National API supervision authority
1. Member States shall designate one or more national API supervision authorities responsible for monitoring the application within their territory by air carriers of the provisions of this Regulation and ensuring compliance with those provisions.
2. Member States shall ensure that the national API supervision authorities have all the means and all the investigative and enforcement powers necessary to carry out their tasks under this Regulation, including by imposing the penalties referred to in Article 38 where appropriate. Member States shall ensure that the exercise of the powers conferred on the national API supervision authority is subject to appropriate safeguards in compliance with the fundamental rights guaranteed under Union law.
3. Member States shall, by the relevant date of application of this Regulation referred to in Article 45, second paragraph, notify the Commission of the name and the contact details of the authorities that they designated under paragraph 1 of this Article. They shall notify the Commission without delay of any subsequent changes or amendments thereto.
4. This Article is without prejudice to the powers of the supervisory authorities referred to in Article 51 of Regulation (EU) 2016/679, Article 41 of Directive (EU) 2016/680 and Article 15 of Directive (EU) 2016/681.
Penalties
1. Member States shall lay down the rules on penalties applicable to infringements of this Regulation and shall take all measures necessary to ensure that they are implemented. The penalties provided for shall be effective, proportionate and dissuasive.
2. Member States shall, by the relevant date of application of this Regulation referred to in Article 45, second paragraph, notify the Commission of those rules and of those measures and shall notify it, without delay, of any subsequent amendment affecting them.
3. Member States shall ensure that the national API supervision authorities, when deciding whether to impose a penalty and when determining the type and level of penalty, take into account relevant circumstances, which may include:
(a)
the nature, gravity and duration of the infringement;
(b)
the degree of the air carrier’s fault;
(c)
previous infringements by the air carrier;
(d)
the overall level of cooperation of the air carrier with the competent authorities;
(e)
the size of the air carrier, such as the annual number of passengers carried;
(f)
whether previous penalties have already been applied by other national API supervision authorities to the same air carrier for the same infringement.
4. Member States shall ensure that a recurrent failure to transfer API data in accordance with Article 5(1) is subject to proportionate financial penalties of up to 2 % of the air carrier’s global turnover of the preceding financial year. Member States shall ensure that failure to comply with other obligations set out in this Regulation is subject to proportionate penalties, including financial penalties.
Statistics
1. In order to support the implementation and monitoring of the application of this Regulation, and on the basis of the statistical information referred to in paragraphs 5 and 6, eu-LISA shall publish every quarter statistics on the functioning of the router and on the compliance of air carriers with the obligations set out in this Regulation. Those statistics shall not allow for the identification of individuals.
2. For the purposes set out in paragraph 1, the router shall automatically transmit the data listed in paragraphs 5 and 6 to the CRRS.
3. In order to support the implementation and monitoring of the application of this Regulation, each year, eu-LISA shall compile statistical data in an annual report for the previous year. It shall publish that annual report and transmit it to the European Parliament, the Council, the Commission, the European Data Protection Supervisor, the European Border and Coast Guard Agency and the national API supervision authorities referred to in Article 37. The annual report shall not disclose confidential working methods or jeopardise ongoing investigations of the Member States’ competent authorities.
4. At the request of the Commission, eu-LISA shall provide it with statistics on specific aspects related to the implementation of this Regulation as well as the statistics pursuant to paragraph 3.
5. The CRRS shall provide eu-LISA with the following statistical information necessary for the reporting referred to in Article 44 and for generating statistics in accordance with this Article, without such statistics on API data allowing for the identification of the passengers concerned:
(a)
whether the data concern a passenger or a crew member;
(b)
the nationality, sex and year of birth of the passenger or crew member;
(c)
the date and the initial point of embarkation, the date and airport of departure, and the date and airport of arrival;
(d)
the type of travel document, the three-letter code of the issuing country and the date of expiry of the validity of the travel document;
(e)
the number of passengers checked-in on the same flight;
(f)
the code of the air carrier operating the flight;
(g)
whether the flight is a scheduled or a non-scheduled flight;
(h)
whether API data were transferred immediately after flight closure;
(i)
whether the personal data of the passenger are accurate, complete and up to date;
(j)
the technical means used to capture the API data.
6. The CRRS shall provide eu-LISA with the following statistical information necessary for the reporting referred to in Article 44 and for generating statistics in accordance with this Article, without such statistics on other PNR data allowing for the identification of the passengers concerned:
(a)
the date and time the PNR message was received by the router;
(b)
flight information contained in the travel itinerary in the specific PNR message;
(c)
code share information contained in the specific PNR message.
7. For the purposes of the reporting referred to in Article 44 and for generating statistics in accordance with this Article, eu-LISA shall store the data referred to in paragraphs 5 and 6 of this Article in the CRRS. It shall store such data for a period of five years in accordance with paragraph 2, while ensuring that the data do not allow for the identification of the passengers concerned. The CRRS shall provide the duly authorised staff of the PIUs and other relevant authorities of the Member States with customisable reports and statistics on API data as referred to in paragraph 5 of this Article and other PNR data as referred to in paragraph 6 of this Article for the implementation and monitoring of the application of this Regulation.
8. The use of the data referred to in paragraphs 5 and 6 of this Article shall not result in the profiling of individuals as referred to in Article 11(3) of Directive (EU) 2016/680 or discrimination against persons on the grounds listed in Article 21 of the Charter. The data referred to in paragraph 5 and paragraph 6 of this Article shall not be used to compare or match them with personal data or to combine them with personal data.
9. The procedures put in place by eu-LISA to monitor the development and the functioning of the router referred to in Article 39(2) of Regulation (EU) 2019/818 shall include the possibility to produce regular statistics to ensure that monitoring.
Practical handbook
The Commission shall, in close cooperation with the PIUs, other relevant authorities of the Member States, air carriers and relevant Union bodies and agencies, prepare and make publicly available a practical handbook, containing guidelines, recommendations and best practices for the implementation of this Regulation, including on fundamental rights compliance as well as on penalties in accordance with Article 38.
The practical handbook shall take into account other relevant handbooks.
The Commission shall adopt the practical handbook in the form of a recommendation.
Source: EUR-Lex (Publications Office of the EU), © European Union, reuse permitted under Commission Decision 2011/833/EU.
