EDPS Opinion 03/2025 on the Proposal for a Regulation on a progressive start of operations of the Entry/Exit system

10 March 2025

Opinion 03/2025

on the Proposal for a Regulation on a progressive start of operations of the Entry/Exit System

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years.

Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council on a temporary derogation from certain provisions of Regulation (EU) 2017/2226 and Regulation (EU) 2016/399 as regards a progressive start of operations of the Entry/Exit System.

This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

1

Executive Summary

On 4 December 2024, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council on a temporary derogation from certain provisions of Regulation (EU) 2017/2226 (EES Regulation) and Regulation (EU) 2016/399 (Schengen Borders Code) as regards a progressive start of operations of the Entry/Exit System.

The objective of the Proposal is to facilitate the operationalisation of the EES Regulation, thereby enabling Member States to achieve the system’s objectives in a timely and efficient manner. The specific objectives of the Proposal are to provide flexibility to Member States to start using the EES according to their level of readiness; to facilitate technical and operational adjustments during the first period of the EES operations by allowing the system to be gradually deployed; to better manage and avoid potential long waiting times at the external borders; to enable national authorities, travellers and carriers to adjust to the new border management processes and technologies; and others.

The EDPS considers that the Proposal raises concerns from the data protection perspective in relation to the accuracy of personal data processed. In particular, the personal data of the third country nationals crossing the external borders, registered in the EES during the period of the progressive start may be incomplete, and that fact may lead to potential negative consequences for them. Therefore, the EDPS underlines the need for the Proposal to lay down appropriate safeguards and that the Proposal should particularly clarify in its Article 6 that decisions that could adversely affect individuals may not be taken solely on the basis that a registration of an alleged entry or exit is absent in the EES. The EDPS also recommends to extend the suspension of certain provisions of the EES Regulation provided for under Article 5(12) of the Proposal to Article 11 of the EES Regulation as regards the automated calculator providing information on the maximum duration of the authorised stay and to Article 12(3) EES Regulation as regards the automatically generated list of overstayers. Moreover, for legal certainty, this suspension should apply until the end of the progressive start of operations.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 4 December 2024, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council on a temporary derogation from certain 2 3 provisions of Regulation (EU) 2017/2226 and Regulation (EU) 2016/399 as regards a progressive start of operations of the Entry/Exit System (‘the Proposal’).

2. The general objective of the Proposal is to facilitate the operationalisation of the EES Regulation, thereby enabling Member States to achieve the system’s objectives in a timely and efficient manner. The specific objectives of the Proposal are, among others, to provide flexibility to Member States to start using the EES according to their level of readiness; to facilitate technical and operational adjustments during the first period of the EES operations by allowing the system to be gradually deployed; to better manage and avoid potential long waiting times at the external borders; to enable national authorities, travellers and carriers to adjust to the new border management processes and technologies; and others .

3. One of the main reasons for the envisaged derogations from EES Regulation and Schengen Borders Code is the fact it is not possible to launch the EES in Q4 2024 as initially planned due to delays in the preparations of certain Member States. Moreover, the proposed progressive start of operations of the EES is considered preferrable compared to a full start of operations overnight as the latter constitutes a risk factor for the resilience of a complex IT system, such as the EES Central System .

4. In addition, it should be noted that the progressive start of the EES operations will have an impact on the application of the Visa Information System (VIS) and the future European Travel Information and Authorisation System (ETIAS), as well as with the future interoperability components being developed by eu-LISA, namely the European Search Portal, the shared Biometric Matching Service, the Common Identity Repository and the Multiple-Identity Detector .

5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 13 January 2025, pursuant to Article 42(1) of EUDPR, which is specifically referred in Recital 34 of the Proposal.

2. General remarks

6. The EDPS positively notes that the Proposal does not envisage or entail any derogations from the applicable data protection framework, namely Regulation (EU) 2016/679 (GDPR) . He also welcomes that it does not change the current access rules to the EES, and the necessary safeguards set out in the EES Regulation, including the right to information .

7. At the same time, the EDPS recalls the principle of accuracy under Article 5(1)(d) GDPR, more specifically in the context of the expected incompleteness of the data of the third country nationals crossing the external borders, being registered and further processed in the EES during progressive start of operations of the system. For the reasons explained in the following section of this Opinion, the potential processing of incomplete data would not seem consistent with the principle of accuracy.

8. The EDPS notes with regret that the Proposal is not accompanied by a proper Impact Assessment. Even if the Explanatory Memorandum to the Proposal provides a generally clear and convincing arguments is support of the proposed change in the approach as regards the EES start of operations, the potential impact on the third country nationals crossing the external borders, on the one hand, and on a number of other IT systems linked to the EES through the interoperabilty framework deserve a more detailed assessment.

9. This being said, the EDPS considers that the Proposal raise concerns from data protection perspective in relation to the accuracy of the personal data processed in the EES. In this regard, the EDPS recommends specific safeguards to protect individuals from potential adverse consequences of the processing of incomplete personal data. He also highlights certain aspects of the Proposal that require further clarification, as well as particular attention during the implementation phase.

3. Incompleteness of the data recorded in the EES

10. The EDPS notes that one of the practical consequences of the progressive start of operations of the EES is that the personal data of the third country nationals crossing the external borders registered in the EES during this period may be incomplete and that may lead to potential negative consequences for them. To prevent such consequences, the legislator has provided for the data protection principle of accuracy in Article 5(1)(d) GDPR, whereby the notion of adequacy includes both factual correctness and the need for data to be comprehensive enough for the intended purpose.

11. The EDPS positively notes that the Proposal explictly acknowledges and addresses the possibility of such situations in Recitals 20-22 and in Article 6. He also recalls that one of the specific objectives of the Proposal is to “improve the current situation by ensuring that end users, such as border guards, immigration officials, visa authorities and law enforcement officers, have access to the most up-to-date information on travellers’ identities even if the data recorded in the system is incomplete due to the progressive deployment of the EES” .

12. At the same time, the envisaged measures to mitigate the potential negative impacts of the possible incompleteness of the data recorded in the EES appear to be very general, namely a call to the concerned national authorities and the relevant Union agencies to “take into account” that fact. The only exception is the provision of Article 6(5) of the Proposal, which explicitly restricts during the progressive start of the EES operations the access of the authorised staff of the European Border and Coast Guard Agency to the data registered in the EES for the purpose of carrying out risk analyses and vulnerability assessments.

13. The EDPS notes that the Proposal does not provide any justification why access to EES data during the progressive start of operations for operational purposes by authorities listed under Article 6(1) should be allowed, whereas access to EES data for strategic analysis by Frontex is not allowed. Given the negative impact that the use of incomplete EES data for operational purposes could have on the rights of data subjects, if access by the authorities listed under Article 6(1) is nevertheless granted, the Proposal should lay down specific guarantees for the data subjects that their rights will not be adversely affected by the processing of incomplete data.

14. The EDPS therefore considers that the enacting terms of the Proposal should be more precise as to the actual meaning of the requirement in Article 6, imposed upon relevant authorities granted access to EES data, during the progressive start of operations – “to take into account” that such data could be incomplete – and provide for specific safeguards to protect individuals from potential adverse consequences of the processing of incomplete personal data. In particular, the Proposal should clarify that decisions that could adversely affect individuals may not be taken solely on the basis that a registration of an alleged entry or exit is absent in the EES. The EDPS stresses that it is a consequence of the fairness principle of the GDPR that the systemic, potentially incomplete filling of the EES must not be to the detriment of the data subject.

15. In addition to the legal safeguards, the EDPS encourages the Commission to provide further practical guidance to the relevant national authority and Union agencies as regards the use of the data registered in the EES during the progressive start of operations of the EES. If feasible, such guidance could also be included in the Practical handbook for the implementation and management of the EES, which the Commission is obliged to prepare pursuant to Article 71 of EES Regulation.

4. Automatic calculator and automatically generated list of overstayers

16. The EDPS notes that according to Article 5(6) of the Proposal, the national authorities and Europol must “disregard” the results of (a) the automated calculator that provides information on the maximum duration of the authorised stay referred to in Article 11 of the EES Regulation and (b) the automatically generated list of overstayers and its consequences referred to in Article 12(3) and other provisions of the EES Regulation. Recital 10 of the Proposal clarifies the rationale for this provision by recalling that "data registered in the EES during the progressive start of operations might be incomplete". Consequently, the results of the automated calculator and the automatically generated list cannot be considered accurate and reliable.

17. As the national authorities and Europol would be obliged to disregard the results of the automated calculator and the automatically generated list, processing of personal data through these tools during the progressive start of the operations does not seem necessary and proportionate. Also, it is not clear how compliance with the obligation to disregard the results of data processing through these tools would be effectively monitored in practice.

18. At the same time, the EDPS notes Article 5(12) of the Proposal provides for the suspension of Article 12(1) and (2) EES Regulation, which refers to a mechanism automatically detecting potential overstaying by identifying which entry/exit records do not have exit data immediately following the time of expiry of authorised stay and for which the maximum duration of authorised stay has been exceeded. However, Article 5(12) of the Proposal does not provide for a suspension of Article 12(3) of the EES Regulation, which refers specifically to the automatically generated list of overstayers.

19. The EDPS notes that it is not clear from the explanatory memorandum and the recitals whether the mechanism automatically detecting potential overstaying by identifying which entry/exit records do not have exit data is a prerequisite for creating the list of overstayers and whether the suspension of Article 12(1) and (2) of the EES Regulation would therefore automatically render the application of paragraph 3 of the same article practically impossible. Article 5(6) of the Proposal, according to which the national authorities and Europol must “disregard” the results of the automated calculator and the automatically generated list of overstayers, seems to suggest that Article 12(3) of the EES Regulation is meant to remain executable. The EDPS sees no justification for not suspending Article 12(3) of the EES Regulation. If the results of the processing may not be used due to the incompleteness of the data, then the preferred solution should be not to carry out (suspend) the processing in the first place, or at least to suppress displaying the results. In this specific context, the technical safeguards seem to be more effective in comparison with organisational measures, such as instructions to “disregard” the results. Moreover, the latter would more difficult to monitor than the former.

20. Therefore, for the reason explained above, the EDPS considers that the suspension provided for under Article 5(12) of the Proposal should be extended and apply also to 7 Article 11 of the EES Regulation as regards the automated calculator providing information on the maximum duration of the authorised stay and to Article 12(3) EES Regulation as regards the automatically generated list of overstayers and its consequences. Furthermore, for legal clarity, the Proposal should specify that the suspension shall apply until the end of the progressive start of operations.

5. Information campaign

21. The EDPS recalls that pursuant to Article 51 of the EES Regulation, the Commission, in cooperation with the national supervisory authorities and the EDPS, should accompany the start of operations of the EES with an information campaign informing the public and, in particular, third-country nationals.

22. The EDPS positively notes that pursuant to Article 5(11) of the Proposal, the information campaign will be updated to reflect the specific conditions stemming from the envisaged progressive start of the EES operations. In this context, the EDPS considers that the requirement for cooperation with the supervisory authorities referred in Article 51 of the EES Regulation applies to the additional information activities, too.

6. Conclusions

23. In light of the above, the EDPS makes the following recommendations: (1) to provide for specific safeguards to protect individuals from potential adverse consequences of the processing of incomplete personal data, in particular by clarifying in Article 6 of the Proposal that decisions that could adversely affect individuals may not be taken solely on the basis that a registration of an alleged entry or exit is absent in the EES during the progressive start of operations. (2) to extend the suspension provided for under Article 5(12) of the Proposal also to Article 11 of EES Regulation as regards the automated calculator providing information on the maximum duration of the authorised stay and to Article 12(3) EES Regulation as regards the automatically generated list of overstayers and its consequences. (4) to carry out the update of the information campaign as regards the specific conditions stemming from the progressive start of the EES operations in cooperation with the national supervisory authorities and EDPS, in line with Article 51 of EES Regulation. Brussels, 10 March 2025 (e-signed) Wojciech Rafał WIEWIÓROWSKI 8