1Regulation (EU) 2024/1356 of the European Parliament and of the Council of 14 May 2024 introducing the screening of third-country nationals at the external borders and amending Regulations (EC) No 767/2008, (EU) 2017/2226, (EU) 2018/1240 and (EU) 2019/817

(2) Article 9 is amended as follows:

(a) the following paragraph is inserted:

2b.

The duly authorised staff of the screening authorities as defined in Article 2, point (10), of Regulation (EU) 2024/1356 shall have access to the EES to consult EES data.;

(b) paragraph 4 is replaced by the following:

1. Access to the EES data stored in the CIR shall be reserved exclusively for the duly authorised staff of the national authorities of each Member State and for the duly authorised staff of the Union agencies that are competent for the purposes laid down in Articles 20, 20a and 21 of Regulation (EU) 2019/817 and in Articles 20, 20a and 21 of Regulation (EU) 2019/818 of the European Parliament and of the Council

Regulation (EU) 2019/818 of the European Parliament and of the Council of 20 May 2019 on establishing a framework for interoperability between EU information systems in the field of police and judicial cooperation, asylum and migration and amending Regulations (EU) 2018/1726, (EU) 2018/1862 and (EU) 2019/816 (OJ L 135, 22.5.2019, p. 85).;

. Such access shall be limited according to the extent that the data are required for the performance of their tasks for those purposes, and proportionate to the objectives pursued.

(3) the following Article is inserted:

Article 24a

Access to data for the security check for the purposes of the screening

The screening authorities as defined in Article 2, point (10), of Regulation (EU) 2024/1356 shall have access to the EES to consult the data in order to perform a security check in accordance with Article 15(2) of that Regulation.

A search in accordance with this Article shall be performed by using the data referred to in Article 14(1) of Regulation (EU) 2024/1356 and the EES shall return a hit where a refusal of entry record based on the grounds provided for in points B, D, H, I and J of Part B of Annex V to Regulation (EU) 2016/399 is linked to a matching individual file. Where a hit is obtained, the screening authorities shall have access to all relevant data in the file.

If the individual file does not include any biometric data, the screening authorities may proceed to access the biometric data of the person concerned and verify correspondence in VIS in accordance with Article 6 of Regulation (EC) No 767/2008.;

(4) in Article 46(1), point (a) is replaced by the following:

(a) the purpose of the access referred to in Article 9(2), (2a) and (2b)..

Article 22

Amendments to Regulation (EU) 2018/1240

Regulation (EU) 2018/1240 is amended as follows:

(1) in Article 4, the following point is inserted:

(eb) support the purposes of Regulation (EU) 2024/1356 of the European Parliament and of the Council

Regulation (EU) 2024/1356 of the European Parliament and of the Council of 14 May 2024 introducing the screening of third country nationals at the external borders and amending Regulations (EC) No 767/2008, (EU) 2017/2226, (EU) 2018/1240 and (EU) 2019/817 (OJ L, 2024/1356, 22.5.2024, ELI: http://data.europa.eu/eli/reg/2024/1356/oj).;

;

(2) in Article 8(2), the following point is added:

(i) providing opinions in accordance with Article 35a.;

(3) Article 13 is amended as follows:

(a) paragraph 4a is replaced by the following:

4a.

Access to the ETIAS identity data and travel document data stored in the CIR shall also be reserved exclusively for the duly authorised staff of the national authorities of each Member State and for the duly authorised staff of the Union agencies that are competent for the purposes laid down in Articles 20, 20a and 21 of Regulation (EU) 2019/817. Such access shall be limited according to the extent that the data are required for the performance of their tasks for those purposes, and proportionate to the objectives pursued.;

(b) the following paragraph is inserted:

4b.

The screening authorities as defined in Article 2, point (10), of Regulation (EU) 2024/1356 (the screening authorities) shall also have access to ETIAS to consult the data in order to perform the checks in accordance with Article 15(2) of that Regulation.

A search in accordance with this paragraph shall be performed by using the data referred to in Article 14(1), points (a) and (b), of Regulation (EU) 2024/1356 and ETIAS shall return a hit where a decision refusing, annulling or revoking a travel authorisation based on Article 28(7) or on Article 37(1), points (a), (b) and (e), of this Regulation is included in a matching application file.

Where a hit is obtained, the screening authorities shall have access to all relevant data in the file.

If the search carried in accordance with this paragraph indicates that there is a correspondence between the data used for the search and the data recorded in the ETIAS watchlist referred to in Article 34, the ETIAS National Unit or Europol having entered the data in the ETIAS watchlist shall be notified of the correspondence and shall be responsible for accessing the data in the ETIAS watchlist and for providing an opinion in accordance with Article 35a.;

(c) paragraph 5 is replaced by the following:

1. Each Member State shall designate the competent national authorities referred to in paragraphs 1, 2, 4 and 4a of this Article, and the screening authorities referred to in paragraph 4b of this Article, and shall communicate a list of those authorities to eu-LISA without delay, in accordance with Article 87(2) of this Regulation. That list shall specify for which purpose the duly authorised staff of each authority shall have access to the data in the ETIAS Information System in accordance with paragraphs 1, 2, 4 and 4a of this Article.;

(4) the following Article is inserted:

Article 35a

Tasks of the ETIAS National Unit and Europol regarding the ETIAS watchlist for the purpose of the screening

1. In cases referred to in Article 13(4b), fourth subparagraph, the ETIAS Central System shall send an automated notification to either the ETIAS National Unit or to Europol, depending on which of them entered the data into the ETIAS watchlist. Where the ETIAS National unit or Europol, as appropriate, considers that the third-country national undergoing the screening might pose a threat to internal security, it shall immediately notify the respective screening authorities and provide a reasoned opinion to the Member State performing the screening, within two days of the receipt of the notification, in the following manner:

(a) the ETIAS National Units shall inform the screening authorities through a secure communication mechanism, to be set up by eu-LISA, between the ETIAS National Units on the one part and the screening authorities on the other;

(b) Europol shall inform the screening authorities using the communication channels provided for in Regulation (EU) 2016/794; if no opinion is provided, it shall be considered that there is no security risk.

1. The automated notification referred to in paragraph 1 of this Article shall contain the data referred to in Article 15(2) of Regulation (EU) 2024/1356 used for the query.;

(5) in Article 69(1), the following point is inserted:

(ea) where relevant, a reference to queries entered in the ETIAS Central System for the purposes of Articles 14 and 15 Regulation (EU) 2024/1356, the hits triggered and the results of this query;.

Article 23

Amendments to Regulation (EU) 2019/817

Regulation (EU) 2019/817 is amended as follows:

(1) in Article 7, paragraph 2 is replaced by the following:

1. The Member State authorities and Union agencies referred to in paragraph 1 of this Article shall use the ESP to search data related to persons or their travel documents in the central systems of the EES, VIS and ETIAS in accordance with their access rights as referred to in the legal instruments governing those EU information systems and in national law. They shall also use the ESP to query the CIR in accordance with their access rights under this Regulation for the purposes referred to in Articles 20, 20a, 21 and 22.;

(2) Article 17 is amended as follows:

(a) paragraph 1 is replaced by the following:

1. A common identity repository (CIR), creating an individual file for each person that is registered in the EES, VIS, ETIAS, Eurodac or ECRIS-TCN containing the data referred to in Article 18, is established for the purpose of facilitating and assisting in the correct identification of persons registered in the EES, VIS, ETIAS, Eurodac and ECRIS-TCN in accordance with Articles 20 and 20a, of supporting the functioning of the MID in accordance with Article 21 and of facilitating and streamlining access by designated authorities and Europol to the EES, VIS, ETIAS and Eurodac, where necessary for the prevention, detection or investigation of terrorist offences or other serious criminal offences in accordance with Article 22.;

(b) paragraph 4 is replaced by the following:

1. Where it is technically impossible because of a failure of the CIR to query the CIR for the purpose of identifying a person pursuant to Article 20 or for the purpose of identification or verification of identity of a person pursuant to Article 20a, for the detection of multiple identities pursuant to Article 21 or for the purposes of preventing, detecting or investigating terrorist offences or other serious criminal offences pursuant to Article 22, the CIR users shall be notified by eu-LISA in an automated manner.;

(3) in Article 18, paragraph 3 is replaced by the following:

1. The authorities accessing the CIR shall do so in accordance with their access rights under the legal instruments governing the EU information systems, and under national law and in accordance with their access rights under this Regulation for the purposes referred to in Articles 20, 20a, 21 and 22.;

(4) the following Article is inserted:

Article 20a

Access to the common identity repository for identification or verification of identity according to Regulation (EU) 2024/1356 of the European Parliament and of the Council

Regulation (EU) 2024/1356 of the European Parliament and of the Council of 14 May 2024 introducing the screening of third country nationals at the external borders and amending Regulations (EC) No 767/2008, (EU) 2017/2226, (EU) 2018/1240 and (EU) 2019/817 (OJ L, 2024/1356, 22.5.2024, ELI: http://data.europa.eu/eli/reg/2024/1356/oj).;

1. Queries of the CIR shall be carried out by the screening authorities as defined in Article 2, point (10), of Regulation (EU) 2024/1356 (the screening authorities) solely for the purpose of identification or verification of identity of a person according to Article 14 of that Regulation, provided that the process was initiated in the presence of that person.

1. Where the query indicates that data on that person are stored in the CIR, the screening authorities shall have access to consult the data referred to in Article 18(1) of this Regulation as well as to the data referred to in Article 18(1) of Regulation (EU) 2019/818.

(5) Article 24 is amended as follows:

(a) paragraph 1 is replaced by the following:

1. Without prejudice to Article 46 of Regulation (EU) 2017/2226, Article 34 of Regulation (EC) No 767/2008 and Article 69 of Regulation (EU) 2018/1240, eu-LISA shall keep logs of all data processing operations in the CIR in accordance with paragraphs 2, 2a, 3 and 4 of this Article.;

(b) the following paragraph is inserted:

2a.

eu-LISA shall keep logs of all data processing operations pursuant to Article 20a in the CIR. Those logs shall include the following:

(a) the Member State launching the query;

(b) the purpose of access of the user querying via the CIR;

(c) the date and time of the query;

(d) the type of data used to launch the query;

(e) the results of the query.;

(c) in paragraph 5, the first subparagraph is replaced by the following:

Each Member State shall keep logs of queries that its authorities and the staff of those authorities duly authorised to use the CIR make pursuant to Articles 20, 20a, 21 and 22. Each Union agency shall keep logs of queries that its duly authorised staff make pursuant to Articles 21 and 22..

Article 24

Evaluation

By 12 June 2028, the Commission shall report on the implementation of the measures set out in this Regulation.

By 12 June 2031, and every five years thereafter, the Commission shall carry out an evaluation of this Regulation. The Commission shall present a report on the main findings to the European Parliament, the Council and the European Economic and Social Committee. Member States shall provide the Commission all information necessary for the preparation of that report, by 12 December 2030, and every five years thereafter.

Article 25

Entry into force

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

It shall apply from 12 June 2026.

The provisions laid down in Articles 14 to 16 related to queries to EU information systems, the CIR and the ESP shall start to apply only once the individual relevant information systems, the CIR and ESP enter into operation.

This Regulation shall be binding in its entirety and directly applicable in the Member States in accordance with the Treaties.

Done at Brussels, 14 May 2024.

For the European Parliament

The President

R. Metsola

For the Council

The President

H. Lahbib