Changes from report parliamentary committee draft to plenary report

This Regulation updates and replaces Directive 2004/82/EC, the existing legal framework on API data that intents to facilitate external border controls, combat illegal immigration and increase internal security. Whereas Directive 2004/82/EC has proven effective in improving border controls, its divergent application at national level has created inconsistencies, which are now being addressed by the new rules proposed by the Commission.

More specifically, this Regulation introduces:

1) provisions for the collection and transfer of API data by air carriers to the router, rules for the processing of API data by competent authorities and the storage and deletion of API data by both air carriers and competent authorities;

2) the establishement of a single point of reception and onward distribution of data, the router, which will be managed by eu-LISA; furthermore rules on the use of the router, on the deletion of the API data from the router and procedure in case of technical impossibilities to use the router;

3) provisions on the protection of personal data, as well as security and self-monitoring by air carriers and competent authorities;

4) rules and conditions on the possibility of an initial voluntary use of the router by air carriers, before its compulsory application;

5) requirements on supervision and possible penalties in case of non-compliance by air carriers.

This Regulation also includes budgetary provisions that will finance the establishment and functioning of the router and the costs incurred by the Member States (with some exceptions) in relation to their connections to and integration with the router, under the Union budget.

Rapporteur’s position

This Regulation should allow authorities to estimate in advance the necessary control capacity at airports and should enable air carriers to process the information and the check-in in a more efficient and faster way. The Rapporteur therefore welcomes this streamlined and simpler method for air carriers to provide API data through a centralised system. He also shares the view that digitalisation and automation can be a useful tool to mitigate errors and to allow for a better travel experience for passengers. Nevertheless, this Regulation should avoid going to the detriment of the travel experience of the legitimate traveller. In that sense, a clarification on the possibility to check in online was introduced, as well as a restriction to apply fees to the passengers when the data is provided at the airport.

The Rapporteur also shares the intention to ensure better quality API data in order to facilitate checks at external borders, while underlining the need to fully respect the citizens' fundamental right to data protection. In view of the sensitive nature of the personal data, the requirement to encrypt the API data when transferred from the air carrier to the router and further on to the competent authorites is introduced. The Rapporteur also proposes a clear restriction of the use of statistical data for specific defined purposes in Art. 31. For reasons of coherence and proportionality, the Rapporteur also intents to exclude both members of the crew and transit passengers from the scope of this Regulation.

The Rapporteur believes that this legislation should facilitate people travelling, with reduced times at disembarkation and at the physical border checks. Therefore, the Rapporteur introduces a provision in Article 38 which imposes a requirement on the Commission to carry out an assessment on the impact of this Regulation on the travel experience of travellers. He also calls for the establishement of a API contact group, to enhance cooperation and information exchange among Member States, EU institutions and stakeholders. The Rapporteur understands that in certain cases air carriers may need to keep logs for longer than for procedures for monitoring or ensuring the security and integrity of the API data or the lawfulness of the processing operations. As the reasons for a prolongation of the temporary storage period has not been made sufficiently clear in relation to the purpose of this Regulation, the Rapporteur prefers to limit the data retention period for both air carriers and competent border authorities to 24 hours.

Regarding the penalties imposed on air carries for non-compliance with the obligations as laid out in this Regulation, the Rapporteur shares the intention to make them effective and dissuasive, but he prefers to introduce a threshold for maximum penalties in order to fully ensure proportionality. The Rapporteur believes that the financial appropriation to the functioning of the router will determine its success, therefore eu-LISA should be provided with the necessary resources. In addition, in view of the expected increase in tasks for the EDPS and national data protection authorities, the Rapporteur includes provisions regarding the coverage of cost costs incurred by them as well.

As regards the provisions and references related to intra-EU flights in the Regulation (EU) [API law enforcement], the Rapporteur prefers to remove them from the text since it is questionable if the proposed filtering mechanism of the router would fully comply with the requirements of the Ligue des droits humains judgment. Moreover, he is of the opinion that separate provisions on non-discrimination and legal remedies are essential fundamental rights safeguards which apply horizontally.

Furthermore, the Rapporteur considers that the obligation to provide API data should not be extented to other means of transport. As such, he does not agree with the introduction of an opening clause in Recital 35, as proposed by the Commission.