Proposal for a Regulation on the digitalisation of the visa procedure

21 June 2022 Opinion 13/2022

on the Proposal for a Regulation on the digitalisation of the visa procedure

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to a Proposal for a Regulation of the European Parliament and of the Council amending Regulations (EC) No 767/2008, (EC) No 810/2009 and (EU) 2017/2226 of the European Parliament and of the Council, Council Regulations (EC) No 1683/95, (EC) No 333/2002, (EC) No 693/2003 and (EC) No 694/2003 and Convention implementing the Schengen Agreement, as regards the digitalisation of the visa procedure. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the draft Proposal that are relevant from a data protection perspective.

1

Executive Summary

On 27 April 2022, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council on the digitalisation of the visa procedure. The Proposal aims at introducing the possibility to submit visa applications online through the European digital visa application platform, and replacing the visa sticker with a digital visa. By doing so, the visa application procedures within the Schengen area should be simplified and harmonised, and security risks posed by the physical visa stickers would be reduced.

The EDPS recognises that the digitalisation of the visa processing has the potential to address a number of challenges faced by visa applicants and consulates. However, the mandatory nature of the new procedure may also create additional obstacles to visa applicants, for instance, due to IT illiteracy or lack of adequate equipment. The EDPS recommends including in the Proposal an explicit provision that would exempt individuals with accessibility issues from using the European digital visa application platform.

The EDPS takes note that the Proposal adds, among the personal data to be included in the visa application, the IP addresses from which application forms are submitted. In this regard, the EDPS recalls the principle of data minimisation, which should lead the Commission to assess whether the collection of IP addresses is needed for the purposes of the Proposal.

The EDPS also recalls the importance of providing to the data subjects information about the processing of their personal data, to ensure fair processing. Consequently, since the personal data for VIS shall be first collected in the European online visa platform, the EDPS is of the opinion that information about the processing of personal data in the context of VIS, in line with Article 37(1) of the VIS Regulation, should also be provided by the platform. Besides, in view of the operationalisation of interoperability and the consequent processing of personal data for multiple purposes, the right to information should not be limited to providing information about the purposes for which the data will be processed within the VIS. It should also provide information about the processing that takes place in all the other JHA large-scale database systems and interoperability components falling within the scope of the interoperability framework.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 27 April 2022 the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council amending Regulations (EC) No 767/2008 , (EC) No 2 3 810/2009 and (EU) 2017/2226 of the European Parliament and of the Council , Council 4 5 6 7 Regulations (EC) No 1683/95 , (EC) No 333/2002 , (EC) No 693/2003 and (EC) No 694/2003 and Convention implementing the Schengen Agreement , as regards the digitalisation of the visa procedure (‘the Proposal’).

2. The Proposal aims to streamline and harmonise the procedures in the context of the common visa policy and align travel, entry requirements and border checks within the Schengen area through digitalisation and the interoperability framework at the borders. To this end, the Proposal would replace the paper visa sticker with a digital visa and introduce a mandatory online European digital visa application form.

3. The Estonian Council Presidency began the discussion on the introduction of an online visa 10 11 application and a digital visa back in 2017. In 2018, the European Commission took up the debate on the digitalisation of the visa processing and announced in its Communication on visa policy the launch of feasibilities studies and pilot projects that would have laid down the ground for future proposals . The New Pact on Migration and Asylum set the objective of making the visa procedure fully digitalised by 2025, with a digital visa and the ability to submit visa applications online .

4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 28 April 2022, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 47 of the Proposal.

2. General remarks

5. The proposal aims at digitalising two steps of the visa procedure: the visa application process and the issuing of the visa. The EDPS observes that, between the two, the former has the greatest impact from a data protection point of view due to the introduction of an EU digital visa application platform. Therefore, this Opinion will focus on this aspect of the Proposal.

6. The EDPS recognises that the digitalisation of the visa processing has the potential to address a number of challenges faced by visa applicants and consulates. However, while technological developments bring new opportunities, they may also create additional obstacles to visa applicants, for instance, due to IT illiteracy or lack of adequate equipment. They also raise broader questions about data protection and privacy rights especially taking into account the use of large-scale database systems and artificial intelligence, in the broader context of migration and border management.

7. The EDPS has underlined in several occasions, including in the context of the EU visa policy that biometric data, such as fingerprints and facial images are considered as one of the special categories of personal data and are subject to special protection. Their collection must take place in a controlled environment. This is even more imperative when it concerns personal data of children from the age of six, as foreseen by the reviewed Regulation (EC) No 810/2009 (VIS Regulation), recently entered into force. Thus, the EDPS welcomes the fact that applicants will need to present themselves in front of the consulate or visa application centre to provide fingerprints and facial images, including when travelling with children. Nevertheless, the EDPS wishes to observe that, the observation attributed to the EDPS and reported in the Explanatory Memorandum have been taken out of context and do not constitute the official position of the EDPS, which is expressed in this Opinion.

8. The EDPS also welcomes the fact that the system will pre-check and will notify the applicant if information is missing and that it will provide the applicant with the possibility of correcting the application.

9. Finally, the EDPS notes positively the reference to the free and explicit consent of the applicants to the storage of their data in a secure account service of the European digital visa application platform.

10. Against this background, the EDPS will focus in this opinion on the following issues: a. the necessity and proportionality of the envisaged measures, in particular with regard to: the mandatory use of the EU digital visa application platform and the categories of data processed therein; b. the integrity and confidentiality of the personal data processed, including: the access and use to data for each authority concerned, the accuracy of the personal data processed, the attribution of the roles and responsibilities, as well as security considerations; and c. the rights of the data subjects with regard to the right to information. 5

3. Mandatory use of the EU digital visa application platform

11. The Proposal would amend Article 9 of Regulation (EC) No 810/2009 (The Visa Code) to introduce the obligation to apply for short-stay visa through an EU digital visa application platform. Derogations are foreseen, among others, for humanitarian reasons . According to the Explanatory Memorandum and Recital 14 of the Proposal, such a derogation could also apply to people with lower IT literacy who would require technical assistance. Indeed, although the online application aims to make the visa processing more efficient, certain categories of applicants may find it more challenging, for instance because they do not have the necessary equipment or adequate digital literacy. As a consequence, these categories of applicants would be more likely to rely on external service providers to submit their applications and thus being more susceptible to expose their personal data to third-parties. However, the EDPS notes that such exception is not clearly mentioned in the Recital, which envisages it as a possibility only. The said Recital indicates that special provisions which should apply in individual cases because of humanitarian reasons could cover digital accessibility issues (emphasis added). Furthermore, such an exception is not reflected in the operative part of the Proposal. In a context of persisting digital divides, the EDPS considers important to include in the operative part of the Proposal an explicit provision that would exempt individuals with accessibility issues from using the EU digital visa platform. Recital 14 should be amended accordingly.

4. Categories of data processed

12. The Proposal would amend Regulation (EC) No 767/2008 by introducing a new Chapter Ia on the European digital visa application platform. Under this Chapter, Article 7(b)(5) would add the IP address from which the application form is submitted among the data of the application. Such data will then be stored in VIS. and it will become possible for designated 18 19 authorities of the Member States as well as Europol to access this information. The EDPS wishes to recall that IP addresses may constitute personal data and, as such, their processing should be subject to an in-depth assessment of the necessity of such processing for the purposes foreseen in the Proposal. Such an assessment is a pre-requisite for any limitation to fundamental rights, including data protection, according to Article 52 of the EU Charter of Fundamental Rights . The EDPS regrets that the impact assessment accompanying the Proposal does not provide for any assessment related to the need to process IP addresses for the purposes of the digital visa. The impact assessment accompanying the Proposal also fails to address the question of access to such data by Europol. In the absence of such an assessment, the EDPS is not in a position to determine whether the processing of IP addresses is necessary to achieve the objectives of the Proposal and whether it would be compliant with the principles of purpose limitation and data minimisation. Therefore, the EDPS considers that the IP address from which the application form was submitted should not be added as part of the data of the visa application. Unless clear evidence is provided for the necessity and proportionality of the processing for the purposes of the Proposal, the EDPS considers that IP addresses should not be processed for the purposes set out in the VIS Regulation nor in any other large-scale database systems or components falling within the scope of the interoperability framework . 6

5. Access and use of data

13. The EDPS welcomes the fact that external providers within the meaning of the Proposal would not have access to VIS. However, he points out that, contrary to Recital 26 of the Proposal, the Explanatory Memorandum states that external service providers would have read-only access to VIS data, via a gateway to be set up.

14. The EDPS recalls in this context that, pursuant to Article 6 (2) of the VIS Regulation access to the VIS for consulting the data shall be reserved exclusively for the duly authorised staff of: a. the national authorities of each Member State and of the Union bodies which are competent for the purposes of Articles 15 to 22, Articles 22g to 22m and Article 45e of this Regulation; b. the ETIAS Central Unit and the ETIAS National Units, designated pursuant to Articles 7 and 8 of Regulation (EU) 2018/1240, for the purposes of Articles 18c and 18d of this Regulation and for the purposes of Regulation (EU) 2018/1240; and c. the national authorities of each Member State and of the Union bodies which are competent for the purposes of Articles 20 and 21 of Regulation (EU) 2019/817. Since the EU application platform will be able to carry out checks against the read-only copy of VIS , the EDPS asks the Commission to ensure that external service providers will not have access to VIS data via the European digital visa application platform.

6. Data quality

15. The EDPS notes that the Proposal provides for the obligation for consulates and external service providers to perform quality checks of the uploaded supporting documents. At the same time, it does not establish a specific procedure to verify the quality of the personal data inserted in the application form via the platform, which may affect the accuracy of the data submitted. Having a uniform approach to quality check is important not only to ensure an equal level of data quality across the Member States, but also to ensure that applicants have the same treatment when addressing different competent consulates. Thus, the EDPS invites the Commission to clarify in the Proposal that procedures and requirements to ensure data quality checks on the data inserted in the application form should be foreseen and that such requirements should be spelled out by means of implementing acts.

7. Roles and responsibilities

16. The architecture of the European digital visa application platform would be a hybrid solution according to which all application files would be stored centrally in the Application Management System only until they are marked by the competent authority as admissible. At that point, they would be transferred to the relevant Member State and deleted from the temporary storage . From a data protection perspective, the envisaged solution brings certain reassurances in terms of data minimisation and security. However, it makes the 7 identification of the roles and responsibilities of the different actors involved potentially more complex. The clear attribution of the different roles and responsibilities is crucial to determine who will be responsible for compliance with different data protection rules and how data subjects can exercise their rights in practice. Therefore, the EDPS recommends clarifying in the Proposal the roles and responsibilities of the different actors involved in the processing of personal data via the European digital visa application platform, e.g. eu-LISA, the Member States authorities and, where relevant, the external service providers, in particular with regard to the notions of controller and processor .

8. Security considerations - External service providers gateway

17. The Proposal would amend Article 44 of Regulation (EC) No 810/2009, which addresses the question of encryption and secure transfer of data between Member States and external service providers. In particular, according to the Proposal, the encryption procedure provided for in Article 44 of Regulation (EC) No 810/2009 shall not apply to the access that external service providers may have to the European digital visa application platform via the external service provider gateway referred to in Article 7e of Regulation (EC) No 767/2008. However, Article 7e only prescribes that when setting up the authentication scheme, information security management and the principles of data protection by design and by default shall be taken into account . While the EDPS welcomes the explicit reference to data protection by design and by default, he wishes to remind that encryption and authentication are different security mechanisms, that operate at different levels. Their use should be cumulative to ensure adequate safety measures for the systems. Replacing security mechanisms, which were designed for different purposes, is a practice to be discouraged from an information security management standpoint. Therefore, the EDPS recommends removing the derogation to Paragraph 1 of Article 44 of Regulation (EC) No 810/2009, unless clear evidence is provided for its necessity and proportionality.

18. Furthermore, the EDPS is of the opinion that the Proposal does not sufficiently describe how the external service provider gateway would allow external providers to access the applicants’ data, as provided for in Article 7e of Regulation (EC) No 767/2008 (External service provider gateway) . The service provider should only be able to access a visa application after applicants have provided their authorisation, and the Proposal should describe in which way that authorisation would be granted. Such access should be limited to the tasks of the external service provider as defined in Article 7e of the Proposal. Furthermore, applications should cease to be accessible once they are made available to the consulates for further processing, as described in Article 2(3) of the Proposal amending the VIS Regulation in Article 7e (1) (e).

19. More generally, the Commission should consider the risk of malicious usage, or exploitation, of the external service provider gateway, as the tool is likely to be accessible to a wide range of different actors, many of which in third countries. Security mechanisms such as the detection of irregular usage of the gateway (for instance, a large number of accesses to different applications on a short interval) or the encryption of the data in the 8 temporary storage are possible safety measures that could be applied to ensure the integrity and confidentiality of the data.

9. Security considerations - The secure account service

20. Amendments to Article 7b(3) of the VIS Regulation in accordance with Article 2(3) of the Proposal would introduce a secure account service, which would provide the possibility for applicants to keep the data provided for subsequent applications, and to submit the application in several steps. The Article refers to the fact that the Commission shall adopt delegated acts in accordance with Article 48a of the VIS Regulation in order to define the requirements of the secure account service, including the retention period for data stored therein and for uncompleted applications or applications which do not pass the competence and admissibility check. The EDPS considers that the secure account service provides access to data that could reveal highly sensitive information about the individuals and stresses the importance of ensuring the confidentiality of the applicant’s personal data. Therefore, any further acts to define the requirements of the secure accounts should address the need to have robust authentication mechanisms, such as multi-factor authentication, to prevent the risk of unauthorised access with stolen credentials.

10. The rights of the data subjects

21. The new Article 7a of the VIS Regulation would be dedicated to the 'General public information on the EU-application platform’. The EDPS recognises the importance of giving general information to the public as referred to in Article 47 of Regulation (EC) No 810/2009. The right to information constitutes an indispensable safeguard for the rights of the individual, including data protection. Therefore, it is equally important to provide to the data subjects information about the processing of their personal data, to ensure fair processing. In particular, with regard to the processing of applicants’ personal data, the EDPS recalls that according to Article 37 of the VIS Regulation, data subjects should be informed about the processing of their personal data in VIS in writing, when the data from the application form, the photograph and the fingerprints data are collected . Since the personal data that will be processed in VIS will be first collected in the envisaged platform, the EDPS is of the opinion that the EU application platform should also provide information about the processing of personal data in the context of VIS.

22. In addition, in view of the operationalisation of the interoperability framework and the consequent processing of personal data for multiple purposes, the EDPS underlines that the right to information should not be limited to providing information about the purposes for which the data will be processed within the VIS. It should also include information about the processing in the other interoperability components and large-scale data base systems part of the network. 9

11. Other specific comments

23. The proposal foresees the possibility to delegate to the Commission the adoption of an implementing act that would define the content of a simplified application forms for confirmation of valid visas in a new travel document and for extension of visas . The EDPS wishes to recall that such form should not go beyond what is explicitly set out in the Proposal and should select the most essential elements, in line with the principle of data minimisation.

12. Conclusions

24. In light of the above, the EDPS makes the following recommendations: (1) to clarify Recital 14 in order to ensure that persons with digital accessibility issues should be entitled to lodge their applications in person, and to reflect this rule in the operative part of the Proposal; (3) to define a common procedure to ensure that data quality checks on the personal data inserted in the application form via the European digital visa application platform are homogeneous and auditable among different stakeholders; (4) to clarify the roles and responsibilities among eu-LISA, the Member States authorities and, if relevant, the external service providers involved in the processing of personal data via the European digital visa application platform; (5) to remove the derogation to Article 44(1) of Regulation (EC) 810/2009, as mentioned in Article 1(29)of the Proposal, in order to ensure the encryption of personal data accessed by external service providers through the EU application platform, via the external service provider gateway and, more generally, to provide for security mechanisms for the use of this gateway; (6) to determine robust authentication mechanisms as part of the secure account service; (7) to include in the European digital visa application platform information about the processing of personal data for the purposes of VIS and additional purposes derived from the operationalisation of the interoperability framework. Brussels, 21 June 2022 [e-signed] Wojciech Rafał WIEWIÓROWSKI 10 11 12