What changed between the draft committee report and the plenary report

Added:Article 6 – paragraph 4 – subparagraph 1: eu-LISA and the air carriers shall keep the logs that they created pursuant to paragraph 1, for a time period of one year from the moment of the creation of those logs. They shall immediately and permanently delete those logs upon the expiry of that time period .

Added:Article 6 – paragraph 4 – subparagraph 2: However, if those logs are needed for procedures for monitoring or ensuring the security and integrity of the API data or the lawfulness of the processing operations, as referred to in paragraph 2, and those procedures have already begun at the moment of the expiry of the time period referred to in the first subparagraph, air carriers may keep those logs for as long as necessary for those procedures, provided that eu-LISA or the air carriers inform the Commission of the need to keep those logs and provide reasons for doing so. In that case, they shall immediately delete those logs when they are no longer necessary for those procedures.

Added:Article 6 a (new): Article 6a / Actions in the case of technical impossibility to use the router / 1. Where it is technically impossible to use the router to transmit API data because of a failure of the router, eu-LISA shall immediately notify the air carriers and PIUs of that technical impossibility in an automated manner. In that case, eu-LISA shall immediately take measures to address the technical impossibility to use the router and shall immediately notify those parties when it has been successfully addressed. / During the time period between those notifications, Article 4(6) shall not apply, insofar as the technical impossibility prevents the transfer of API data to the router. Insofar as that is the case, Article 4 paragraphs 1 and 8 shall not apply either to the API data in question during that time period. / 2. Where it is technically impossible to use the router to transmit API data because of a failure of the systems or infrastructure referred to in Article 10 of a Member State, the PIU of that Member State shall immediately notify the air carriers, the other PIUs, eu-LISA and the Commission of that technical impossibility in an automated manner. In that case, that Member State shall immediately take measures to address the technical impossibility to use the router and shall immediately notify those parties when it has been successfully addressed. / During the time period between those notifications, Article 4(6) shall not apply, insofar as the technical impossibility prevents the t…

Added:Article 7 – paragraph 1: The PIUs shall be controllers, within the meaning of Article 3, point (8), of Directive (EU) 2016/680 in relation to the processing of API data constituting personal data under this Regulation through the router, including transmission of the data from the router to the PIUs and storage for technical reasons of that data on the router as well as in relation to their processing of API data constituting personal data referred to in Article 4(7b) of this Regulation.

Added:Article 7 a (new): Article 7a / Personal data processor / eu-LISA shall be the processor on behalf of the PIUs within the meaning of Article 3, point (9), of Directive 2016/680 for the processing of API data constituting personal data through the router in accordance with this Regulation.

Added:Article 7 b (new): Article 7b / Information to passengers / In accordance with the right of information in Article 13 of Regulation (EU) 2016/679, air carriers shall provide passengers, on flights covered by this Regulation, with information on the purpose of the collection of their personal data, the type of personal data collected, the recipients of the personal data and the means to exercise the data subject rights. / This information shall be communicated to passengers in writing and in an easily accessible format at the moment of booking and at the moment of check-in, irrespective of the means used to collect the personal data at the moment of check-in, in accordance with Article 4.

Added:Article 8 – paragraph 1: 1. PIUs and air carriers shall ensure the security of the API data, in particular API data constituting personal data, that they process pursuant to this Regulation.

Added:Article 8 – paragraph 2: 2. PIUs and air carriers shall cooperate, in accordance with their respective responsibilities and in compliance with Union law, with each other and with eu-LISA to ensure such security.

Added:Article 8 – paragraph 2 a (new): 2a. eu-LISA shall ensure the security and encryption of the API data, in particular API data constituting personal data, that it processes pursuant to this Regulation. The PIUs and the air carriers shall ensure the security of the API data, in particular API data constituting personal data, that they process pursuant to this Regulation. eu-LISA, the PIUs and the air carriers shall cooperate, in accordance with their respective responsibilities and in compliance with Union law, with each other to ensure such security.

Added:Article 8 – paragraph 2 b (new): 2b. In particular, eu-LISA shall take the necessary measures to ensure the security of the router and the API data, in particular API data constituting personal data, transmitted through the router, including by establishing, implementing and regularly updating a security plan, a business continuity plan and a disaster recovery plan, in order to: / (a) physically protect the router, including by making contingency plans for the protection of critical components thereof; / (b) prevent any unauthorised processing of the API data, including any unauthorised access thereto and copying, modification or deletion thereof, both during the transfer of the API data to and from the router and during any storage of the API data on the router where necessary to complete the transmission, in particular by means of appropriate encryption techniques; / (c) ensure that it is possible to verify and establish to which PIUs the API data is transmitted through the router; / (d) properly report to its Management Board any faults in the functioning of the router; / (e) monitor the effectiveness of the security measures required under this Article and under Regulation (EU) 2018/1725, and assess and update those security measures where necessary in the light of technological or operational developments. / The measures referred to in the first subparagraph of this paragraph shall not affect Article 33 of Regulation (EU) 2018/1725 and Article 32 of Regulation (EU) 2016/679.

Added:Article 9 a (new): Article 9a / Personal data protection audits / 1. The independent supervisory authorities referred to in Article 41 of Directive 2016/680 shall ensure that an audit of processing operations of API data constituting personal data performed by the PIUs for the purposes of this Regulation is carried out, in accordance with relevant international auditing standards, at least once every four years. / 2. The European Data Protection Supervisor shall carry out an audit of processing operations of API data constituting personal data performed by eu-LISA for the purposes of this Regulation, in accordance with relevant international auditing standards at least once every year. A report of that audit shall be sent to the European Parliament, to the Council, to the Commission, to the Member States and to eu-LISA. eu-LISA shall be given an opportunity to make comments before the reports are adopted. / 3. In relation to the processing operations referred to in paragraph 2, upon request, eu-LISA shall supply information requested by the European Data Protection Supervisor, shall grant the European Data Protection Supervisor access to all the documents it requests and to the logs referred to in Article 6, and shall allow the European Data Protection Supervisor access to all eu-LISA’s premises at any time.

Added:Article 10 – paragraph 1 – subparagraph 2: Member States shall ensure that the connection to the router and integration with it enables their PIUs to receive and further process the API data, as well as to exchange any communications relating thereto, in a lawful, secure, effective and swift manner

Added:Article 10 – paragraph 2: 2. The Commission is empowered to adopt delegated acts in accordance with Article 19 to supplement this Regulation by laying down the necessary detailed rules on the connections to and integration with the router referred to in paragraph 1, including on requirements for data security.

Added:Article 11 – paragraph 2: 2. The Commission is empowered to adopt delegated acts in accordance with Article 19 to supplement this Regulation by laying down the necessary detailed rules on the connections to and integration with the router referred to in paragraph 1, including on data security requirements.

Added:Article 11 a (new): Article 11a / eu-LISA’s tasks relating to the design and development of the router / 1. eu-LISA shall be responsible for the design of the physical architecture of the router, including defining the technical specifications. / 2. eu-LISA shall be responsible for the development of the router, including for any technical adaptations necessary for the operation of the router. The development of the router shall consist of the elaboration and implementation of the technical specifications, testing and overall project management and the coordination of the development phase. / 3. eu-LISA shall ensure that the router is designed and developed in such a manner that the router provides the functionalities specified in this Regulation, and that the router starts operations as soon as possible after the adoption by the Commission of the delegated acts provided for in 4(5) and (9), Article 5(3), Article 10(2), Article 11(2) and after the carrying out of a data protection impact assessment in accordance with Article 35 of Regulation (EU) 2016/679. / 4. Where eu-LISA considers that the development phase has been completed, it shall, without undue delay, conduct a comprehensive test of the router, in cooperation with the PIUs and other relevant Member States’ authorities and air carriers and inform the Commission of the outcome of that test.

Added:Article 11 b (new): Article 11b / eu-LISA’s tasks relating to the hosting and technical management of the router / 1. eu-LISA shall host the router in its technical sites. / 2. eu-LISA shall be responsible for the technical management of the router, including its maintenance and technical developments, in such a manner as to ensure that the API data are securely, effectively and swiftly transmitted through the router, in compliance with this Regulation. / The technical management of the router shall consist of carrying out all the tasks and enacting all technical solutions necessary for the proper functioning of the router in accordance with this Regulation, in an uninterrupted manner, 24 hours a day, 7 days a week. It shall include the maintenance work and technical developments necessary to ensure that the router functions at a satisfactory level of technical quality, in particular as regards availability, accuracy and reliability of the transmission of API data, in accordance with the technical specifications and, as much as possible, in line with the operational needs of the PIUs and air carriers. / 3. eu-LISA shall not have access to any of the API data that is transmitted through the router. However, that prohibition shall not preclude eu-LISA from having such access insofar as strictly necessary for the maintenance of the router. / 4. Without prejudice to paragraph 3 of this Article and to Article 17 of Council Regulation (EEC, Euratom, ECSC) No 259/681a, eu-LISA shall apply appropriate r…

Added:Article 11 c (new): Article11c / eu-LISA’s support tasks relating to the router / 1. eu-LISA shall, upon their request, provide training to PIUs and other relevant Member States’ authorities and air carriers on the technical use of the router and on the connection and integration to the router. / 2. eu-LISA shall provide support to the PIUs regarding the reception of API data through the router pursuant to this Regulation, in particular as regards the application of Articles 5 and 10 of this Regulation.

Added:Article 12 – title: Costs for eu-Lisa and of Member States

Added:Article 12 – paragraph -1 (new): -1. Costs incurred by eu-LISA in relation to the design, development, hosting and technical management of the router under this Regulation shall be borne by the general budget of the Union. In view of the Union interests at stake, in relation to its responsibilities for the design, development, hosting and technical management and maintenance of the router, eu-LISA shall be provided with the necessary resources under the Union budget in accordance with the applicable legislation.

Added:Article 12 – paragraph 1 – subparagraph 1: Costs incurred by eu-LISA and the Member States in relation to their connections to and integration with the router referred to in Article 10 shall be borne by the general budget of the Union.

Added:Article 12 – paragraph 1 a (new): 1a. Costs incurred by the European Data Protection Supervisor in relation to the tasks entrusted to it under this Regulation shall be borne by the general budget of the Union.

Added:Article 12 – paragraph 1 b (new): 1b. Costs incurred by independent national supervisory authorities in relation to the tasks entrusted to them under this Regulation shall be borne by the Member States.

Added:Article 12 – paragraph 2: 2. The Member States shall also bear the costs arising from the administration, use and maintenance of their connections to and integration with the router.

Added:Article 13: deleted

Added:Article 14 a (new): Article 14a / Start of operations of the router / The Commission shall determine, without undue delay, the date from which the router starts operations by means of an implementing act once eu-LISA has informed the Commission of the successful completion of the comprehensive test of the router referred to in Article 11a (4). That implementing act shall be adopted in accordance with the examination procedure referred to in Article 18a (2). / The Commission shall set the date referred to in the first subparagraph to be no later than 30 days from the date of the adoption of that implementing act.

Added:Article 14 b (new): Article 14b / Voluntary use of the router in application of Directive 2004/82/EC / 1. Air carriers shall be entitled to use the router to transmit the information referred to in Article 3(1) of Directive 2004/82/EC to one or more of the responsible PIUs referred to therein, in accordance with that Directive, provided that the responsible PIU concerned has agreed with such use, from an appropriate date set by that PIU. That PIU shall only agree after having established that, in particular as regards both its own connection to the router and that of the air carrier concerned, the information can be transmitted in a lawful, secure, effective and swift manner. / 2. Where an air carrier starts using the router in accordance with paragraph 1, it shall continue using the router to transmit such information to the responsible PIU concerned until the date of application of this Regulation referred to in Article 21, second subparagraph. However, that use shall be discontinued, from an appropriate date set by that PIU, where that PIU considers that there are objective reasons that require such discontinuation and has informed the air carrier accordingly. / 3. The responsible PIU concerned shall: / (a) consult eu-LISA before agreeing with the voluntary use of the router in accordance with paragraph 1; / (b) except in situations of duly justified urgency, afford the air carrier concerned an opportunity to comment on its intention to discontinue such use in accordance with paragraph 2 and,…

Added:Article 14 c (new): Article 14c / Use of the router for PNR data / The provisions of Chapters 3 and 4 shall apply mutatis mutandis to the mandatory transfer and transmission of PNR data through the router.

Added:Article 16 – paragraphs 1 and 2: 1. Member States shall lay down the rules on penalties applicable to infringements of this Regulation and shall take all measures necessary to ensure they are implemented. The penalties provided for shall be effective, proportionate and dissuasive penalties.

Added:Article 16 – paragraph 1 a (new): 1a. Member States shall ensure that when deciding whether to impose a penalty and when determining the type and level of penalty, the national supervisory authorities take into account relevant circumstances, which may include: / (a) the nature, gravity and duration of the infringement; / (b) the degree of the air carrier's fault; / (c) previous infringements by the air carrier; / (d) the overall level of cooperation of the air carrier with the competent authorities; / (e) the size of the air carrier, such as the annual number of passengers carried; / (f) whether previous penalties have already been applied by other national API supervisory authorities to the same carrier for the same infringement.

Added:Article 16 – paragraph 1 b (new): 1b. Member States shall ensure that a systematic or persistent failure to comply with obligations set out in this Regulation is subject to financial penalties of up to 2% of an Air Carrier's global turnover of the preceding business year.

Added:Article 16 a (new): Article16a / Statistics / 1. To support the implementation and supervision of this Regulation and based on the statistical information referred to in paragraph 5 of this Article, eu-LISA shall publish every quarter statistics on the functioning of the router, and on compliance by air carriers with the obligations set out in this Regulation. Those statistics shall not allow for the identification of individuals. / The statistics shall show in particular: / (a) the number of passengers on which API and PNR data is transmitted, / (b) the number of flights for which API and PNR data is transmitted, / (c) the number of flights on which API and PNR data is not transmitted, / (d) the number of API and PNR messages transmitted on time to PIUs, / (e) the number of passengers who boarded the aircraft with inaccurate, incomplete or no longer up-to-date API data, with a non-recognised travel document. / 2. For the purposes set out in paragraph 1, the router shall automatically transmit the data listed in paragraph 5 to the central repository for reporting and statistics established in Article 39 of Regulation (EU) 2019/818. / 3. In order to support the implementation and supervision of this Regulation, at the end of each year, eu-LISA shall compile statistical data in an annual report for that year. It shall publish that annual report and transmit it to the European Parliament, the Council, the Commission, the European Data Protection Supervisor, the European Border and Coast Guard Agenc…

Added:Article 17 – paragraph 1: The Commission shall, in close cooperation with the PIUs, other relevant Member States’ authorities, the air carriers and relevant Union agencies, in particular the European Data Protection Supervisor and the Fundamental Rights Agency, prepare and make publicly available a practical handbook, containing guidelines, recommendations and best practices for the implementation of this Regulation, including on fundamental rights compliance as well as on penalties in accordance with Article 16.

Added:Article 17 a (new): Article 17a / API Expert Group / 1. An API Expert Group shall be established with effect from ... [one month from the date of entry into force of this Regulation] in accordance with the horizontal rules on the creation and operation of Commission expert groups. It shall facilitate cooperation and the exchange of information on obligations stemming from and issues relating to this Regulation among Member States, EU institutions and stakeholders. / 2. The API Expert Group shall be composed of representatives of the European Commission, Member States’ relevant authorities, the European Parliament and eu-LISA. Where relevant for the performance of its tasks, the API Expert Group may invite relevant stakeholders, in particular representatives of air carriers, the EDPS and the independent national supervisory authorities, to participate in its work. The Commission’s representative shall chair the API Expert Group.

Added:Regulation (EU) 2019/818

Added:Article 18 – paragraph 1, Article 39 – paragraph 2: “2. eu-LISA shall establish, implement and host in its technical sites the CRRS containing the data and statistics referred to in Article 74 of Regulation (EU) 2018/1862 and Article 32 of Regulation (EU) 2019/816 logically separated by EU information system. eu-LISA shall also collect the data and statistics from the router referred to in Article 13(1) of Regulation (EU) …/… * [this Regulation ]. Access to the CRRS shall be granted by means of controlled, secured access and specific user profiles, solely for the purpose of reporting and statistics, to the authorities referred to in Article 74 of Regulation (EU) 2018/1862, Article 32 of Regulation (EU) 2019/816 and Article 13(1) of Regulation (EU) …/… * [this Regulation ]. Especially the use of the CRRS for risk analysis, profiling or predictive risk assessment shall be prohibited.”

Added:Article 18 a (new): Article 18a / Committee Procedure / 1. The Commission shall be assisted by a committee. That committee shall be a committee within the meaning of Regulation (EU) No 182/2011. / 2. Where reference is made to this paragraph, Article 5 of Regulation (EU) No 182/2011 shall apply. Where the committee delivers no opinion, the Commission shall not adopt the draft implementing act and Article 5(4), the third subparagraph, of Regulation (EU) No 182/2011 shall apply.

Added:Article 19 – paragraph 2: 2. The power to adopt delegated acts referred to in Article 4(5), Article 4(7b), Article 5(3), Article 5(4) (Left 238), Article 10(2) and Article 11(2) shall be conferred on the Commission for a period of five years from [date of adoption of the Regulation]. The Commission shall draw up a report in respect of the delegation of power not later than nine months before the end of the five-year period. The delegation of power shall be tacitly extended for periods of an identical duration, unless the European Parliament or the Council opposes such extension not later than three months before the end of each period.

Added:Article 19 – paragraph 3: 3. The delegation of power referred to in Article 4(5), Article 4(7b), Article 5(3) and (4) (Left 239), Article 10(2) and Article 11(2) may be revoked at any time by the European Parliament or by the Council. A decision to revoke shall put an end to the delegation of the power specified in that decision. It shall take effect the day following the publication of the decision in the Official Journal of the European Union or at a later date specified therein. It shall not affect the validity of any delegated acts already in force.

Added:Article 20 – paragraph -1 (new): -1. eu-LISA shall ensure that procedures are in place to monitor the development of the router in light of objectives relating to planning and costs, and to monitor the functioning of the router in light of objectives relating to the technical output, cost-effectiveness, security and quality of service.

Added:Article 20 – paragraph -1 a (new): -1a. By ... [one year from the date of entry into force of this Regulation] and every year thereafter during the development phase of the router, eu-LISA shall produce a report, and submit it to the European Parliament and to the Council on the state of play of the development of the router. That report shall contain detailed information about the costs incurred and about any risks which may impact the overall costs to be borne by the general budget of the Union in accordance with Article 12. From the date at which the router starts operations and every year thereafter, the Commission shall assess whether the budget under the MFF budget line 4.11.10.02 (“eu-LISA”) covers the needs necessary for good design, development, hosting and technical management of the router and, if appropriate, immediately propose amendment to the budget appropriations.

Added:Article 20 – paragraph -1 b (new): -1b. Once the router starts operations, eu-LISA shall produce a report and submit it to the European Parliament and to the Council explaining in detail how the objectives, in particular relating to planning and costs, were achieved as well as justifying any divergences.

Added:Article 20 – paragraph 1 – introductory part: 1. By [four years after the date of entry into force of this Regulation], and every four years thereafter, the Commission shall produce a report containing an overall evaluation of this Regulation, demonstrating the necessity and added value of the collection of API data, including an assessment of:

Added:Article 20 – paragraph 1 – point c a (new): (ca) the impact of this Regulation on the travel experience of legitimate passengers;

Added:Article 20 – paragraph 1 – point c b (new): (cb) the impact of this Regulation on the competitiveness of the aviation sector and the burden incurred by businesses. The Commission’s report shall also address this Regulation’s interaction with other relevant EU legislative acts, notably Regulation (EU) 2017/2226, Regulation (EU) 2018/1240 and Regulation (EC) 767/2008, with a view to assessing the overall impact of related reporting obligations on air carriers, identify provisions that may be updated and simplified, where appropriate, to mitigate the burden on air carriers, and consider actions and measures that could be taken to reduce the total cost pressure on air carriers.

Added:Article 20 – paragraph 1 a (new): 1a. The evaluation referred to in paragraph 1 shall also include an assessment of: / (a) the necessity, proportionality and effectiveness of including the mandatory collection and transfer of API data relating to intra-EU flights within the scope of this Regulation; / (b) the feasibility of including non-commercial business aviation within the Scope of this Regulation.

Added:Article 20 – paragraph 1 b (new): 1b. The Commission shall submit the evaluation report to the European Parliament, the Council, the European Data Protection Supervisor and the European Agency for Fundamental Rights. If appropriate, in light of the evaluation conducted, the Commission shall make a legislative proposal to the European Parliament and to the Council with a view to amending this Regulation.

Added:Article 20 – paragraph 2: 2. The Member States and air carriers shall, upon request, provide the eu-LISA and the Commission with the information necessary to draft the report referred to in paragraph 1. In particular, Member States shall provide quantitative and qualitative information on the necessity and added value of the collection of API data from an operational perspective. However, Member States may refrain from providing such information if, and to the extent, necessary not to disclose confidential working methods or jeopardise ongoing investigations of their PIUs or other law enforcement authorities. The Commission shall ensure that any confidential information provided is appropriately protected.

Added:Article 21 – paragraph 2: It shall apply from two years from the date at which the router starts operations, specified by the Commission in accordance with Article 14a.

Added:Article 21 – paragraph 3: However: / (a) Article 4(5), Article 5(3) and (4), Article 10(2), Article 11(2), Article 18a and Article 19 shall apply from [Date of entry into force of this Regulation]. / (b) Article 4b, Article 6(-1), (2) and (3), Article 7, Article 7a, Article 8, Article 11b, Article 11c, Article 14 and Article 14 shall apply from the date at which the router starts operations, specified by the Commission in accordance with Article 14a.