Responsibilities of eu-LISA during the designing and development phase
1. The ETIAS Central System shall be hosted by eu-LISA in its technical sites and shall provide the functionalities laid down in this Regulation in accordance with the conditions of security, availability, quality and speed pursuant to paragraph 3 of this Article and to Article 74(1).
2. The infrastructures supporting the public website, the app for mobile devices, the email service, the secure account service, the verification tool for applicants, the consent tool for applicants, the assessment tool for the ETIAS watchlist, the carrier gateway, the web service, the software to process the applications, the central repository of data and the technical solutions referred to in Article 92(8) shall be hosted in eu-LISA sites or in Commission sites. These infrastructures shall be geographically distributed to provide the functionalities laid down in this Regulation in accordance with the conditions of security, data protection and data security, availability, quality and speed pursuant to paragraph 3 of this Article and to Article 74(1). The ETIAS watchlist shall be hosted in an eu-LISA site.
3. eu-LISA shall be responsible for the technical development of the ETIAS Information System, for any technical development required for establishing interoperability between the ETIAS Central System and the EU information systems referred to in Article 11 and for enabling querying of Interpol databases referred to in Article 12.
eu-LISA shall define the design of the physical architecture of the system including its communication infrastructure as well as its technical specifications and their evolution and the NUIs. Those technical specifications shall be adopted by eu-LISA’s Management Board, subject to a favourable opinion from the Commission. eu-LISA shall also implement any necessary adaptations to the EES, SIS, Eurodac or VIS deriving from the establishment of interoperability with ETIAS.
eu-LISA shall develop and implement the ETIAS Central System, including the ETIAS watchlist, the NUIs, and the communication infrastructure as soon as possible after the entry into force of this Regulation and the adoption by the Commission of:
(a)
the measures provided for in Articles 6(4), 16(10), 17(9), Article 31, Articles 35(7), 45(2), 54(2), 74(5), 84(2), 92(8); and
(b)
measures adopted in accordance with the examination procedure referred to in Article 90(2) necessary for the development and technical implementation of the ETIAS Central System, the NUIs, the communication infrastructure and the carrier gateway, in particular implementing acts for:
(i)
accessing the data in accordance with Articles 22 to 29 and Articles 33 to 53;
(ii)
amending, erasing and advance erasure of data in accordance with Article 55;
(iii)
keeping and accessing the logs in accordance with Article 45 and Article 69;
(iv)
performance requirements;
(v)
specifications for technical solutions to connect central access points in accordance with Articles 51 to 53.
The development shall consist of the elaboration and implementation of the technical specifications, testing and overall project coordination. In this regard, the tasks of eu-LISA shall also be to:
(a)
perform a security risk assessment;
(b)
follow the principles of privacy by design and by default during the entire lifecycle of the development of ETIAS; and
(c)
conduct a security risk assessment regarding the interoperability of ETIAS with the EU information systems and Europol data referred to in Article 11.
4. During the design and development phase, a Programme Management Board composed of a maximum of 10 members shall be established. It shall be composed of six members appointed by eu-LISA’s Management Board from among its members or its alternates, the Chair of the EES-ETIAS Advisory Group referred to in Article 91, a member representing eu-LISA appointed by its Executive Director, a member representing the European Border and Coast Guard Agency appointed by its Executive Director and one member appointed by the Commission. The members appointed by eu-LISA’s Management Board shall be elected only from those Member States which are fully bound under Union law by the legislative instruments governing the development, establishment operation and use of all the large-scale IT systems managed by eu-LISA and which will participate in ETIAS. The Programme Management Board shall meet regularly and at least three times per quarter. It shall ensure the adequate management of the design and development phase of ETIAS. The Programme Management Board shall submit written reports every month to eu-LISA’s Management Board on progress of the project. It shall have no decision-making power nor any mandate to represent the members of eu-LISA’s Management Board.
5. eu-LISA’s Management Board shall establish the rules of procedure of the Programme Management Board which shall include in particular rules on:
(a)
chairmanship;
(b)
meeting venues;
(c)
preparation of meetings;
(d)
admission of experts to the meetings;
(e)
communication plans to ensure that non-participating members of eu-LISA’s Management Board are fully informed.
The chairmanship shall be held by a Member State which is fully bound under Union law by the legislative instruments governing the development, establishment, operation and use of all the large-scale IT systems managed by eu-LISA.
All travel and subsistence expenses incurred by the members of the Programme Management Board shall be paid by eu-LISA. Article 10 of the eu-LISA Rules of Procedure shall apply mutatis mutandis . The Programme Management Board’s secretariat shall be ensured by eu-LISA.
The EES-ETIAS Advisory Group shall meet regularly until the start of operations by ETIAS. It shall report after each meeting to the Programme Management Board. It shall provide the technical expertise to support the tasks of the Programme Management Board and shall follow-up on the state of preparation of the Member States.
Responsibilities of eu-LISA following the entry into operations of ETIAS
1. Following the entry into operations of ETIAS, eu-LISA shall be responsible for the technical management of the ETIAS Central System and the NUIs. It shall also be responsible for any technical testing required for the establishment and update of the ETIAS screening rules. It shall ensure, in cooperation with the Member States that, at all times, the best available technology is used, subject to a cost-benefit analysis. eu-LISA shall also be responsible for the technical management of the communication infrastructure between the ETIAS Central System and the NUIs as well as for the public website, the app for mobile devices, the email service, the secure account service, the verification tool for applicants, the consent tool for applicants, the assessment tool for the ETIAS watchlist, the carrier gateway, the web service, the software to process the applications and the central repository of data referred to in Article 6.
Technical management of ETIAS shall consist of all the tasks necessary to keep the ETIAS Information System functioning 24 hours a day, 7 days a week in accordance with this Regulation, in particular the maintenance work and technical developments necessary to ensure that the system functions at a satisfactory level of technical quality, in particular as regards the response time for consultation of the ETIAS Central System in accordance with the technical specifications.
2. Without prejudice to Article 17 of the Staff Regulations of Officials of the European Union, laid down in Council Regulation (EEC, Euratom, ECSC) No 259/68 ( 43 ) , eu-LISA shall apply appropriate rules of professional secrecy or other equivalent duties of confidentiality to its entire staff required to work with data stored in the ETIAS Central System. That obligation shall also apply after such staff leave office or employment or after the termination of their activities.
3. Where eu-LISA cooperates with external contractors in any ETIAS-related tasks, it shall closely monitor the activities of the contractors to ensure compliance with all provisions of this Regulation, including in particular security, confidentiality and data protection.
4. eu-LISA shall also perform tasks related to providing training on the technical use of the ETIAS Information System.
5. eu-LISA shall develop and maintain a mechanism and procedures for carrying out quality checks on the data in the ETIAS Central System and shall provide regular reports to the Member States and the ETIAS Central Unit. eu-LISA shall provide a regular report to the European Parliament, the Council and the Commission covering the issues encountered. The Commission shall, by means of implementing acts, lay down and develop that mechanism, the procedures and the appropriate requirements for data quality compliance. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 90(2).
Responsibilities of the European Border and Coast Guard Agency
1. The European Border and Coast Guard Agency shall be responsible for:
(a)
the setting up and operation of the ETIAS Central Unit and ensuring the conditions for the secure management of data stored in ETIAS;
(b)
the automated processing of applications; and
(c)
the ETIAS screening rules.
2. Before being authorised to process data recorded in the ETIAS Central System, the staff of the ETIAS Central Unit having a right to access the ETIAS Central System shall be given appropriate training on data security and fundamental rights, in particular data protection. They shall also take part in training offered by eu-LISA on the technical use of the ETIAS Information System and on data quality.
Responsibilities of Member States
1. Each Member State shall be responsible for:
(a)
the connection to the NUI;
(b)
the organisation, management, operation and maintenance of the ETIAS National Units for the manual processing of applications for travel authorisation where the automated processing has reported a hit, as referred to in Article 26;
(c)
the organisation of central access points and their connection to the NUI for the purposes of preventing, detecting and investigating terrorist offences or other serious criminal offences;
(d)
the management and arrangements for access of duly authorised staff of the competent national authorities to the ETIAS Information System in accordance with this Regulation and to establish and regularly update a list of such staff and their profiles;
(e)
the set up and operation of the ETIAS National Units;
(f)
entering data into the ETIAS watchlist related to terrorist offences or other serious criminal offences pursuant to Article 34(2) and (3); and
(g)
ensuring that each of its authorities entitled to access the ETIAS Information System takes the measures necessary to comply with this Regulation, including those necessary to ensure the respect of fundamental rights and data security.
2. Each Member State shall use automated processes for querying the ETIAS Central System at the external borders.
3. Before being authorised to process data recorded in the ETIAS Central System, the staff of the ETIAS National Units having a right to access the ETIAS Information System shall be given appropriate training on data security and on fundamental rights, in particular data protection.
They shall also take part in trainings offered by eu-LISA on the technical use of the ETIAS Information System and on data quality.
Responsibilities of Europol
1. Europol shall ensure processing of the queries referred to in point (j) of Article 20(2) and in Article 20(4). It shall adapt its information system accordingly.
2. Europol shall have the responsibilities and tasks regarding the ETIAS watchlist laid down in Article 35(1) and (3) to (6).
3. Europol shall be responsible for providing a reasoned opinion following a consultation request pursuant to Article 29.
4. Pursuant to Article 34(2), Europol shall be responsible for entering data related to terrorist offences or other serious criminal offences obtained by Europol into the ETIAS watchlist.
5. Before being authorised to undertake any of the tasks referred to in Articles 34 and 35, the staff of Europol shall be given appropriate training on data security and on fundamental rights, in particular data protection. They shall also take part in training offered by eu-LISA on the technical use of the ETIAS Information System and on data quality.
Source: EUR-Lex (Publications Office of the EU), © European Union, reuse permitted under Commission Decision 2011/833/EU.
