefore, the Rapporteur introduces a provision in Article 8(1) that allows for the use of API data by air carriers for travel facilitation, in compliance with the General Data Protection Regulation. The Rapporteur also introduces a provision in Article 38, which imposes a requirement on the Commission to carry out an assessment on the impact of this Regulation on the travel experience of travellers.
The Rapporteur understands that in certain cases air carriers may need to keep logs for longer than for procedures for monitoring or ensuring the security and integrity of the API data or the lawfulness of the processing operations. However to avoid any missuse or abuse, the air carriers should inform and justify to the Commission the reason for keeping the logs longer.
The Rapporteur believes that the financial appropriation to the functioning of the router will determine its success, therefore eu-LISA should be provided with the necessary resources under the Union budget.
AMENDMENT
The Committee on Transport and Tourism calls on the Committee on Civil Liberties, Justice and Home Affairs, as the committee responsible, to take the following into account:
Amendment 1
Proposal for a regulation
Recital 15 a (new)
| Text proposed by the Commission | Amendment |
| (15 a) This Regulation should be subject to regular evaluations to ensure the monitoring of its effective application. In particular, the collection of API data should not be to the detriment of the travel experience of legitimate travellers. Therefore, the Commission should include in its regular evaluation reports on the application of this Regulation an assessment of the impact of this Regulation on the travel experience of legitimate travellers. |
Or. en
Amendment 2
Proposal for a regulation
Recital 16
| Text proposed by the Commission | Amendment |
| (16) To ensure that competent border authorities have sufficient time to carry out pre-checks effectively on all travellers, including travellers on long-haul flights and those travelling on connecting flights, as well as sufficient time to ensure that the API data collected and transferred by the air carriers is complete, accurate and up-to-date, and where necessary to request additional clarifications, corrections or completions from the air carriers, the competent border authorities should store the API data that they received under this Regulation for a fixed time period that remains limited to what is strictly necessary for those purposes. Similarly, to be able to respond to such requests, air carriers should store the API data that they transferred under this Regulation for the same fixed and strictly necessary time period. | (16) To ensure that competent border authorities have sufficient time to carry out pre-checks effectively on all travellers, including travellers on long-haul flights and those travelling on connecting flights, as well as sufficient time to ensure that the API data collected and transferred by the air carriers is complete, accurate and up-to-date, and where necessary to request additional clarifications, corrections or completions from the air carriers, the competent border authorities should store the API data that they received under this Regulation for a fixed time period that remains limited to what is strictly necessary for those purposes. Similarly, to be able to respond to such requests, air carriers should store the API data that they transferred under this Regulation for the same fixed and strictly necessary time period. Beyond that, and with a view to enhance the travel experience of legitimate travellers, air carriers should be able to retain and use the API data where necessary for the normal course of their business in particular for travel facilitation, in compliance with the applicable law and in particular Regulation (EU) 2016/679. |
Or. en
Amendment 3
Proposal for a regulation
Recital 22
| Text proposed by the Commission | Amendment |
| (22) The router to be created and operated under this Regulation should reduce and simplify the technical connections needed to transfer API data, limiting them to a single connection per air carrier and per competent border authority. Therefore, this Regulation provides for the obligation for the competent border authorities and air carriers to each establish such a connection to, and achieve the required integration with, the router, so as to ensure that the system for transferring API data established by this Regulation can function properly. To give effect to those obligations and to ensure the proper functioning of the system set up by this Regulation, they should be supplemented by detailed rules. | (22) The router to be created and operated under this Regulation should reduce and simplify the technical connections needed to transfer API data, limiting them to a single connection per air carrier and per competent border authority. Therefore, this Regulation provides for the obligation for the competent border authorities and air carriers to each establish such a connection to, and achieve the required integration with, the router, so as to ensure that the system for transferring API data established by this Regulation can function properly. The design and development of the router by eu-LISA should enable the effective and efficient connection and integration of air carriers’ systems and infrastructure by providing for all relevant standards and technical requirements. To give effect to those obligations and to ensure the proper functioning of the system set up by this Regulation, they should be supplemented by detailed rules. |
Or. en
Amendment 4
Proposal for a regulation
Recital 23
| Text proposed by the Commission | Amendment |
| (23) In view of the Union interests at stake, the costs incurred by eu-LISA for the performance of its tasks under this Regulation and Regulation (EU) [API law enforcement] in respect of the router should be borne by the Union budget. The same should go for appropriate costs incurred by the Member States in relation to their connections to, and integration with, the router, as required under this Regulation and in accordance with the applicable legislation, subject to certain exceptions. The costs covered by those exceptions should be borne by each Member State concerned itself. | (23) In view of the Union interests at stake, the costs incurred by eu-LISA for the performance of its tasks under this Regulation and Regulation (EU) [API law enforcement] in respect of the router should be borne by the Union budget. The same should go for appropriate costs incurred by the Member States in relation to their connections to, and integration with, the router, as required under this Regulation and in accordance with the applicable legislation, subject to certain exceptions. The costs covered by those exceptions should be borne by each Member State concerned itself. The Union budget should also cover the support, such as training, provided by eu-LISA to air carriers and PIUs to enable the effective transfer and transmission of API data through the router. |
Or. en
Amendment 5
Proposal for a regulation
Article 8 – paragraph 1
| Text proposed by the Commission | Amendment |
| 1. Air carriers shall store, for a time period of 48 hours from the moment of departure of the flight, the API data relating to that passenger that they collected pursuant to Article 4. They shall immediately and permanently delete that API data after the expiry of that time period. | 1. Air carriers shall store, for a time period of 48 hours from the moment of departure of the flight, the API data relating to that passenger that they collected pursuant to Article 4. They shall immediately and permanently delete that API data after the expiry of that time period. This is without prejudice to the possibility for air carriers to retain and use the data where necessary for the normal course of their business in particular for travel facilitation, in compliance with the applicable law and in particular Regulation (EU) 2016/679. |
Or. en
Amendment 6
Proposal for a regulation
Article 13 – paragraph 5 – subparagraph 2
| Text proposed by the Commission | Amendment |
| However, if those logs are needed for procedures for monitoring or ensuring the security and integrity of the API data or the lawfulness of the processing operations, as referred to in paragraph 2, and these procedures have already begun at the moment of the expiry of the time period referred to in the first subparagraph, eu-LISA and the air carriers may keep those logs for as long as necessary for those procedures. In that case, they shall immediately delete those logs when they are no longer necessary for those procedures. | However, if those logs are needed for procedures for monitoring or ensuring the security and integrity of the API data or the lawfulness of the processing operations, as referred to in paragraph 2, and these procedures have already begun at the moment of the expiry of the time period referred to in the first subparagraph, eu-LISA and the air carriers may keep those logs for as long as necessary for those procedures after informing and justifying it to the Commission. In that case, they shall immediately delete those logs when they are no longer necessary for those procedures. |
Or. en
Amendment 7
Proposal for a regulation
Article 24 – paragraph 1
| Text proposed by the Commission | Amendment |
| 1. eu-LISA shall, upon their request, provide training to competent border authorities, PIUs and other relevant Member States’ authorities and air carriers on the technical use of the router. | 1. eu-LISA shall, upon their request, provide training to competent border authorities, PIUs and other relevant Member States’ authorities and air carriers on the technical use of the router. and on the connection and integration to the router. |
Or. en
Amendment 8
Proposal for a regulation
Article 25 – paragraph 1
| Text proposed by the Commission | Amendment |
| 1. Costs incurred by eu-LISA in relation to the design, development, hosting and technical management of the router under this Regulation and Regulation (EU) [API law enforcement] shall be borne by the general budget of the Union. | 1. Costs incurred by eu-LISA in relation to the design, development, hosting and technical management of the router under this Regulation and Regulation (EU) [API law enforcement] shall be borne by the general budget of the Union. In view of the Union interests at stake, in relation to its responsibilities for the design, development, hosting and technical management and maintenance of the router, eu-LISA shall be provided with the necessary resources under the Union budget in accordance with the applicable legislation. |
Or. en
Amendment 9
Proposal for a regulation
Article 28 – title
| Text proposed by the Commission | Amendment |
| Voluntary use of the router in application of Directive 2004/81/EC | Voluntary use of the router in application of Directive 2004/82/EC |
Or. en
Amendment 10
Proposal for a regulation
Article 38 – paragraph 2
| Text proposed by the Commission | Amendment |
| 2. By [one year after the date of entry into force of this Regulation] and every year thereafter during the development phase of the router, eu-LISA shall produce a report, and submit it to the European Parliament and to the Council on the state of play of the development of the router. That report shall contain detailed information about the costs incurred and about any risks which may impact the overall costs to be borne by the general budget of the Union in accordance with Article 25. | 2. By [one year after the date of entry into force of this Regulation] and every year thereafter during the development phase of the router, eu-LISA shall produce a report, and submit it to the European Parliament and to the Council on the state of play of the development of the router. That report shall contain detailed information about the costs incurred and about any risks which may impact the overall costs to be borne by the general budget of the Union in accordance with Article 25. From the date at which the router starts operations and every years thereafter, the Commission shall assess whether the budget under the MFF budget line 4.11.10.02 (“eu-LISA”) covers the needs necessary for good design, development, hosting and technical management of the router and, if appropriate, immediately propose amendment to the budget appropriations. |
Or. en
Amendment 11
Proposal for a regulation
Article 38 – paragraph 4 – point c a (new)
| Text proposed by the Commission | Amendment |
| (c a) the impact of this Regulation on the travel experience of legitimate travellers. |
Or. en