The thorny discussions on the centralised information system 'ECRIS-TCN' on convictions of third-country nationals seemed finally closed, after the validation last week by the European Parliament of the Interinstitutional Agreement (see EUROPE 12157/11). But the amendments made by the Commission to the Regulation establishing the 'ETIAS' system at the beginning of the year put the subject back on the table and, with it, serious concerns are re-emerging.
The 'ETIAS' system, creating an EU travel authorisation for third-country nationals exempt from visas, was already the subject of an interinstitutional agreement in April 2018 (see EUROPE 12009/2), but amendments have been made to adapt it to changes in the other European databases to which it must connect, including the 'ECRIS-TCN' system.
In the explanatory memorandum to the proposal, the Commission states that these are only limited technical changes, aimed at allowing the 'ETIAS' system to access the other databases.
But not everyone agrees, starting with the European Data Protection Supervisor (EDPS), Giovanni Buttarelli. In a letter sent on Wednesday 13 March to the Romanian Presidency of the Council of the EU, he considers that these amendments are far from being just "limited technical adjustments".
In concrete terms, the central 'ETIAS' system will be able to query the 'ECRIS-TCN' system in order to assess the travel authorisation applications of third-country nationals exempted from visa requirements and identify whether these persons have been the subject of previous convictions related to terrorist offences or other serious criminal offences.
For him, this possibility - which was not provided for in the political agreement on 'ECRIS-TCN' - constitutes a progressive extension of the use of this database beyond the purpose for which it was initially created and, therefore, a "misuse of function".
On the contrary, the EDPS considers that these are "substantial changes" which require a thorough analysis of their necessity and proportionality while taking into account the impact on the fundamental rights of individuals, in particular as regards data protection.
On the side of the Member States too, the subject is controversial. On 13 February, the Member States' ambassadors to the EU (Coreper) decided to refer the case to the working groups (see EUROPE 12193/21).
In a note in early February, the Romanian Presidency of the Council of the EU indicated that the discussions had revealed "serious reservations". For some countries, these amendments would add a new purpose - border management - to the 'ECRIS-TCN' system and empower a new category of authorities to consult this system, which contains particularly sensitive data.
The European Commission then tried to reassure by explaining that querying the 'ECRIS-TCN' system would not reveal to the central 'ETIAS' system that a third-country national has been convicted in a Member State, if the conviction is not for a terrorist offence or another serious criminal offence. Indeed, it is foreseen that a "flag" will be added to the list of data to be entered in the 'ECRIS-TCN' system to indicate terrorist offences and serious criminal offences.
The Commission also reminded delegations that this possibility was maintained by the co-legislators when they adopted the ‘ETIAS’ Regulation.
At that time, since the European Parliament and the Council of the EU had not yet reached agreement on the 'ECRIS-TCN' system, the co-legislators had indeed had to innovate and decided to include in a recital a provision stating that "If a centralised system for the identification of Member States holding conviction information on third country nationals and stateless persons is established at Union level, ETIAS should be able to query it".
The EDPS does not seem really convinced by this last justification. In his letter, he also asks the co-legislators to check to what extent this provision can be considered sufficient to justify the extension of the scope of the 'ECRIS-TCN' system on its own.
According to a European source, discussions in the EU Council are still ongoing at the technical level, with the last discussion taking place at the end of February and the next one scheduled for mid-April.
Several elements still need to be clarified, in particular the question of "reporting" and access by national 'ETIAS' units. (Original version in French by Marion Fontana)