Access and authentication for the purpose of self-revocation
Article 2
1. Applicants shall be given the option to revoke a travel authorisation via the public website and the app for mobile devices referred to in Article 16 of Regulation (EU) 2018/1240. 2. Upon selection of the option to revoke a travel authorisation, the applicant shall be presented with a request to authenticate using a two-factor authentication. 3. The applicant shall first enter the following data: (a) the application number; (b) the travel document number; (c) the email address used in the application for a travel authorisation. The applicant shall be asked to confirm that they have access to the email address referred to in the first subparagraph, point (c), by ticking a box. Should they no longer have access to that address, they shall be asked to enter a new email address for receiving a unique code and confirmation of revocation. 4. Where the data submitted pursuant to paragraph 3 correspond to a valid travel authorisation, the first authentication shall consist of the submission by the applicant of the following data: (a) the country of issue of the travel document (to be selected from a list); (b) the dates of issue and of expiry of the travel document; (c) the first names of both parents, as entered in the application for a travel authorisation. 5. The second authentication shall consist of a unique code to be entered into the revocation web page or mobile app. The unique code shall be generated automatically and sent to the applicant through the email service referred to in Article 6(2), point (f), of Regulation (EU) 2018/1240, upon submission of the data referred to in paragraphs 3 and 4. The recipient email address shall be that to which the applicant has access, as confirmed pursuant to paragraph 3. 6. Where the data submitted pursuant to paragraph 3, with the exception of the email address referred to in point (c) in that paragraph, correspond to the data in the application form, an email shall be sent to the email address on the application form signalling an attempt to revoke the authorisation via the website or the mobile app. That email shall allow the applicant to indicate, by a given deadline, that they are not at the origin of the request for revocation. It shall also inform the applicant how to contact the ETIAS Central Unit if necessary. The ETIAS Central Unit shall keep records of all follow-up action. 7. Once the applicant enters the unique code, referred to in paragraph 5, on the revocation web page or mobile app to confirm authentication, the website or the app shall display information on the 5-year data retention period for application files relating to revoked travel authorisations, as referred to in Article 54(1), point (b), of Regulation (EU) 2018/1240. 8. The applicant shall be required to confirm having read and agreed with the information referred in paragraph 7 and confirm the revocation of the travel authorisation in order to finalise the revocation request. 9. Unique codes generated pursuant to paragraph 5 shall expire after a reasonably short period of time. The sending of a new code shall invalidate previous codes. Codes shall be usable only once. 10. Where the revocation request is introduced with an email address that differs from that used in the application form, the finalised request shall not be sent to the ETIAS National Unit for processing before the deadline referred to in the second subparagraph in paragraph 6. In all other cases, it shall be sent to the National Unit without undue delay.