For security measures, ETIAS (European Travel Information and Authorisation System) will be implemented for individuals who can enter the Schengen Zone without a visa. These individuals will have to sign up with ETIAS and receive an entry authorization before traveling to the Schengen Area.
To register for ETIAS, applicants must fill out a short application form and answer a few questions. While the data entered into the system is secure, it’s important to understand what happens to your information once you enter it into the system.
What Kind of Data Is Stored in ETIAS?
ETIAS will store the applicants’ following information:
- Personal Information:
- Full name, including surname, given names, and surname at birth.
- Date, place, and country of birth.
- Gender.
- Current nationality and any previous nationalities.
- Parents’ first names.
- Identification Details:
- Other names used (aliases, artistic, or usual names).
- Travel document details (type, number, issuing country, expiration date).
- Home address, city, and country of residence if the address isn’t available.
- Contact Information:
- Email address and phone number.
- Education and Occupation:
- Education level and field (selected from a predefined list).
- Current occupation and job title (selected from a predefined list).
- Travel Details:
- Intended first entry Member State in the Schengen Area.
- Information for Minors:
- Names of parents or legal guardians.
- Family Member Information (if claiming family member status):
- Relationship status and details of the family member in the Schengen Area.
- Representative Information (if another person fills the application):
- Representative’s full name, firm/organization, email, mailing address, phone number, and relationship to the applicant.
- Health and Legal Background:
- Any diseases with epidemic potential.
- Any past criminal convictions.
- Previous stays in war or conflict zones and reasons for stay.
- Any orders to leave a country or return decisions in the last ten years.
When you log in to register for ETIAS, the system will also collect the IP address from where your application was submitted.
Who Can Access My Data in ETIAS?
Only authorized staff of the ETIAS Central Unit and National Units can access your data in the ETIAS system. For security checks— in case there is a match or a “hit” alert— your data may also be compared with other databases like the following:
- The Schengen Information System (SIS).
- Visa Information System (VIS).
- Europol’s Databases, the Interpol Stolen and Lost Travel Documents database (SLTD)
- Entry/Exit System (EES).
- Eurodac.
- The European Criminal Records Information System (ECRIS).
- The Interpol Travel Documents Associated with Notices database (TDAWN).
Please note that while border guards at Schengen entry points can confirm whether you possess an ETIAS authorization, their access is restricted to this verification alone; they do not have access to your entire ETIAS file.
How Can Other Agencies Access My ETIAS Data?
Other EU security agencies (such as Europol) can only access your information in ETIAS after following a strict official procedure— here is a brief overview of the process:
- Reasoned request. Law enforcement authorities and Europol must first submit a reasoned request to access the ETIAS data, showing that previous searches in relevant national and Europol databases did not yield the necessary information.
- Independent verification. Before accessing the data, there must be an independent verification to ensure that the strict conditions for data consultation are met. This verification is conducted by a court or an independent authority that is impartial and free from external influence.
- Specific conditions. Access is granted only if it’s necessary for the prevention, detection, or investigation of a terrorist offense or another serious criminal offense. Additionally, there must be reasonable grounds to consider that consulting the data will substantially contribute to these efforts.
- Data limitation. Not all data in the ETIAS application file is available for criminal investigations. Only the data that is explicitly justified as necessary for the case at hand can be accessed. In most cases, only your personal data may be accessed, and other information, such as your education history and health assessment, is not provided.
- Record keeping. Records of all data processing operations within the ETIAS Central System are kept, including the purpose of the data request and the decision on its admissibility.
Please note that in urgent situations where immediate access to data is necessary to prevent a serious crime, the request can be processed immediately, but an independent verification must follow without undue delay.
Is My Data in ETIAS Safe?
Yes, your information in ETIAS is kept safe by following several important security measures such as the following:
- Adherence to privacy regulations. ETIAS operates in compliance with strict European data protection regulations (Regulation (EC) No 45/2001), ensuring that personal data handling meets legal standards.
- Data security protocols. The agency eu-LISA, along with national security units, is tasked with safeguarding the processing of personal data, employing robust security protocols to prevent unauthorized access and data breaches.
- Controlled access. Access to personal data within ETIAS is restricted to specifically authorized personnel, with stringent controls in place to deter unauthorized personnel from accessing or altering data.
- Careful interoperability. While ETIAS interfaces with other security databases for risk assessments, it maintains controlled access and monitoring to safeguard personal data and prevent misuse.
- Secure data transmission. Data transmitted within the system is protected through encryption and other security measures to prevent unauthorized interception or tampering.
- Security oversight and auditing. eu-LISA is required to keep detailed records of data processing activities and report on security measures to various EU bodies, ensuring accountability and continuous oversight. Additionally, the European Data Protection Supervisor conducts audits of eu-LISA’s data processing activities at least every four years to ensure compliance with data protection standards.
How Long Will the Data Stay in ETIAS?
Your data in ETIAS will be stored for a specific retention period starting from points in time as follows:
- According to the length of the travel authorization, if one has been granted.
- Five years from the last recorded entry of the applicant in the Entry/Exit System (EES).
- Five years from the date of a decision to refuse, revoke, or annul the travel authorization in accordance with the relevant ETIAS regulations.
After these periods, your data will be automatically deleted from the ETIAS Central System so that information is not held indefinitely. This is a part of the ETIAS Data Retention Policy, which is another step in making sure your information is kept safe and secure.
Please note that even after this period ends, your data can be stored in the system for an additional three years— if you give consent to this. eu-LISA is developing a tool for you to easily give or withdraw your consent for storing your travel application information. You will be able to access this tool through a dedicated website or a mobile app, and you can withdraw your consent at any time.
What Is My Data Used For?
The data collected in ETIAS is used for the following purposes:
- To assess the security, irregular migration, and public health risks posed by applicants who want to enter the Schengen Zone.
- To enable interoperability with other information systems, such as the Entry/Exit System (EES), Visa Information System (VIS), and others, for carrying out risk assessments.
- To prevent, detect, and investigate terrorist offenses or other serious criminal offenses.
- To support and strengthen action by Member States in preventing, detecting, or investigating serious criminal offenses falling under Europol’s mandate.
- To create reports and statistics, which include non-identifiable information such as application status, nationality, gender, date of birth, residence, education, occupation, and travel document details, ensuring privacy and data protection.
What if My Data Is Stored Illegally?
If your data in ETIAS is found to have been recorded unlawfully, you can expect the following to happen:
- The responsible ETIAS Central or National Unit will review the case. If they decide not to amend or delete the data, they must issue an administrative decision explaining their reasoning, which will be promptly communicated to you along with guidance on how to appeal the decision.
- The data will either be corrected or deleted. If the data is confirmed to be inaccurate or unlawfully recorded, the ETIAS Central or National Unit must correct or delete it from the system.
Keep in mind that if a Schengen Member State suspects any data inaccuracies or unlawful processing, it must notify the responsible ETIAS Unit within 14 days. The Unit then has one month to verify the data and correct or delete it if necessary.
What if My Data Is Incorrect?
If your data in ETIAS is stored incorrectly, the information will be reviewed and corrected as necessary. If you believe your data in ETIAS is incorrect, you should contact the ETIAS Central Unit or the ETIAS National Unit responsible for your application.
Can I Opt Out of Data Collection or Delete My Data From ETIAS?
Your data will be deleted automatically from the system after the retention period has expired, but you cannot opt out of submitting your data when you apply for an ETIAS authorization.
However, if any of the following happens while your information is stored in ETIAS, the data can be deleted before the retention period has expired:
- You became a citizen of any of the EU countries.
- Your situation has changed, and now you belong to one of the ETIAS exemption categories, e.g., you are now classified as a refugee or asylum seeker.