Programme Management Board
1. By 28 January 2025, eu-LISA’s Management Board shall establish a Programme Management Board. It shall be composed of 10 members and shall consist of:
(a)
seven members appointed by eu-LISA’s Management Board from among its members or its alternates;
(b)
the chair of the API-PNR Advisory Group referred to in Article 29;
(c)
one member of the eu-LISA staff appointed by its Executive Director; and
(d)
one member appointed by the Commission.
As regards point (a), the members appointed by eu-LISA’s Management Board shall be elected only from its members or its alternates from those Member States to which this Regulation applies.
2. The Programme Management Board shall draft its rules of procedure to be adopted by eu-LISA’s Management Board.
The chairpersonship shall be held by a Member State that is a member of the Programme Management Board.
3. The Programme Management Board shall supervise the effective fulfilment of eu-LISA’s tasks relating to the design and development of the router in accordance with Article 25.
Upon request of the Programme Management Board, eu-LISA shall provide detailed and updated information on the design and development of the router, including on the resources allocated by eu-LISA.
4. The Programme Management Board shall regularly, and at least three times per quarter, submit written reports on progress in the design and development of the router to eu-LISA’s Management Board.
5. The Programme Management Board shall have no decision-making power, nor any mandate to represent eu-LISA’s Management Board or its members.
6. The Programme Management Board shall cease to exist by the date of the application of this Regulation referred to in Article 45, second paragraph.
API-PNR Advisory Group
1. As from 28 January 2025, the API-PNR Advisory Group, established pursuant to Article 27(1), point (de), of Regulation (EU) 2018/1726, shall provide eu-LISA’s Management Board with the necessary expertise related to API-PNR in particular in the context of the preparation of its annual work programme and its annual activity report.
2. Whenever available, eu-LISA shall provide the API-PNR Advisory Group with versions, even intermediary ones, of the technical specifications and the compliance test sets referred to in Article 25(1), (2) and (4).
3. The API-PNR Advisory Group shall exercise the following functions:
(a)
provide expertise to eu-LISA and to the Programme Management Board on the design and development of the router in accordance with Article 25;
(b)
provide expertise to eu-LISA on the hosting and technical management of the router in accordance with Article 26;
(c)
provide its opinion to the Programme Management Board, upon its request, on the progress of the design and development of the router, including on the progress of the technical specifications and compliance test sets referred to in paragraph 2.
4. The API-PNR Advisory Group shall have no decision-making power, nor any mandate to represent the eu-LISA’s Management Board or its members.
API-PNR Contact Group
1. By the relevant date of the application of this Regulation referred to in Article 45, second paragraph, eu-LISA’s Management Board shall establish an API-PNR Contact Group.
2. The API-PNR Contact Group shall enable communication between Member States’ relevant authorities and air carriers on technical matters related to their respective tasks and obligations under this Regulation.
3. The API-PNR Contact Group shall be composed of representatives of Member States’ relevant authorities and air carriers, the chairperson of the API-PNR Advisory Group and eu-LISA’s experts.
4. eu-LISA’s Management Board shall establish the rules of procedure of the API-PNR Contact Group, following an opinion of the API-PNR Advisory Group.
5. Where deemed necessary, eu-LISA’s Management Board may also establish sub-groups of the API-PNR Contact Group to discuss specific technical matters related to the respective tasks and obligations of Member States’ relevant authorities and air carriers under this Regulation.
6. The API-PNR Contact Group, including its sub-groups, shall have no decision-making power, nor any mandate to represent the eu-LISA’s Management Board or its members.
API Expert Group
1. By the date of application of this Regulation referred to in Article 45, second paragraph, point (a), the Commission shall establish an API Expert Group in accordance with the horizontal rules on the creation and operation of Commission expert groups.
2. The API Expert Group shall enable communication among Member States’ relevant authorities, and between Member States’ relevant authorities and air carriers, on policy matters related to their respective tasks and obligations under this Regulation, including in relation to the penalties referred to in Article 38.
3. The API Expert Group shall be chaired by the Commission and constituted in accordance with the horizontal rules on the creation and operation of Commission expert groups. It shall be composed of representatives of Member States’ relevant authorities, representatives of air carriers and eu-LISA’s experts. Where relevant for the performance of its tasks, the API Expert Group may invite relevant stakeholders, in particular representatives of the European Parliament, the European Data Protection Supervisor and the independent national supervisory authorities, to participate in its work.
4. The API Expert Group shall carry out its tasks in accordance with the principle of transparency. The Commission shall publish the minutes of the meetings of the API Expert Group and other relevant documents on the Commission website.
Costs incurred by eu-LISA, the European Data Protection Supervisor, the national supervisory authorities and Member States
1. Costs incurred by eu-LISA in relation to the establishment and operation of the router under this Regulation shall be borne by the general budget of the Union.
2. Costs incurred by the Member States in relation to the implementation of this Regulation, in particular to their connection to and the integration with the router referred to in Article 23, shall be supported by the general budget of the Union, in accordance with the eligibility rules and co-financing rates set in the applicable Union legal acts.
3. Costs incurred by the European Data Protection Supervisor in relation to the tasks entrusted to it under this Regulation shall be borne by the general budget of the Union.
4. Costs incurred by independent national supervisory authorities in relation to the tasks entrusted to them under this Regulation shall be borne by the Member States.
Liability regarding the router
If a failure of a Member State or an air carrier to comply with its obligations under this Regulation causes damage to the router, that Member State or air carrier shall be liable for such damage, as provided for by the applicable Union or national law, unless and insofar as it is demonstrated that eu-LISA, another Member State or another air carrier failed to take reasonable measures to prevent the damage from occurring or to minimise its impact.
Start of operations of the router in relation to API data
The Commission shall determine, without undue delay, the date from which the router starts operations in relation to API data by means of an implementing act once eu-LISA has informed the Commission of the successful completion of the comprehensive test of the router referred to in Article 25(5). That implementing act shall be adopted in accordance with the examination procedure referred to in Article 42(2).
The Commission shall set the date referred to in the first paragraph to be no later than 30 days from the date of the adoption of that implementing act.
Start of operations of the router in relation to other PNR data
The Commission shall determine, without undue delay, the date from which the router starts operations in relation to other PNR data by means of an implementing act once eu-LISA has informed the Commission of the successful completion of the comprehensive tests of the router referred to in Article 25(6), including on the reliability of the connections of the router with air carriers and PIUs and on the readability of other PNR data transferred by air carriers and transmitted by the router in the necessary standardised format, in accordance with Article 16 of Directive (EU) 2016/681. That implementing act shall be adopted in accordance with the examination procedure referred to in Article 42(2).
The Commission shall set the date referred to in the first paragraph to be no later than 30 days from the date of the adoption of that implementing act.
Voluntary use of the router
1. Air carriers shall be entitled to use the router to transmit the information referred to in Article 3(1) and (2) of Directive 2004/82/EC or other PNR data collected pursuant to Article 8 of Directive (EU) 2016/681 to one or more of the responsible PIUs, in accordance with those Directives, provided that the Member State concerned has agreed with such use, from an appropriate date set by that Member State. That Member State shall agree only after having established that, in particular as regards both its own PIU’s connection to the router and that of the air carrier concerned, the information can be transmitted in a lawful, secure, effective and swift manner.
2. Where an air carrier starts using the router in accordance with paragraph 1 of this Article, it shall continue using the router to transmit such information to the PIU of the Member State concerned until the relevant date of application of this Regulation referred to in Article 45, second paragraph. However, that use shall be discontinued, from an appropriate date set by that Member State, where that Member State considers that there are objective reasons that require such discontinuation and has informed the air carrier accordingly.
3. The Member State concerned shall:
(a)
consult eu-LISA before agreeing with the voluntary use of the router in accordance with paragraph 1;
(b)
except in situations of duly justified urgency, afford the air carrier concerned an opportunity to comment on its intention to discontinue such use in accordance with paragraph 2 and, where relevant, also consult eu-LISA thereon;
(c)
immediately inform eu-LISA and the Commission of any such use to which it agreed and any discontinuation of such use, providing all necessary information, including the date of the start of the use, the date of the discontinuation and the reasons for the discontinuation, as applicable.
Source: EUR-Lex (Publications Office of the EU), © European Union, reuse permitted under Commission Decision 2011/833/EU.
