PIUs’ connections to the router
1. Member States shall ensure that their PIUs are connected to the router. They shall ensure that their national systems and infrastructure for the reception and further processing of API data and other PNR data transferred pursuant to this Regulation are integrated with the router.
Member States shall ensure that the connection to the router and integration with it enables their PIUs to receive and further process those API data and other PNR data, as well as to exchange any communications relating thereto, in a lawful, secure, effective and swift manner.
2. The Commission shall adopt implementing acts specifying the necessary detailed rules on the connections to and integration with the router referred to in paragraph 1 of this Article, including on requirements for data security. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 42(2).
Air carriers’ connections to the router
1. Air carriers shall ensure that they are connected to the router. They shall ensure that their systems and infrastructure for the transfer of API data and other PNR data to the router pursuant to this Regulation are integrated with the router.
Air carriers shall ensure that the connection to the router and the integration with it enables them to transfer those API data and other PNR data as well as to exchange any communications relating thereto, in a lawful, secure, effective and swift manner. To that end, air carriers shall conduct tests of the transfer of API data and other PNR data to the router in cooperation with eu-LISA in accordance with Article 27(3).
2. The Commission shall adopt implementing acts specifying the necessary detailed rules on the connections to and integration with the router referred to in paragraph 1 of this Article, including on requirements for data security. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 42(2).
eu-LISA’s tasks relating to the design and development of the router
1. eu-LISA shall be responsible for the design of the physical architecture of the router, including defining its technical specifications.
2. eu-LISA shall be responsible for the development of the router, including for any technical adaptations necessary for the operation of the router.
The development of the router shall consist of the elaboration and implementation of the technical specifications, testing and overall project management and coordination of the development phase.
3. eu-LISA shall ensure that the router is designed and developed in such a manner that the router provides the functionalities specified in this Regulation, and that the router starts operations as soon as possible after the adoption by the Commission of the delegated acts provided for in Article 4(12), Article 5(3), Article 7(2), and of the implementing acts provided for in Article 11(5), Article 12(4), Article 23(2), Article 24(2) of this Regulation, and of the implementing acts provided for in Article 16(3) of Directive (EU) 2016/681, and after the carrying out of a data protection impact assessment in accordance with Article 35 of Regulation (EU) 2016/679.
4. eu-LISA shall provide PIUs, other relevant Member States’ authorities and air carriers with a compliance test set. The compliance test set shall include a test environment, a simulator, test data sets and a test plan. The compliance test set shall allow for comprehensive tests of the router referred to in paragraphs 5 and 6 and it shall remain available after the completion of those tests.
5. Where eu-LISA considers that the development phase has been completed in relation to API data, it shall, without undue delay, conduct a comprehensive test of the router, in cooperation with the PIUs and other relevant Member States’ authorities and air carriers and inform the Commission of the outcome of that test.
6. Where eu-LISA considers that the development phase has been completed in relation to other PNR data, it shall, without undue delay, conduct comprehensive tests of the router to ensure the reliability of the connections of the router with air carriers and PIUs, the necessary standardised transmission of other PNR data by air carriers and the transfer and transmission of other PNR data in accordance with Article 16 of Directive (EU) 2016/681, including the use of the common protocols and supported standardised data formats referred to in Article 16, paragraphs 2 and 3, of that Directive to ensure the readability of the other PNR data. Such tests shall be conducted in cooperation with the PIUs and other relevant Member States’ authorities and air carriers. eu-LISA shall inform the Commission of the outcome of those tests.
eu-LISA’s tasks relating to the hosting and technical management of the router
1. eu-LISA shall host the router in its technical sites.
2. eu-LISA shall be responsible for the technical management of the router, including its maintenance and technical developments, in such a manner as to ensure that the API data and other PNR data are securely, effectively and swiftly transmitted through the router, in compliance with this Regulation.
The technical management of the router shall consist of carrying out all the tasks and enacting all technical solutions necessary for the proper functioning of the router in accordance with this Regulation, in an uninterrupted manner, 24 hours a day, 7 days a week. It shall include the maintenance work and technical developments necessary to ensure that the router functions at a satisfactory level of technical quality, in particular as regards availability, accuracy and reliability of the transmission of API data and other PNR data, in accordance with the technical specifications and, as much as possible, in line with the operational needs of the PIUs and air carriers.
3. eu-LISA’s staff shall not have access to any of the API data or other PNR data that are transmitted through the router. However, that prohibition shall not preclude eu-LISA’s staff from having such access insofar as strictly necessary for the maintenance and technical management of the router.
4. Without prejudice to paragraph 3 of this Article and to Article 17 of the Staff Regulations of Officials of the European Union, laid down in Council Regulation (EEC, Euratom, ECSC) No 259/68 ( 22 ) , eu-LISA shall apply appropriate rules of professional secrecy or other equivalent duties of confidentiality to its staff required to work with API data and other PNR data transmitted through the router. This obligation shall also apply after such staff leave office or employment or after the termination of their activities.
eu-LISA’s support tasks relating to the router
1. eu-LISA shall, upon the request of PIUs, other relevant Member States’ authorities or air carriers, provide training to them on the technical use of the router and on their connection to and integration with the router.
2. eu-LISA shall provide support to the PIUs regarding the reception of API data and other PNR data through the router pursuant to this Regulation in particular as regards the application of Articles 12 and 23.
3. In accordance with Article 24(1) and making use of the compliance test set referred to in Article 25(4), eu-LISA shall conduct, in cooperation with air carriers, tests of the transfer of API data and other PNR data to the router.
Source: EUR-Lex (Publications Office of the EU), © European Union, reuse permitted under Commission Decision 2011/833/EU.
