EDPS Opinion 24/2024 on the Proposal for a Regulation establishing an application for the electronic submission of travel data

4 December 2024

Opinion 24/2024

on the Proposal for a Regulation establishing an application for the electronic submission of travel data

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years.

Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council establishing an application for the electronic submission of travel data (“EU Digital Travel application”) and amending Regulation (EU) 2016/399 and (EU) 2018/1726 of the European Parliament and of the Council and Council Regulation (EC) No 2252/2004, as regards the use of digital travel credentials . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

Executive Summary

On 8 October 2024, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council establishing an application for the electronic submission of travel data (“EU Digital Travel application”) and amending Regulations (EU) 2016/399 and (EU) 2018/1726 of the European Parliament and of the Council and Council Regulation (EC) No 2252/2004, as regards the use of digital travel credentials (‘the Proposal’).

The objective of the Proposal is to increase security in the Schengen area and the EU and allow for a smoother and faster border crossing for travellers. To this end, the Proposal for a regulation aims at (i) establishing a uniform standard for digital travel credentials and a common EU application (EU Digital Travel application) for using them, (ii) allowing people to use digital travel credentials to cross external air, land and sea borders based on a uniform EU technical solution, and (iii) enabling border authorities to carry out checks based on these credentials, to reduce bottlenecks and time spent at border-crossing points.

The EDPS considers that the Proposal does not raise any specific concerns from data protection perspective. Notwithstanding this general conclusion, the EDPS recommends to clarify that competent border authorities should delete the travel data they have received remotely from the traveller via digital advance submission, immediately after the traveller has been granted entry or after an adequate waiting period after a decision denying exit or entry has been taken, unless there is a legal justification for a continued processing for other purposes. He also highlights the need to clarify the relationship between the digital travel credentials and the European Digital Identity Wallet.

Contents 4. Relationship with the European Digital Identity Wallet..7

3

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 8 October 2024, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council establishing an application for the electronic submission of travel data (“EU Digital Travel application”) and amending Regulations (EU) 2016/399 and (EU) 2018/1726 of the European Parliament and of the Council and Council Regulation (EC) No 2252/2004, as regards the use of digital travel credentials (‘the Proposal’).

2. The objective of the Proposal is to increase security in the Schengen area and the EU and allow for a smoother and faster border crossing for travellers . To this end, the Proposal for a regulation aims at (i) establishing a uniform standard for digital travel credentials and a common EU application (EU Digital Travel application) for using them, (ii) allowing people to use digital travel credentials to cross external air, land and sea borders based on a uniform EU technical solution, and (iii) enabling border authorities to carry out checks based on these credentials, to reduce bottlenecks and time spent at border-crossing points .

3. As a result, travellers will have the possibility to submit a digital version of their travel document through an application for an advance check ahead of travel, and consequently to pass through border control in a smoother fashion . In addition, the Proposal will allow border authorities to carry out the checks in advance and thereby focus their resources on detecting cross-border crime and irregular migration more efficiently .

4. In addition, the Proposal will have an impact on several existing legal acts, relating to digital visas, the European Travel Authorisation and Information System (ETIAS), the Entry/Exit System (EES), and advance passenger information (API) .

5. The 2021 Commission Communication on a Schengen Strategy put forward the European Commission’s plans towards further digitalising procedures at the external borders of the Schengen area, including an initiative on digitalising travel documents and facilitating travel.

6. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 9 October 2024, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 33 of the Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.

2. General remarks

7. The EDPS welcomes the specific attention given in the Proposal, in particular in recital 11 and in Article 7, to the data protection aspects of the envisaged processes. As a result, the Proposal provides for the necessary legal clarity and certainty as regards the applicable data protection framework, namely Regulation (EU) 2016/679 (GDPR) and the EUDPR, as well as on the attribution of the role and responsibilities of data controller and data processor with regard to the involved Union and national authorities.

8. The EDPS also welcomes the voluntary nature of the digital travel credentials and the possibility for the individuals to freely choose whether to use them or a physical travel document for the purpose of undergoing border checks, without affecting their eligibility to cross external borders. In this regard, the EDPS calls on the competent Union and Member States bodies to ensure that the possible choice not to use the digital credentials would not entail in practice any other negative consequences for the individual.

9. The EDPS positively notes that the amount and categories of personal data, as currently processed in the areas of border control and document issuance under Union and national law, are not affected by this proposal . The EDPS similarly welcomes the fact that, in line with ICAO standards and the principle of data minimisation, pursuant to Article 4(7) of the Proposal, the digital travel credentials created would not include the fingerprints of the holder.

10. However, the EDPS considers that the establishment of the EU Digital Travel application and the creation and use of digital travel credentials would inevitably lead to additional risks for the data subject, as personal data that would otherwise be presented physically in a non-digital format to the border control authorities would be transmitted remotely, leaving the data subject with less control of the data and opening up possibilities for further processing. Therefore, adequate safeguards, such as strict purpose limitation and robust security, including protection against any unauthorised access, alteration, or loss of data, are essential.

11. The EDPS also notes that advance border checks with the use of digital travel credentials (and other travel data, if applicable) are in practice very similar to the processing of advance passenger information by border authorities. The EDPS recalls that he has issued an Opinion on two Proposals for Regulations on the collection and transfer of advance passenger information (API), where he has discussed several elements that are relevant also in the context of the proposed EU Digital Travel application, such as the functioning of a dedicated EU ‘router’, the storage of data, and the designation of data controllers and processors .

12. This being said, the EDPS considers that the Proposal does not raise any specific concerns from data protection perspective. Notwithstanding this general conclusion, the following specific comments aim to highlight selected aspects of the Proposal that may require additional attention and clarification.

3. Storage Limitation

13. The EDPS stresses that in principle the digitalisation and digital delivery of travel data by the traveller should not lead to additional data retention that would not generally occur in cases where the traveller chooses to use his or her physical travel document. In this regard, the EDPS welcomes the clarification in Article 7(4) of the Proposal that no personal data should be stored on the backend validation service or the Traveller Router beyond what is necessary for the creation of the digital travel credential and transmission of the travel data to the competent border authorities.

14. However, in the view of the EDPS, the retention of digital travel credentials and other traveller data by border control authorities requires a more precise legal limitation. Therefore, the EDPS recommends to further clarify that the competent border authorities should delete the travel data they have received from the traveller via digital advance submission immediately after the traveller has been granted entry or after an adequate waiting period after a decision denying exit or entry has been taken, unless there is a legal justification for a continued processing for other purposes.

15. In the same vein, the EDPS notes that in order to use the digital travel credentials, the digital travel credentials submitted by the user must be temporarily stored in a local database in the responsible Member State. This temporary database would be populated with the facial images that are contained in the submitted digital travel credentials. According to the Proposal, this is necessary to biometrically match the traveller to the submitted digital travel credential when they present themselves at the border-crossing point . The EDPS recommends that once the border check has been carried out, the data should be deleted from the temporary database – similar to what is currently done when reading chip data from physical travel documents during border checks .

4. Relationship with the European Digital Identity Wallet

16. According to Article 4(2) of the Proposal, the EU Digital Travel application should provide for the possibility to store a digital travel credential for multiple use in the European Digital Identity Wallet, provisions for which are laid down in Regulation (EU) No 910/2014 .

17. The EDPS supports in principle the envisaged interoperability between the EU Digital Travel application and the European Digital Identity Wallet as provided for in Article 8(4) of the Proposal. At the same time, the EDPS notes that the Proposal lacks any specic details about the relationship between the two systems.

18. The digital travel credentials would contain the same personal data, including facial image and excluding the fingerprints, as the identity cards, passports or other travel documents, on which they are based. Conversely, according to Article 3, point 3 of Regulation (EU) No 910/2014, ‘person identification data’ that can be stored in the European Digital Identity Wallet means a set of data that is issued in accordance with Union or national law and that enables the establishment of the identity of a natural or legal person, or of a natural person representing another natural person or a legal person. In this context, it is not clear whether digital travel credentials would be stored in the form of attestations of attributes, similarly to a driver’s licence, or as person identification data.

19. Therefore, the EDPS recommends further clarifying the relationship between the digital travel credentials and the European Digital Identity Wallet, e.g. by explicitly referring to this element in Article 16 of the Proposal as regards the future implementing acts to be adopted by the Commission.

5. Conclusions

20. In light of the above, the EDPS makes the following recommendations: (1) to clarify that the competent border authorities should delete the travel data they have received remotely from the traveller via digital advance submission, immediately after the traveller has been granted entry or after an adequate waiting period after a decision denying exit or entry has been taken, unless there is a legal justification for a continued processing for other purposes. (2) to further clarifying the relationship between the digital travel credentials and the European Digital Identity Wallet. Brussels, 4 December 2024 (e-signed) Wojciech Rafał WIEWIÓROWSKI 8