Changes from report parliamentary committee draft to plenary report

DRAFT EUROPEAN PARLIAMENT LEGISLATIVE RESOLUTION

▸9 unchanged paragraphs

on the proposal for a regulation of the European Parliament and of the Council establishing an application for the electronic submission of travel data (“EU Digital Travel application”) and amending Regulations (EU) 2016/399 and (EU) 2018/1726 of the European Parliament and of the Council and Council Regulation (EC) No 2252/2004, as regards the use of digital travel credentials

(COM(2024)0670 – C100124/2024 – 2024/0670(COD))

(Ordinary legislative procedure: first reading)

The European Parliament,

– having regard to the Commission proposal to Parliament and the Council (COM(2024)0670),

– having regard to Article 294(2) and Article 77(2)(b) and (d), of the Treaty on the Functioning of the European Union, pursuant to which the Commission submitted the proposal to Parliament (C100124/2024),

– having regard to Article 294(3) of the Treaty on the Functioning of the European Union,

– having regard to Rule 60 of its Rules of Procedure,

– having regard to the opinion of the Committee on Transport and Tourism,

Changed– having regard to the report of the Committee on Civil Liberties, Justice and Home Affairs (A100000/2025),(A10-0258/2025),

1. Adopts its position at first reading hereinafter set out;

2. Calls on the Commission to refer the matter to Parliament again if it replaces, substantially amends or intends to substantially amend its proposal;

3. Instructs its President to forward its position to the Council, the Commission and the national parliaments.

Change 1

ChangedRecital 1: (1) The carrying out of effective and efficient border checks at the external borders contributes to the proper functioning of the area without internal border controls (‘the Schengen area’) and the internal security of the Union. The inclusion in travel documents issued by Member States of a storage medium ('chip'),(the 'chip'), with a facial image of the holder, by Council Regulation (EC) 2252/20041 and Regulation (EU) 2019/11572 , and the entry into force of Regulation (EC) No 562/2006 of the European Parliament and of the Council3 have significantly contributed to high security standards and robust external border management. Border checks are to be carried out in accordance with Regulation (EU) 2016/399 of the European Parliament and of the Council4Council4. ,Such border checks serve the purposes of reliably and securely identifying travellers, preventing threats to the internal security, public policy, and public health and international relations of Member States.

Change 2

ChangedRecital 2: (2) With the current reliance on physical travel documents and physical interactions for the examination of travel documents and the carrying out of border checks, Member States’ border authorities are unable to remotely verify the authenticity and integrity of travel documents and to carry out the relevant checks against databases before travellers arrive at the physical border crossing point, with the exception of air passengers for whom advance passenger information has been transmitted and processed. In light of increasing traveller flows across the external borders of the Schengen area as well as the entry into operation of the Entry/Exit System (EES) established by Regulation (EU) 2017/2226 of the European Parliament and of the Council5 that will require third-country nationals to whom it applies to provide additional data as part of border checks, this Regulation provides the possibility for border authorities to use secure technical solutions to carry out relevant checks before travellers arrive at the border-crossing points.

Change 3

ChangedRecital 3: (3) The existing legal framework on travel documents and border checks, consisting notably of Regulations (EC) No 2252/2004, (EU) XXXX/XXXX6 [COM(2024) 316 final] and (EU) 2016/399, does not allow for the use of data contained in the chip of travel documents for the purpose of carrying out such advance border checks and pre-clearing travellers or using that data for other purposes. Following recent developments at international level, namely in the context of standardisation work carried out by the International Civil Aviation Organization (ICAO), and on the capabilities and reliability of facial recognition, that technologyit is available and respondsappropriate to theexplore callsnew forapproaches facilitatingto facilitate cross-border travel while ensuring high levels of security in full respect of fundamental rights, including the right to privacy and the protection of personal data.

Change 4

ChangedRecital 4: (4) Therefore, the existing legal framework should be updated to ensure that both travellers and border authorities can benefit from more efficient and effective border checks using so-called digital travel credentials, that is, a digital representation of the person’s identity that is derived from the information stored in the chip of the travel document (i.e. passport or EU identity card) and that can be validated,reliably verified, leading ultimately to shorter waiting and processing times at border-crossing points and improving the authorities’ ability to pre-screen travellers, as well as to plan and manage resources andmore focuseffectively, onto higherallow riskfor travellers.a more thorough assessment in cases that exhibit irregularities or require additional verification.

Change 5

ChangedRecital 5: (5) In order to achieve its objectives, this Regulation should cover persons over the age of 18 enjoying the right of free movement under Union law as well as third-country nationals. This Regulation should only apply to persons over the age of 16 who are in possession of a travel document or identity card issued pursuant to Union law, or a travel document containing a chip, that is based on technical specifications and security standards compatible with those provided for by Regulation (EC) No 2252/2004, and that contain reliable technology preventing its cloning.

Change 6

ChangedRecital 5 a (new): (5a) Biometric data are, by their nature, particularly sensitive and merit specific protection as the context of their processing could create significant risks to fundamental rights and freedoms. Children merit specific protection with regard to their personal data, as they maymight be less aware of the risks, consequences and safeguards concerned and of their rights in relation to the processing of personal data.data Furthermore,as facialset recognitionout technologyin mayRegulation not(EU) be2016/679 ableof tothe reliablyEuropean matchParliament and of the facialCouncil1. image/ 1 Regulation (EU) 2016/679 of athe growingEuropean childParliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the imageprocessing storedof personal data and on the chip.free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1, ELI: http://data.europa.eu/eli/reg/2016/679/oj).

Change 7

ChangedRecital 6: (6) In the interest of achieving a uniform approach at Union level and maximising gains in travel facilitation and economies of scale, a common technical solution for the creation, storage and submission of electronic travel data should be established, as opposed to each Member State developing their own. This application for the electronic submission of travel data (‘the EU Digital Travel application’) should consist of a user-friendly mobile application,application available in at least all official languages of the Union, a backend validation service that can verify the authenticity and integrity of travel documents and match the facial image of the user to the image stored on the travel document’s chip and a technical component for the secure communicationtransmission of travel data from the application to the receiving authority (‘Traveller Router’). In the longer term, the EU Digital(‘Digital Travel application could be developed with new functionalities with a view to establishing a comprehensive one-stopCredential shopRouter’). applicationThe atsource Unioncode levelof tothe increasesoftware easecomponents of travel for the travellersEU andDigital toTravel supportapplication externalshould borderbe management.open-source licensed.

Change 8

ChangedRecital 7: (7) The EU Digital Travel application should allow travellers to create a digital travel credential for single or multiple use and to retrieve of an already created digital travel credential. For reasons of security and for combatting identity fraud, the EU Digital Travel application backend validation service should be able to verify, before the creation of the digital travel credential, the authenticity and integrity of the travel document and verify that the user is the legitimate holder of the travel document by comparing the facial image stored on the chip of the travel document to the user’s live facial image. Digital travel credentials to be used several times should be ableable, based on the user's explicit consent, to be stored in the user’s European Digital Identity Wallet in accordance with Regulation (EU) No 910/2014 of the European Parliament and of the Council7 . Persons who do not havinguse a European Digital Identity Wallet established by that Regulation shouldor bedo ablenot wish to store thetheir digital travel credential in the Wallet should be able to store it locally in the mobile application.

Change 9

RemovedRecital 8: (8) In order to support the carrying out of advance border checks on persons enjoying the right of free movement under Union law when these apply to them and the pre-clearance of third-country nationals, travellers using digital travel credentials should also declare, through the EU Digital Travel application, certain relevant travel data, such as the intended time of crossing the border and the Member State in which the external border is crossed. Such data should be strictly limited to what is necessary for the purpose of carrying out the border check, including for the purposes of supporting the verification of the fulfilment of entry conditions in accordance with Regulation (EU) 2016/399.

AddedRecital 7 a (new): (7a) The EU Digital Travel application should be compatible with EES, European Travel Information and Authorisation System (ETIAS) and advance passenger information system (API).

RemovedRecital 9: (9) The Traveller Router should transmit the travel data submitted by the traveller to the competent border authorities for the advance border check and pre-clearance. Consequently, Member States should be obliged to designate a Single Point of Contact for the border authorities authorised to receive such data.

AddedRecital 7 b (new): (7b) The mobile application should allow carriers to access the digital travel credential for the purposes of Regulations (EU) 2025/121 and (EU) 2025/132 of the European Parliament and of the Council, subject to the explicit consent of the user. Carriers should not be allowed to collect any biometric data in accordance with Regulations (EU) 2025/12 and (EU) 2025/13. / 1 Regulation (EU) 2025/12 of the European Parliament and of the Council of 19 December 2024 on the collection and transfer of advance passenger information for enhancing and facilitating external border checks, amending Regulations (EU) 2018/1726 and (EU) 2019/817, and repealing Council Directive 2004/82/EC (OJ L, 2025/12, 8.1.2025, ELI: http://data.europa.eu/eli/reg/2025/12/oj). / 2 Regulation (EU) 2025/13 of the European Parliament and of the Council of 19 December 2024 on the collection and transfer of advance passenger information for the prevention, detection, investigation and prosecution of terrorist offences and serious crime, and amending Regulation (EU) 2019/818 (OJ L, 2025/13, 8.1.2025, ELI: http://data.europa.eu/eli/reg/2025/13/oj).

RemovedRecital 10: (10) The creation, submission and use of digital travel credentials for the purpose of carrying out border checks impacts the right to privacy and the protection of personal data. In order to fully respect the fundamental rights of travellers, adequate limits and safeguards should be in place. Any data that is submitted by travellers to border authorities ahead of travel, and in particular personal data, should be strictly limited to what is necessary and proportionate to the objectives of increasing security, facilitating travel and ensuring the well-functioning of the Schengen area pursued by this Regulation. It should be guaranteed that the processing of data under this Regulation does not lead to any form of discrimination. No personal data should be stored at EU level beyond the stage that is necessary for its submission to the border authority.

AddedRecital 7 c (new): (7c) The EU Digital Travel application should not allow any third party access, including embedded software development kits, plugins, or embedded libraries that allow accessing, processing, transmitting or receiving any personal or technical data.

RemovedRecital 10 a (new): (10a) The competent border authorities should delete the travel data transmitted in accordance with this Regulation, in an automated manner, from the database of the border crossing point immediately after the traveller has crossed the external border. Where the traveller, who has submitted travel data in accordance with this Regulation, does not cross the external border, the competent border authorities should delete, in an automated manner, the travel data transmitted 12 hours after the intended date and time of arrival or departure.

AddedRecital 8: (8) In order to support the carrying out of advance border checks on persons enjoying the right of free movement under Union law when these apply to them and the pre-clearance of third-country nationals, travellers using digital travel credentials should also declare, through the EU Digital Travel application, the intended time of crossing the border and the Member State in which the external border is crossed. Such data should be strictly limited to what is necessary for the purpose of carrying out the border check in accordance with Regulation (EU) 2016/399.

RemovedRecital 13: (13) The European Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) established by Regulation (EU) 2018/1726 of the European Parliament and of the Council10 should be responsible for the development and maintenance of the EU Digital Travel application. Consequently, eu-LISA should put in place the necessary measures for the operational management of the EU Digital Travel application, including for the development, monitoring and reporting of the system. Before the start of operation of the EU Digital Travel application, a test should be carried out in accordance with the technical specifications by eu-LISA in cooperation with the relevant authorities. eu-LISA should also collect statistics on the use of the EU Digital Travel application for the sole purpose of evaluating the effectiveness of this Regulation.

AddedRecital 9: (9) The Digital Travel Credential Router should transmit the end-to-end encrypted travel data submitted by the traveller to the competent border authorities for the advance border check and pre-clearance. Consequently, Member States should be obliged to designate a Single Point of Contact for the border authorities authorised to receive such data.

RemovedRecital 15: (15) In order to increase public awareness of digital travel credentials and to promote the uptake of their use, the Commission should, together with eu-LISA, the European Border and Coast Guard Agency and national border authorities carry out information campaigns on the objectives, use and other important aspects, including on data protection and data security, of the EU Digital Travel application. The information campaigns should also include practical information on the scanning of the chip in the travel document to ensure the correct functioning of the EU Digital Travel application.

AddedRecital 10: (10) The creation, submission and use of digital travel credentials for the purpose of carrying out border checks impacts the right to privacy and the protection of personal data. In order to fully respect the fundamental rights of travellers, adequate limits and safeguards should be in place. Any data that is submitted by travellers to border authorities ahead of travel, and in particular personal data, should be strictly limited to what is necessary and proportionate to the objectives of increasing security, facilitating travel and ensuring the well-functioning of the Schengen area pursued by this Regulation. The creation of the EU Digital Travel application should not, under any circumstances, impact or modify the rules and requirements on the exercise of the right to free movement within the Schengen area. It should be guaranteed that the processing of data under this Regulation does not lead to any form of discrimination, in particular against travellers who choose not to use digital travel credentials. No personal data should be stored at EU level. The Digital Travel Credential Router should transmit the travel data submitted by the traveller to the competent border authority immediately and in an automated manner, without modifying their content.

RemovedRecital 19: (19) In order to establish the Union standard specification for digital travel credentials based on travel documents, it is necessary to amend Regulation (EC) No 2252/2004. To boost the uptake of digital travel credentials, when applying for or renewing a travel document, applicants should be allowed to request that the competent authority issues, together with the physical document, a corresponding digital travel credential. They should also be able to make that request at any point in time. Holders of valid travel documents should also be able to create a digital travel credential based on their existing physical travel document. The digital travel credentials should also be storable in the European Digital Identity Wallet.

AddedRecital 10 a (new): (10a) The competent border authorities should delete the travel data transmitted in accordance with this Regulation, in an automated manner, from the national database of the border crossing point immediately after the traveller has crossed the external border. Where the traveller, who has submitted travel data in accordance with this Regulation, does not cross the external border, the competent border authorities should delete, in an automated manner, from the national database, the travel data transmitted 24 hours after the intended date and time of arrival or departure.

RemovedRecital 23: (23) The Commission should, two years after the start of operations of the EU Digital Travel application, and every four years thereafter, carry out an evaluation of that application and its use and prepare a report, including recommendations, to be submitted to the European Parliament, the Council, the European Data Protection Supervisor and the European Union Agency for Fundamental Rights. The evaluation and report should consider how the objectives of this regulation have been met and how, if at all, fundamental rights have been impacted.

AddedRecital 11: (11) Travellers should be free to choose whether they use a digital travel credential or a physical travel document for the purpose of undergoing border checks. Travellers have to carry a physical travel document in any event, even if they use a digital travel credential. They should be able to withdraw their consent for the processing of their personal data at any time without it affecting the eligibility to cross external borders. Any processing of personal data under this Regulation should be carried out in compliance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council8 and Regulation (EU) 2018/1725 of the European Parliament and of the Council9 , within their respective scope of application.

RemovedRecital 23 a (new): (23a) In order to amend the minimum age for the use of the EU Digital Travel application, the power to adopt acts in accordance with Article 290 of the Treaty on the Functioning of the European Union should be delegated to the Commission in respect of granting the use of that application for the creation of digital travel credentials to persons under the age of 18, should the necessary technical requirements and any other relevant conditions be fulfilled, in particular as regards the facial image. It is of particular importance that the Commission carry out appropriate consultations during its preparatory work, including at expert level, and that those consultations be conducted in accordance with the principles laid down in the Interinstitutional Agreement 13 April 2016 on Better Law-Making1a. In particular, to ensure equal participation in the preparation of delegated acts, the European Parliament and the Council receive all documents at the same time as Member States’ experts, and their experts systematically have access to meetings of Commission expert groups dealing with the preparation of delegated acts. / 1a OJ L 123, 12.5.2016, p. 1, ELI: http://data.europa.eu/eli/agree_interinstit/2016/512/oj.

AddedRecital 11 a (new): (11a) The application of this Regulation should not result in any form of discrimination against travellers who do not make use of the EU Digital Travel application.

RemovedRecital 25: (25) This Regulation should not affect the possibility to provide, under national law, for the use of digital travel credentials for other purposes than the carrying out of border checks, provided that such national law complies with Union law.

AddedRecital 11 b (new): (11b) In order to respect the voluntary nature of the EU Digital Travel application, travellers who do not wish to use the application, or who choose to withdraw their consent for processing of their personal data, should be able to rely on infrastructure that allows the use of a physical travel document to complete border checks. Member States should ensure the necessary infrastructure at the border crossing points, including manual processing and e-gates, which remain available and deliver comparable access, speed, and quality of service. This is essential to uphold parity and to ensure that consent to digital processing is truly free, informed, and revocable.

RemovedArticle 1 – paragraph 1 – point b: (b) the entry of self-declared travel data, pursuant to Article 5;

AddedRecital 11 c (new): (11c) The application of this Regulation should respect relevant Union law and fundamental rights, as enshrined in the Charter of Fundamental Rights of the European Union (the ‘Charter’), including the right to respect for one’s private life and to the protection of personal data. Particular attention should be paid to vulnerable persons including persons with disabilities, elderly people and persons with limited resources or limited digital skills.

RemovedArticle 2 – paragraph 1 – point a a (new): (aa) ‘border authority’ means the border guard assigned, in accordance with national law, to carry out border checks as defined in Article 2, point (14), of Regulation (EU) 2016/399;

AddedRecital 12: (12) In the interest of ensuring compliance with the fundamental right to privacy and the protection of personal data and to promote legal clarity, the controller and processor should be identified. To ensure adequate safeguards and security, all transmission between the Digital Travel Credential Router and the competent authority should be protected by strong encryption methods so that any potential data breaches would not involve the disclosure of data that can be traced back to a person. For that reason, when designing and developing the router, the European Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) should ensure that any data transmitted by the EU Digital Travel application to competent border authorities is encrypted from end-to-end by design and by default, in order to take account of the sensitivity of the data and to prevent and minimize the impact of security incidents on users and the system as a whole. Member States should also provide adequate training, covering data security and data protection aspects, to the staff of border authorities before they can process data transmitted through the EU Digital Travel application.

RemovedArticle 2 – paragraph 1 – point c a (new): (ca) ‘travel data’ means the data to be submitted by the traveller for the purpose of this Regulation as defined in Article 5.

AddedRecital 13: (13) The European Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) established by Regulation (EU) 2018/1726 of the European Parliament and of the Council10 should be responsible for the development and maintenance of the EU Digital Travel application. Consequently, eu-LISA should put in place the necessary measures for the operational management of the EU Digital Travel application, including for the development, monitoring and reporting of the system. The eu-LISA budget allocated to that purpose should comply with the principles of economy, efficiency and effectiveness. Before the start of operation of the EU Digital Travel application, a test should be carried out in accordance with the technical specifications by eu-LISA in cooperation with the relevant authorities. eu-LISA should also collect statistics on the use of the EU Digital Travel application.

RemovedArticle 2 – paragraph 1 – point d: (d) ‘Traveller Router’ means the technical component referred to in Article 6 enabling the transmission of the travel data submitted by the traveller to the competent border authority.

AddedRecital 13 a (new): (13a) Where the conditions set out in Regulation (EU) 2016/679 require that a data protection impact assessment be carried out, the competent border authorities should carry out that assessment before eu-LISA conducts the test of the EU Digital Travel application.

RemovedArticle 3 – paragraph 1 – point a: (a) a mobile application, enabling the creation and submission of the digital travel credentials for single or multiple use, and the entry and submission of the self-declared travel data;

AddedRecital 13 b (new): (13b) eu-LISA should also collect and publish statistics including on the number of users of the EU Digital Travel application, for the sole purpose of evaluating the usability of the mobile application and the effectiveness of this Regulation, without allowing for the identification of any traveller.

AddedRecital 14: (14) While eu-LISA should be responsible for the overall development, operation and maintenance of the EU Digital Travel application, including the Digital Travel Credential Router that transmits the travel data to the competent authorities, each Member State should be responsible for ensuring, at national level, a secure connection in its national system in order to receive the travel data, including the development, operation and maintenance of that connection. Member States should be responsible for the management and arrangements for access of duly authorised staff of border authorities to the travel data. Member States should ensure the one-to-one verification through e-gates, as defined in Regulation (EU) 2016/399, or through any other infrastructure, between the individual traveller’s identity and their travel document for the purpose of carrying out border checks.

AddedRecital 15: (15) In order to increase public awareness of digital travel credentials and to promote the uptake of their use, the Commission should, together with eu-LISA, the European Border and Coast Guard Agency and national border authorities carry out information campaigns, informing the public, including third country nationals, about the objectives, use and other important aspects, including data protection, right to withdraw consent and data security, of the EU Digital Travel application. Information campaigns should be adapted to the specific circumstances of each Member State taking into account the varying stages of national implementation. The Commission should use a cost-effective approach regarding such campaigns.

AddedRecital 15 a (new): (15a) The information campaigns should also include practical information on how to scan the chip of the travel document in order to ensure the correct use of the EU Digital Travel application. Special attention should be given to ensuring that travellers who are not technologically proficient are clearly informed about the benefits of the application and are provided with accessible, practical guidance on how to use the EU Digital Travel application safely and securely.

AddedRecital 16: (16) In view of the Union interests at stake, the costs incurred by eu-LISA for the performance of its tasks under this Regulation and Regulation (EU) 2018/1726 in respect of the development, operation, maintenance and overall management of the EU Digital Travel application should be borne by the Union budget. Member States should remain liable for the costs incurred at national level for developing, operating and maintaining the secure connection for the reception of the travel data transmitted via the Digital Travel Credential Router.

AddedRecital 19: (19) In order to establish the Union standard specification for digital travel credentials based on travel documents, it is necessary to amend Regulation (EC) No 2252/2004. When applying for or renewing a travel document, the competent authority should automatically issue, together with the physical document, a corresponding digital travel credential. Holders of valid travel documents should also be able to create upon request to the competent authority a digital travel credential based on their existing physical travel document. They should be able to make that request at any point in time. Holders of valid travel documents should also be able to create a digital travel credential based on their existing physical travel document through the EU Digital Travel application. The digital travel credential should also be storable, at the request of the person concerned, in the European Digital Identity Wallet, as qualified electronic attestation of attributes within the meaning of Article 3, point 45, of Regulation (EU) No 910/2014.

AddedRecital 21: (21) While the use of digital travel credentials should be voluntary for travellers, in order to achieve the objectives of increasing security throughout the Schengen area, and to facilitate travel, all Member States should be obliged to allow travellers to use digital travel credentials for the purpose of crossing external borders once the EU Digital Travel application is operational. Before that, Member States may develop national solutions for the use of digital travel credentials, in accordance with the uniform format, for the purpose of border checks.

AddedRecital 22: (22) To further speed up processes and reduce overall time spent at border-crossing points, third-country nationals subject to the Entry/Exit System should be allowed to use the EU Digital Travel application for pre-enrolling certain data required for the border-crossing.

AddedRecital 23: (23) The Commission should, two years after the start of operations of the EU Digital Travel application, and every four years thereafter, carry out an evaluation of that application and its use and prepare a report, including recommendations, to be submitted to the European Parliament, the Council, the European Data Protection Supervisor and the European Union Agency for Fundamental Rights. The evaluation and report should consider how the objectives of this regulation have been met and how, fundamental rights have been impacted.