Commission Delegated Decision (EU) 2019/969 of 22 February 2019 on the tool enabling applicants to give or withdraw their consent for an additional retention period of their application file pursuant to Article 54(2) of Regulation (EU) 2018/1240 of the European Parliament and of the Council (Text with EEA relevance.)
Data as of 2026-07-04 · Compiled from an official source version. Later amendments or repeals may not be reflected; the official text prevails. · Read the official text ↗
Access to the consent tool
The consent tool shall be accessible via: (a) the dedicated public website referred to in Article 16 of Regulation (EU) 2018/1240; (b) the app for mobile devices referred to in Article 16 of Regulation (EU) 2018/1240; (c) a link provided through the ETIAS email service referred to in point (f) of Article 6(2) of Regulation (EU) 2018/1240.
Two-factor authentication for access to the consent tool
1. In order to connect to the consent tool, two-factor authentication shall be used. 2. The first authentication shall consist of entering the following data: (a) application number; (b) travel document number. 3. Where the applicant does not provide his or her application number, the first authentication shall consist of entering following data: (a) travel document number; (b) country of issue of the travel document to be selected from a predetermined list; (c) date of issue and of expiry of the travel document; (d) first names of both parents. 4. The application number shall be the same as the one provided to applicants via the ETIAS email service on submission of their application. The other data, referred to in paragraph 2 or paragraph 3, submitted by the applicant shall be the same as those provided by them in their application form. 5. The second authentication shall consist of a unique code to be entered into the consent tool. 6. Upon submission of the information in paragraph 2 or paragraph 3, the unique code referred to in paragraph 4 shall be automatically generated and sent to the applicant through the email service referred to in point (f) of Article 6(2) of Regulation (EU) 2018/1240. 7. The unique code shall expire after a short period of time. Sending a new unique code shall invalidate unique codes previously sent to the same applicant. 8. The unique code shall be sent to the same email address provided in the submitted application. 9. The unique code shall be usable only once.
Consultation of the data via the tool
1. For the purposes of giving or withdrawing consent to prolong the storing of the application file, the tool shall inform the applicant on the data that would be retained or erased. 2. Prior to giving the consent, the applicant shall have access to: (a) a read-only version of the application form and the personal data submitted; (b) a read-only version of additional submitted documentation or information; (c) a read-only version of data added to the application file under Article 39(1), points (a) and (c) to (d) of Regulation (EU) 2018/1240, following the decision to issue the travel authorisation. 3. Prior to giving the consent, the applicant shall be informed: (a) about the fact if consent is provided, the application file is retained for an additional period of three years from the end of the validity period of the travel authorisation; (b) about the fact that consent may be withdrawn at any time until the end of the additional retention period; (c) about the fact that the data shall be retained for the purpose of facilitating a new application; (d) about the fact that the data may be used in accordance with Article 71(o) of Regulation (EU) 2018/1240; (e) about the procedures for exercising the rights under Articles 17 to 24 of Regulation (EU) 2018/1725; the contact details of the data protection officer of the European Border and Coast Guard Agency, of the European Data Protection Supervisor and of the national supervisory authority of the Member State of first intended stay where the travel authorisation has been issued by the ETIAS Central System, or of the Member State responsible where the travel authorisation has been issued by an ETIAS National Unit.
Provision of consent
1. The consent shall be given by means of an electronically signed declaration through the ticking of an appropriate box in the consent tool. 2. Following the provision of consent the applicant shall receive an email containing: (a) confirmation that the applicant's application file is retained for an additional period of three years from the end of the validity of the travel authorisation; (b) a link to the consent tool; (c) notification that the data is retained for the purpose of facilitating a new application and that those data may be used for the purposes referred to in Article 71(o) of Regulation (EU) 2018/1240; (d) notification that consent may be withdrawn at any time until the end of the additional retention period; (e) notification that the applicant is advised to retain their current application number to reuse the retained application file for the purpose of submitting a new application.
Withdrawal of consent
1. The withdrawal of the consent for the retention of the application file shall be indicated by ticking an appropriate box in consent tool. 2. Where consent is withdrawn during the validity period of the current travel authorisation, an email shall be sent to the applicant confirming that the application file will be erased after the validity period of their current travel authorisation. 3. Where consent is withdrawn during the additional period, an email shall be sent to the applicant confirming that the application file will be erased.
Communication of the tool with the Central System
1. Following a provision of consent for the retention of an application file in accordance with Article 54 of Regulation (EU) 2018/1240: (a) the consent tool shall inform the ETIAS Central System of such consent via the secure web service, referred to in point (l) of Article 6(2) of Regulation (EU) 2018/1240; (b) the ETIAS Central System shall retain the application file for a period of three years from the end of the validity period of the current travel authorisation. 2. Following a withdrawal of consent for the retention of an application file in accordance with Article 54 of Regulation (EU) 2018/1240: (a) the consent tool shall inform the ETIAS Central System of such withdrawal; (b) the ETIAS Central System shall automatically erase the application file after the validity period of their current travel authorisation or during the additional retention period of three years, if the consent is withdrawn during that period. 3. Upon expiry of its retention period, the application file shall automatically be erased from the ETIAS Central System as referred to in Article 54(3) of Regulation (EU) 2018/1240.
Message format, standards and protocols
The message format and the protocols to be implemented shall be included in the technical specifications referred to in Article 73(3) of Regulation (EU) 2018/1240.
Specific security considerations
1. The consent tool shall be designed and implemented to ensure the confidentiality, integrity and availability of processed data and to ensure non-repudiation of transactions. The technical and organisational implementation of it shall meet the requirements of the ETIAS security plan referred in Article 59(3) of Regulation (EU) 2018/1240 and of the rules on data protection and security applicable to the public website and the app for mobile devices referred to in Article 16(10) of Regulation (EU) 2018/1240. 2. The consent tool shall be designed and implemented in a way that precludes unlawful access to it. For this purpose, the consent tool shall limit the number of attempts to access the tool with the same travel document number, the same application number or the same unique code. The tool shall also include measures to protect against non-human behaviour. 3. The consent tool shall include time-out measures after some minutes of inactivity. 4. Additional details concerning the confidentiality, integrity and availability of processed data shall be subject of the technical specifications referred to in Article 73(3) of Regulation (EU) 2018/1240.
Logs
1. The consent tool shall keep activity logs, containing: (a) authentication data, including whether the authentication was successful or not; (b) date and time of access; (c) value of tick box giving or withdrawing consent. 2. Activity logs of the tool shall be copied to the Central System. They shall be stored for no longer than one year after the end of the extended retention period of the application file, unless they are required for monitoring procedures which have already begun. After that period, they shall be automatically erased. Such logs can only be used for the purpose of Article 69(4) of Regulation (EU) 2018/1240.
This Decision shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union .
Source: EUR-Lex (Publications Office of the EU), © European Union, reuse permitted under Commission Decision 2011/833/EU.