EUROPEAN COMMISSION

Strasbourg, 8.10.2024

SWD(2024) 671 final

COMMISSION STAFF WORKING DOCUMENT

IMPACT ASSESSMENT REPORT

Accompanying the document

Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

establishing an application for the electronic submission of travel data (“EU Digital Travel application”) and amending Regulations (EU) 2016/399 and (EU) 2018/1726 of the European Parliament and of the Council and Council Regulation (EC) No 2252/2004, as regards the use of digital travel credentials

{COM(2024) 670 final} - {SEC(2024) 670 final} - {SWD(2024) 670 final} - {SWD(2024) 672 final}

Table of contents

1.Introduction: Political and legal context

1.1.General background

1.2.Policy and legal context

1.3.Scope of the initiative

2.Problem definition

2.1.What are the problems (and their drivers)?

2.2.What are the problem drivers?

2.3.What are the effects?

2.4.What are the impacts on the stakeholders concerned?

2.5.How likely is the problem to persist?

3.Why should the EU act?

3.1.Legal basis

3.2.Subsidiarity: Necessity of EU action

3.3.Subsidiarity: Added value of EU action

4.Objectives: What is to be achieved?

4.1.General objectives

4.2.Specific objectives

5.What are the available policy options?

5.1.What is the baseline from which options are assessed?

5.2.Description of the policy options

5.2.1.General definition and policy changes

5.3.Options discarded at an early stage

6.What are the impacts of the policy options?

6.1.Economic impact

6.1.1.Impact on EU institutions and agencies

6.1.2.Impact on Member States

6.1.3.Impact on EU citizens

6.1.4.Impact on third country nationals

6.1.5.Impact on industry

6.2.Social impact

6.2.1.Impact on security

6.2.2.Protection of personal data

6.2.3.Protection of fundamental rights

6.3.Environmental impact

7.How do the options compare?

7.1.Effectiveness

7.2.Efficiency

7.3.Coherence

7.4.Proportionality

7.5.Summary of assessment

8.Preferred option

8.1.Benefits of the preferred option for the digitalisation of travel documents and facilitation of travel

8.2.Potential disadvantages of the preferred option

8.3.Application of the ‘one in, on out’ approach

8.4.REFIT (simplification and improved efficiency)

9.How will actual impacts be monitored and evaluated?

Annex 1: Procedural information

1.Lead DG, Decide Planning/CWP references

2.Organisation and timing

3.Consultation of the RSB

4.Evidence, sources and quality

Annex 2: Stakeholder consultation (Synopsis report)

1.Consultation strategy

2.Consultation activities

2.1.Strategic interviews with key decision makers and key experts

2.2.Targeted consultations

2.3.In depth-interviews

2.4.Public consultation

2.5.Special Eurobarometer

3.Conclusions

Annex 3: Who is affected and how?

1.Practical implications of the initiative

1.1.Individuals

1.2.Member States’ national authorities

1.2.1.Border management authorities

1.2.2.Visa, ETIAS and other authorities

1.3.eu-LISA

1.4.Other entities

2.Summary of costs and benefits

3.Relevant sustainable development goals

Annex 4: Analytical methods

1.Introduction

2.Member State authorities

3.eu-LISA

Annex 5: Competitiveness check

1.Overview of impacts on competitiveness

2.Synthetic assessment

Annex 5: Summary of the pilot project in Finland and Croatia

1.Introduction

2.Project objectives

3.Project implementation and outcomes

4.Noteworthy observations and questions raised

5.Conclusions

Glossary

1.Introduction: Political and legal context

1.1.General background

Our societies are becoming increasingly mobile 1 , with a significant number of EU citizens and third country nationals crossing the external borders of the EU 2 every day. Over the last two years, external border crossings have steadily increased to close to pre-pandemic levels. In 2019, 605 million external border crossings were recorded, while in 2020, the number of crossings dropped to 186 million. In 2023, a total of 593 million crossings were recorded. From these crossings, 65% were at air borders, 31% at land borders and the remaining 4% via sea borders 3 .The fact that over half a billion passengers enter or leave the EU every year puts a strain on the external borders of the EU. High volumes of travellers are a challenge for the authorities competent for carrying out border checks at external borders, as well as for EU citizens and third country nationals crossing borders on a daily basis. To ensure that systematic checks can be efficiently performed on every traveller, there is a need to speed up border controls and to ensure the facilitation of passenger flows while at the same time maintaining a high level of security.

The advantages of digitalisation have become apparent during the COVID-19 pandemic in several contexts, where paperless transactions proved to substitute or reduce significantly close physical contact as well as to speed up different processes. The EU Digital COVID Certificate 4 , for example, facilitated travel at a time when many Member States had introduced travel restrictions linked to the protection of public health. Digitalisation of travel documents may improve the identification of travellers, enable better advance checks by authorities, and allow, at a later stage, the remote issuance of documents and ultimately a smoother and faster border-crossing experience and streamlined travel processes for travellers. It can also ensure high standards of security and data protection, without putting the integrity of borders at risk. 

With the advancement of technology, in particular improvements in biometric identification and interoperability of several systems in the field of migration, borders and visas, travel and international border crossing can be facilitated with the use of digital travel credentials. Industry and individual governments have already been exploring ways of using digital traveller information more effectively in order to facilitate passengers passing through the different stages of travel in a more seamless and customer-centric fashion 5 . In Europe, much of this is thanks to the EU investments in research and innovation 6 .

By leveraging existing technology and introducing digital travel credentials for EU citizens, the EU aims to facilitate travel across external borders, to relieve pressure and bottlenecks at border-crossing points and to shorten waiting times. Third country nationals could also benefit from the use of digital travel credentials when crossing the external borders of Schengen Member States. They would be able to undergo advance checks and reduce the touchpoints where physical interaction is required, for instance in the context of immigration-related processes.

The use of such digital travel credentials would not only facilitate cross-border travel but also has as the objective to increase the security and efficiency of border checks and to facilitate free movement of EU citizens more generally. To this end, the use of digital travel credentials as well as biometric solutions should maintain harmonised high standards of security and privacy among the Member States and the industry.

Since 2006, passports issued by Member States have an integrated chip, containing the personal data and two biometric identifiers (facial image and two fingerprints 7 ) of the holder (i.e. a biometric passport). At global level, 171 countries issue biometric passports 8 . Since 2021, identity cards issued by Member States contain the same technology. There is no central passport or identity card database at EU level. 

This Impact Assessment is based on the findings of an external study, a public consultation, extensive stakeholder consultations and other sources.

1.2.Policy and legal context

This initiative links up two important EU policy fields: The Commission’s Digital Europe strategy of 2020 and its 2021 Schengen Strategy that has as an objective to re-establish a fully functioning Schengen area. On 19 February 2020, the Commission launched the Digital Europe strategy on shaping Europe’s digital future 10 , which aims to ensure the integrity and resilience of the EU’s data infrastructure and to support the uptake of technology that will make a real difference to people’s daily lives. On 9 March 2021, the Commission presented a vision and the avenues for Europe’s digital transformation by 2030. The Commission proposed a Digital Compass for the EU’s digital decade that evolves around four cardinal points, one of which is the digitalisation of public services, with the specific objective of 80% of citizens using digital identity by the end of 2030 11 .

As announced in the Schengen Strategy of 2 June 2021 12 and provided for in the Commission Work Programme 2023 13 , the Commission plans to adopt a legislative proposal on the digitalisation of travel documents and travel facilitation. The Schengen Strategy announced an impact assessment that would prepare the ground for a proposal on the digitalisation of travel documents and facilitation of travel. 

In September/October 2022, in the 41st Assembly of the International Civil Aviation Organization, the EU and others 14 submitted a Working Paper presenting a common long-term vision to guide the actions of States and stakeholders for the common goal of delivering the optimal passenger journey. The Working Paper, setting high-level principles focusing on inclusivity, avoiding bottlenecks, ensuring sustainability, resilience and global interoperability, underlined the importance of appropriate tools, such as digital solutions, prioritising contactless processes and ensuring better coordination among all stakeholders.

These efforts for Europe’s digital transformation should be seen together with the advances taking place in the domain of more digitalised borders and the so-called Smart Borders Package that is currently changing fundamentally the way we manage the EU’s external borders:

·The Entry Exit System (EES) Regulation 15  adopted in 2017, and its related amendment of the Schengen Borders Code 16  (SBC), introducing the recording and storage of the date, time and place of entry and exit of third country nationals and the automatic calculation of the duration of stay. Third country nationals will also have to provide biometric data to create their individual EES file for carrying out border checks. 

·The European Travel Information and Authorisation System (ETIAS) Regulation 17 , adopted in 2018, introduces a future online travel authorisation for visa-free third country nationals to enter the Schengen area 18 .

·The Visa Information System (VIS) Regulation, adopted in 2008 19 , establishes an IT system involved in the registration and checking of people who apply for a short-stay visa to enter the Schengen area. It has been operational since 2011 20 . The system can perform biometric matching, primarily of fingerprints, for identification and verification purposes. This system is being extended, through a 2021 amendment of the VIS regulation 21 to include data on long stay visa and residence permits.

·The Schengen Information System (SIS) Regulation 22 , adopted in 2018, further develops the system (established in 1995) to assist the competent authorities in Europe to preserve internal security in the absence of internal border checks and to carry out border checks at external borders.

·The Interoperability between EU IT systems in the field of borders and visas Regulation 23 establishes a framework to ensure the interoperability between the above-mentioned systems as well as others in the field of justice, asylum and law enforcement.

In the context of the exercise of the right of free movement of persons within the EU, Regulation (EU) 2019/1157 24 has strengthened the security of identity cards of EU citizens and of residence documents. Under the Regulation, all Member States must include an integrated chip, containing the personal data and two biometric identifiers (facial image and two fingerprints) of the holder in identity cards in the same way as they do in the passports they issue. Prior to the adoption on the Regulation, no harmonised standards for such documents existed at EU level, resulting in some Member States not issuing identity cards with a digital component.

That Regulation is not part of the Schengen acquis and covers all EU Member States – independent of their membership in the Schengen area – and, through its incorporation into the Agreement on the European Economic Area, also applies in Iceland, Liechtenstein and Norway 25 . 

Following the Court of Justice’s invalidation of Regulation (EU) 2019/1157 in case Landeshauptstadt Wiesbaden 26 , the Commission proposed a new Regulation on identity cards on 23 July 2024 27 .

This initiative is also linked to other ongoing developments at EU level. In the context of identity management in the digital sphere, the Commission is currently rolling out the European Digital Identity Wallet (EUDIW) established by the recently adopted Digital Identity Regulation 28 . That Regulation introduces an EU-wide framework for public electronic identities based on a harmonised standard allowing any individual to have access to a secure European digital identity that gathers different electronic attestations (e.g. identity card, passport, driver’s license, medical prescriptions) in one single interoperable digital wallet, the EUDIW, with the possibility to cryptographically prove their authenticity and provenance. 

The revised rules on Advance Passenger Information 29  (API) will soon be adopted. The revised API rules on the collection and transfer of advance passenger information (API) for enhancing and facilitating external border controls would oblige air carriers to collect by automated means and transmit the API data (traveller information as featuring on the travel document and flight information) via a central router to the authorities responsible for carrying out checks at external borders, with necessary information on persons whom the carriers will transport to a Schengen Member State that could be contained in the digital travel credential. In the future, carriers could collect the API data from travellers’ digital travel credential and with the traveller’s consent, increasing data accuracy and efficiency of border checks.

Finally, the initiative is also thematically linked to the Commission proposal on the digitalisation of the visa procedure 30  on which political agreement was reached by co-legislators in June 2023. The proposal aims to digitalise the visa application procedure and to replace the visa sticker with a digital visa.

1.3.Scope of the initiative

The initiative focuses on travel documents (passports and identity cards) and their digitalisation for the purposes of facilitating travel and making border checks at the external borders of the Schengen area more efficient and effective with upstreaming the moment of carrying out checks against those documents. This impact assessment looks at the options for and the impacts of the use of digital travel credentials by citizens of EU Member States and Schengen Associated Countries as well as third country nationals. This impact assessment focuses on the impacts for border authorities and travellers are they are directly impacted by the initiative.

As mentioned above, air carriers will already be obliged through the revised API rules to use automated means to collect passenger information in order to increase security through improved data quality. The digital travel credential, while offering a suitable format for the collection of passenger information with automated means, is not the only way for them to comply with the obligations of the revised API rules, and – as set out in more detail below – there is no advantage for border authorities or the carrier themselves in imposing the use of the same format for that purpose. The same applies to the possible voluntary use of digital travel credentials by other carriers involved in the transportation of passengers (via land or sea borders). Such use of the DTC by the carriers, therefore, does not fall within the scope of the initiative.

2.Problem definition

Both EU nationals and third country nationals are subject to border checks when crossing the external borders. These checks comprise verification of the identity and the nationality of persons, the validity and authenticity of their travel documents as well as consultations in the relevant databases, in particular the Schengen Information System, Interpol’s Stolen and Lost Travel Documents (SLTD) database as well as national databases 31 . In addition, systematic checks for third country nationals include the assessment and verification that the entry conditions are fulfilled, e.g. concerning the validity and authenticity of visas or residence permits, justification of the purpose and conditions of the intended stay and means of subsistence. These checks are done physically at the border crossing point and the process typically starts once the traveller presents their travel document to a border guard or at the e-gate. 

European tourism is steadily recovering from the impact of the pandemic. In 2023, European tourism demand showed a strong and positive trend. Based on year-to-date data, international tourist arrivals for Europe were 12% higher than in 2023, and 6% higher than in 2019 32 . Since March 2022, European air traffic embarked on a consistent upward trajectory, gradually reaching and sustaining levels in the high 80% of the 2019 levels. It is estimated that air travel to Europe in 2024 will surpass pre-pandemic levels by 5%. From 2021 to 2022, there was an increase of 234.4%, and in 2023, an increase of 17.7% in international Revenue Passenger Kilometres, which is currently standing at almost 2% above the pre-pandemic level 33 . Therefore, European travel remains resilient despite obstacles (such as the pandemic, economic obstacles and the Russian invasion of Ukraine) and is expected to experience steady recovery and growth in the future 34 .

Given the pressure faced at the external borders on the verification processes 35 , combined with different speeds in the digital transformation 36 of Member States, new challenges are emerging from the current situation. They include security risks and inefficient border management as well as obstacles to smooth and facilitated travel across borders. The increase in air passenger flows has translated into a higher pressure on available human resources at some air border crossing points and a subsequent increase in passengers’ waiting time 37 . 

At a time when private sector solutions have emerged that enable citizens to enrol and create digital travel credentials on their mobile devices, some Member States already started to get involved in national digital travel credential programmes. Among those Member States, some are more advanced in digitalising travel documents, especially those involved in EU-funded digital travel credential pilots, such as the Netherlands 38 , Finland and Croatia 39 .

These two main issues linked to obstacles to smooth travel and security risks have different implications in the context of the Schengen area, which, in principle, is free from controls at internal borders. 447.7 million EU citizens, along with third country nationals living in the EU or visiting the EU as tourists, exchange students or for business purposes, can freely move around the Schengen area without being subject to border checks 40 . Nowadays, all countries that are part of the EU are also members of the Schengen area, except for Ireland, Cyprus, Bulgaria and Romania. The latter three, nevertheless, are already applying the Schengen acquis to a large extent 41 . Next to non-Schengen EU countries, there are the four non-EU countries that are members of the Schengen area: Switzerland, Liechtenstein, Norway, and Iceland 42 . EU citizens and the nationals of these four third countries enjoy, based on EU law or international agreements, a right to freely move to the territory of all these 31 countries.

Figure 1 Problem Tree

2.1.What are the problems (and their drivers)?

Problem 1: Obstacles to smooth and facilitated travel across borders

Some obstacles, like especially the congestion at border-crossing points and transport hubs, can hinder smooth and facilitated travel across borders for both EU nationals and third country nationals.

The absence of digitalised processes or the only partial character of such digitalised processes, along with increasing passenger movements across borders, have resulted in longer waiting times at border-crossing points. Travellers are required to physically present their travel documents at all external border crossing points either to border authorities for manual verification or at e-gates. Even with the use of e-gates, a border authority official is required to supervise the process and to take a decision on admission or refusal of entry (or refusal to leave).

When EU citizens cross the Schengen external borders while travelling to and from the EU Member States that have not abolished internal border controls, or while travelling to the Schengen area from a third country, longer queues resulting from a suboptimal management of passenger flows may also place a burden on the exercise of these citizens’ right of free movement.

Moreover, carriers transporting travellers in and out of the EU territory and the Schengen area, such as coaches, trains and airlines, face difficulties too and are impacted by traveller flows, the absence of digitalised processes and reliance on physical interactions. As the number of passengers travelling increases, the manual verification by border guards and carriers becomes a repetitive and time-consuming process. Similarly, as the collection and transmission of advance passenger information 43 as well as information for ETIAS applications is largely based on manually transcribed or self-declared information, it can lead to incomplete or incorrect data, having a negative impact for passengers, carriers as well as authorities in terms of significant delays, fines or even refusals of entry.

According to a study on the implementation of Regulation (EU) 2017/458 as regards the reinforcement of checks against relevant databases at external borders, EU citizens entering the Schengen area experienced increased waiting times 44 , primarily at land and air borders, following the introduction of the reinforced checks in 2018. The study provided data on five Member States as concerned the changes in waiting time estimates. The changes compared to the situation before expanding the systematic checks to EU nationals ranged, at air borders, from 1 min (SE, FR) or 2 min (AT) to 10 min (HR) and 30 min (PT). At land borders, only HR provided an estimate, which amounted to a 20‑minute increase. Others provided more general assessments at “tripling” (BE) or “doubling” (HU) for all types of BCPs 45 . The overall perception or understanding of border guards is, according to the study, that overall waiting times have “significantly” or “somewhat” increased.

Similarly, processing times (verification of identity, travel document check, database consultations) per passenger increased as a result of carrying out systematic checks on EU nationals, with an EU average of an additional 16.2 seconds per passenger.

Third country nationals have been subject to thorough checks on entry and exit since the entry into force of the Schengen Borders Code 46 . This includes, among other things, checks on travel documents, verification of the entry conditions, database checks as well as verification that the person concerned has a valid visa or residence permit. With the future entry into operation of the Entry/Exit System, certain third country nationals 47 are required to register additional information upon arrival, including their fingerprints and a facial image taken at the border crossing point, which will increase the amount of time for processing travellers, and, consequently, waiting times, and will have an impact on queue lengths and space requirements for transport hubs. According to the European Border and Coast Guard Agency (Frontex), the installation of pre-enrolment solutions can be very useful in scenarios where the majority of passengers are third country nationals to be registered into the Entry/Exit System 48 .

Self-service systems are already envisaged for the enrolment of data by third country nationals subject to EES 49 . Interaction with these ‘kiosks’ entails several steps from physically approaching the device, identification, instructing passengers, asking questions related to entry conditions, scanning and verifying travel documents to capturing the fingerprints and facial images of travellers. According to a Dutch study 50 , if advance remote enrolment of certain data, including the passport data, is allowed, the overall time spent interacting with the physical self-service system can be reduced from 86 seconds to 67 seconds per passenger.

Problem 2: Security risks and challenges to an efficient external border control

Document fraud is a key enabler for the materialisation of risks that can impact various areas of the EU integrated border management components, such as the internal security of the EU and the functioning and security of the external borders. Document fraud is notably associated with cross-border crime, migrant smuggling, irregular migration, hybrid threats and terrorism.

In 2023, EU Member States and Schengen Associated Countries detected a total of 17 424 fraudsters using, or in possession of, 22 395 fraudulent documents 51 . Fraudulent passports accounted for 38% (8 674) and fraudulent identity cards for 19% (4 310) of all fraudulent documents detected in this period, constituting the two most used documents by fraudsters. In addition to physical or digital alterations in otherwise valid travel documents (forgeries) and unlawfully produced/manufactured travel documents (counterfeits), lost, stolen or unlawfully given travel documents are used for impostor fraud (or lookalike fraud), where the fraudster uses an authentic document issued to someone else. Counterfeit documents accounted for 58%, forgeries for 12%, impostor fraud for 15% and fraudulently obtained documents for 9%. 52 . 

In order to ensure adequate security as well as interoperability of travel documents worldwide, the International Civil Aviation Organization (ICAO) 53  developed international standards for biometric and non-biometric machine-readable travel documents. Those standards provide specifications, recommended practices and guidance on areas such as manufacturing, issuance, authentication and security characteristics. The EU Passport Regulation 54 , which establishes minimum security features including the introduction of biometric identifiers for passports in the EU, rendered the ICAO standards mandatory at EU level. They are also applicable for identity cards 55 . On a global level, all countries apply the ICAO standards for machine-readable travel documents. There is currently no complete overview of how many of the 171 countries that issue biometric passports (with a chip) fully comply with the ICAO standards.

Chips in travel documents are secured through various measures to prevent unauthorised access to the stored information and tampering as well as cloning. The chips utilise encryption techniques to protect the data, ensuring that the information can only be deciphered using specific cryptographic keys. The data stored on chips is secured by access control mechanisms so that only authorised individuals with the necessary authentication credentials can read certain data (like fingerprints). Communication between the passport chip and the inspection device is also secured through secure messaging protocols. The data stored on individual chips are moreover digitally signed by the issuing authority using their individual signing certificates. Even one unauthorised minor alteration in the data changes the hash values when the chip is read, leading to an unsuccessful validation of the chip and its security components 56 . While physical travel documents and their security features can be counterfeited or forged and while the chips may be cloned or created from scratch and integrated into another passport, if the validation of the chip data is done correctly with the necessary certificates, such manipulated chips and travel documents are easily detected.

However, there is no guarantee that officials will systematically detect such cases of counterfeits, forgeries or other criminal activities with high certainty, due to various factors, such as pressure due to peaks in traveller traffic or infrastructural issues.

Firstly, actual border checks are carried out only once the traveller arrives at the physical border-crossing point and presents a physical travel document. Therefore, authorities are unable to verify in advance whether the person concerned (with the exception of visa holders) has a valid and authentic travel document with them and, in case of third country nationals, whether they fulfil the entry conditions. This is due to a lack of a sufficient legal framework enabling border guards to carry out such checks in advance. Despite the checks carried out in the context of (future) ETIAS and visa application processing, border authorities need to verify the authenticity of travel documents and to verify that the entry conditions are still fulfilled at the moment the person reaches the border crossing point, as a significant amount of time may have passed since the previous checks during the assessment of the visa or ETIAS application. Moreover, the ETIAS application process does not enable authorities to verify the authenticity of the travel document. Similarly, although API (Advance Passenger Information) data collected and submitted by air carriers to border authorities of the destination country enable the authorities to carry out certain checks in advance, including the consultation of several databases, it does not allow them to verify the authenticity of travel documents. Moreover, API data for border management purposes is predominantly collected in the context of Schengen-bound air travel 57 .

While passenger volumes continue to increase and with authorities being required to carry out all checks at the time of the actual border-crossing, authorities’ capacity to manage resources, pre-screen and focus on high-risk profiles and to detect irregular migration and cross-border crimes like trafficking in human beings is significantly reduced.

Secondly, although border authorities are required to verify the authenticity and integrity of chip data of biometric passports 58 or identity cards, this may be at times skipped, due to travel peaks and technical malfunctions 59 , and border guards will, in these cases, rely more on a manual inspection of the document  60 . However, even more common is the practice that despite the inspection system presenting an error message concerning the validation, border authorities wave through the traveller, thinking that this-or-that type of travel document never works with the particular inspection device. In fact, there may be several reasons for the unsuccessful validation: 1) the inspection device does not have access to the necessary (public) certificates to carry out the validation; 2) there has been a technical error in encoding the data contained in the chip of an otherwise valid and authentic document; or 3) the chip is counterfeit or forged. In fact, in 2022, there was a significant increase in the detections of fraudulent EU passports involving the use of counterfeit chips or tags. It is particularly worrying when fraudsters become aware of certain defects in the validation process, as this enables them to leverage the combination of the technical defect and the practice of border authorities that wave through holders of such passports without carrying out any additional investigations. 

2.2.What are the problem drivers?

The root causes of the two problems linked to facilitation and security are:

§Increased chances of errors in capturing and transmitting required data (PD1):

The collection and transmission of accurate data is essential for the management of external borders. This collection and transmission, in the case of third country nationals, applies in particular to self-declared data in ETIAS and visa applications. For EU nationals and third country nationals alike, the collection and transmission applies in particular to advance passenger information collected and transmitted by air carriers and the actual checks based on those data. However, there are increasing chances of errors in capturing and transmitting required data, which can lead to security risks and inefficient border control management, contributing to both problems. For carriers, the submission of erroneous data may lead to fines under carrier liability.

§Possible divergences in standards in the implementation of digital travel credentials and varied levels in digital maturity (PD 2 and PD4):

According to a study carried out by the European Parliament in 2019, EU citizens are becoming increasingly eager to embrace the digital transformation and expect that national governments cater for their digital needs 61 . Moreover, in IATA’s 2023 Global Passenger Survey 62 , 75% responded that they would rather use biometrics than traditional passports or boarding passes in international travel and 87% of respondents were willing to share immigration data (e.g. passport, visa, health questionnaire) to expedite the process. 

In the absence of a common reference architecture, there is a risk that each country will rely on different private contractors for the design, development and implementation of various tools to reply to these expectations. As a result, Member States’ programmes and levels of security will become incompatible with each other, digital fragmentation will increase and border control management across the EU will risk being negatively impacted. Moreover, depending on which country EU citizens and third country nationals are travelling through, their travel experience might significantly differ (e.g. non-mutual recognition of the used digital travel credentials), forcing the traveller to use a variety of different digital tools, depending on which Member State he or she will be travelling to or through. This will increase the burden on him or her and, thus, also the risk of mistakes and the potential for frustration.

These divergences and the lack of a common approach can increase the risk of fraud and reduce the ability to identify fraud cases, as opposed to a common digital solution used by all the Member States.

While the level of convergence between the EU Member States is increasing, there is still a large gap between the EU’s frontrunners and those with the lowest level of digitalisation 63 . The failure of Member States to make concerted efforts to meet the Digital Decade targets can entail further fragmentation in the way each Member State manages its border control, thereby hampering its efficiency throughout the area without internal border controls. In addition, such differences can impact negatively the travellers’ experience when travelling from one country to another.

§Reliance on physical practices and peaks in border crossings put pressure on verification processes (PD3):

Peak times in border crossings, combined with a full reliance on physical travel documents, can put significant pressure on border control and verification processes, leading to potential security risks and distressing travel experiences for passengers.

64 When large numbers of people attempt to cross a border at the same time, border control staff must process a high volume of individuals in a short period. Time pressure coupled with full reliance on checks of physical documents on the spot can lead to rushed or inadequate verification processes, which increase the likelihood of security breaches.

It should be noted that not all travellers will be in the same situation when the EES will come into operation as certain third country nationals will have to be registered upon crossing the external borders of Member States using the system. Therefore, most third country nationals travelling to the Schengen area will be subject to the registration of their entry and exit data for short-term stays, as opposed to EU citizens and nationals of Schengen Associated Countries.

In addition to the security risks, peaks in border crossings can make the travelling experience less satisfactory for passengers. Long queues and waiting times can cause frustration and discomfort, particularly for those with mobility issues or medical conditions or those travelling with infants.

2.3.What are the effects? 

All the above-mentioned problems have several negative effects:

§Area of freedom, security and justice is less safe

The constraints imposed on border and screening authorities by a growing number of travellers, in particular regarding checks on the spot and the inability of clearing bona fides travellers ahead of travel, create the risk that these authorities are prevented from more effectively focusing their resources on high-risk travellers and, thus, from detecting irregular migration and cross-border crimes (e.g. human smuggling and trafficking networks). Similarly, the border authorities may be prevented from efficiently uncovering cases of fraudulent physical documents, especially those of higher quality. According to Member States, some of the most common reasons for derogations to systematic checks against relevant databases at external borders 65  were heavy traffic and the intention to avoid excessive passenger waiting times 66 . Similarly, Member States may relax border checks as a result of exceptional and unforeseen circumstances 67 . The introduction of systematic checks on all persons, be they third country nationals or not, led to an increased detection and execution of SIS alerts for arrest, extradition and surrender as well as an increased detection of individuals that are subject to entry bans related to criminal charges, and of a fraudulent usage of identity documents. In some Member States, the introduction of systematic checks even doubled the relative number of hits in several databases 68 , as compared to the targeted checks prior to 2017 69 . From these developments it follows that applying derogations or relaxations of border checks creates a higher risk to security in the EU, with border crossing procedures being abused or wanted criminals crossing the borders undetected. 

Consequently, due to the nature of document fraud as an enabling crime, the presence of security threats may further increase, thereby making the area of freedom, security and justice less safe.

§Practical limitations to free movement

While all EU citizens enjoy the right to move and reside freely within the EU, they may need to cross the external borders of the Schengen area when travelling to and from the EU Member States that have not yet abolished internal border controls, when travelling to a third country, or when travelling to the Schengen area from a third country.

The suboptimal management of border control, in the face of increasing passenger movements across borders, entails unnecessary longer manual authentication and verification processes and hence, longer waiting times. This suboptimal use of resources at border-crossing points and transport hubs affects the proper implementation of integrated management of the EU’s external borders, as provided for in the Treaty 70 . 

71 More generally, for both EU nationals and third country nationals alike, the travel experience with delays can increase passenger frustration and affect the trust in the integrity of the Schengen area as a whole.

§Slowdown in the EU’s digital transition and goals

Less efficient and divergent approaches to border checks and travel facilitation may also lead to fragmentation, with incompatible solutions being deployed, and a general slowdown of shaping Europe’s digital future goals. These goals aim to open new opportunities for businesses, encourage the development of trustworthy technology and foster an open and democratic society, ultimately by making sure that technology improves the daily lives of citizens. The COVID-19 crisis has emphasized the significant role that digital technologies play in today’s lives and has accelerated the digital transition with the introduction and uptake of remote (digital) interactions in the space of travel, health, commerce, education and work. It also confirmed how important it is for the EU to rely on its own digital solutions rather than being dependent on those coming from other regions of the world 72 , while ensuring global interoperability.

2.4.What are the impacts on the stakeholders concerned?

The effects concern different actors at their respective levels:

§Travellers are affected by longer waiting times than necessary at border crossing points, due to their inability to submit data up front, which would allow the authorities to carry out certain checks in advance. Some travellers may even be discouraged from travelling due to the requirements for entry 73 . Individual citizens are also negatively impacted by the security risks posed by fraudsters and by cross-border criminal activity, the detection of which could be made more efficient by allowing for advance checks on the basis of digital travel credentials.

§Border and law enforcement authorities are impacted by the increase in time-consuming manual checks on the spot, due to the increased number of travellers, which reduce the ability of the competent authorities to focus on high-risk travellers. 

§Fraudsters and criminals leverage the shortcomings and take advantage of the current situation.

2.5.How likely is the problem to persist?

An absence of or only partially digitalised processes would require competent authorities to continue carrying out the border checks manually on the spot, entailing potentially inconsistent, repeated and long “pain points” for travellers, thereby hampering the smooth crossing of persons across well-managed borders.

Furthermore, with the methods of fraudsters getting consistently more sophisticated, it will also further reduce security and safety in the area of free movement without internal border control. In particular, the efficiency of border checks would be negatively impacted as border authorities would be less capable of efficiently identifying fraudulent documents, cross-border criminal activities and illegal immigration, especially in light of the increasing passenger flows.

Looking at the issue from the angle of digital transformation, without a common regulation/reference architecture, Member States and industry would keep developing (or not) their own digital solutions that are not compatible with one another. This is likely to increase the costs for the Member States and could, at the same time, ultimately damage the coherence and effectiveness of the common EU integrated border management and have a negative impact on the integrity of the external borders as well as internal security.

3.Why should the EU act?

3.1.Legal basis

Article 77(2)(b) TFEU empowers the EU to develop measures concerning the checks to which persons crossing external borders are subject. Article 77(2)(d) TFEU empowers the EU to adopt measures for the gradual establishment of an integrated management system for external borders.

Article 77(3) TFEU confers on the EU a competence to adopt provisions on passports, identity cards, residence permits or any other such document intended to facilitate the exercise of the right to move and reside freely within the territory of the Member States guaranteed in Article 20(2)(a) TFEU 74 .

3.2.Subsidiarity: Necessity of EU action

The EU is committed to facilitating the free movement of persons within an area of freedom, security and justice which, according to Article 4 TFEU, is an area of shared competence. The shortcomings described above are inextricably related to existing legislation, notably the Schengen acquis concerning passports as well as border checks and EU legislation on identity cards. The set-up of an integrated and more uniform border management requires coordinated measures and a common approach at EU level. A common approach to digitalising travel documents is still missing and results in problems across Member States. National measures are subject to the obvious limitation that their direct benefits are largely or exclusively confined to a single Member State (or several Member States in case of data exchange and other forms of cooperation), whereas addressing systemic problems in relation to free movement clearly requires action with an EU-wide dimension, because of the intrinsic cross-border nature of these problems. 

Moreover, the current EU legal framework does not allow for the use of digital solutions for verifying the authenticity and integrity of travel documents in border checks or in other situations of free movement. Instead, the current rules provide, in a mandatory way, for a check of physical travel documents. Therefore, Member States themselves cannot effectively introduce a uniform format for digital travel credentials and facilitate cross-border mobility. The problems elaborated on in the previous sections are unlikely to disappear in the near future and they are directly related to the current legal provisions.

The need for a uniform European approach is confirmed by the targeted consultation of relevant Council preparatory bodies’ representatives carried out: 96% of Member State representatives believe that a uniform approach across EU Member States is essential or very essential. 82% of respondents consider a truly integrated management of borders and facilitation tools within the EU (without overlapping legislations and processes related to border management bringing operational inefficiencies) as essential or very essential.

3.3.Subsidiarity: Added value of EU action

EU action will help preventing that Member States and/or private actors develop individual solutions, leading to a fragmentation and possible conflicts with the EU legal framework. Moreover, joint action at EU level will allow the Union to shape future global standards in this area. As described below, the continuation of the baseline scenario is not going to solve the problems identified, neither in relation to Member State authorities, nor individual travellers. Only at EU level, can changes be implemented in a way that would lead to the benefits illustrated in this assessment. Objectives would therefore be better achieved through action at Union level.

4.Objectives: What is to be achieved?

4.1.General objectives

The general objectives of the initiative are to contribute to:

4.2.Specific objectives

In order to achieve the general objectives, the following specific objectives should be addressed:

5.What are the available policy options?

5.1.What is the baseline from which options are assessed?

Maintaining the status quo or baseline scenario analysed below would have short-, mid- and long-term travel- and security-related impacts. Having in mind the current trend of digitalisation in all spheres of life, including international travel and migration, as well as the possibilities to address the problem drivers brought about by digital solutions, the cost of no action at EU level in the space of digitalisation of travel documents and travel facilitation are already visible and would continue to increase if the status quo were to continue. The ability of competent authorities to process increasing flows of travellers in an effective and efficient manner would be hampered, leading to further security risks as well as congestion at border-crossing points, including longer waiting times as well as confusion and frustration for travellers.

Without EU action, Member States would possibly develop (or not) their own national solutions for leveraging digital data for making border checks more efficient and effective, resulting in a fragmented landscape of technical implementations, different levels of digitalisation and security, which could lead to decreased security at the external borders as well as prolonged waiting times and less convenient procedures for individual travellers. Given that the external borders of the Schengen area are becoming smarter and more digitalised, new legal requirements for identification are being enforced. Furthermore, as further possibilities are emerging in the eIDAS framework, it is highly likely that Member States will digitalise travel documents within their own competencies, and several Member States are already leveraging the chip data from passports and identity cards for national purposes, while some have explicitly prohibited it.

A digital solution implemented for EU citizens by one Member State may not be interoperable with the one chosen in another Member State, thereby creating practical obstacles to the exercise of the right of free movement, in particular where this situation should result in entry being refused to the EU citizen. Moreover, such fragmentation would severely jeopardize the aim of introducing a truly integrated management system for external borders.

Next to the Member States’ initiatives, industry and associations would continue to develop proprietary or transport-mode specific solutions at regional or international level, which the EU cannot necessarily influence, in the absence of EU-wide standards.

Such divergences in standards will lead to the need for travellers to use a variety of apps or other digital solutions when travelling to and across the Schengen area and – possibly combined with the absence of digital solutions in some Member States – can be expected to result in significant confusion among travellers as to whether the specific technological solution they are using is accepted by the Member State of destination/departure.

Existing national facilitation programmes

The current legal framework 75 allows Member States to establish national facilitation programmes on a voluntary basis, in order to allow pre-vetted third country nationals to benefit from derogations upon entry from certain aspects of thorough border checks. The derogations, however, do not pertain to the verification of the authenticity and integrity of travel documents or for pre-registering biometric data for speeding up controls of third country nationals at border-crossing points. Similarly, no facilitation programmes for EU nationals making use of digital travel credential data are provided for in the current acquis. The requirement to carry out border checks, including the verification of the authenticity and integrity of travel documents, at the actual border-crossing point, is common to all Member States and concerning both EU nationals and third country nationals, as provided in the Schengen Borders Code.

Digital travel credentials

Under EU law, Member States have an obligation to issue passports or identity cards to their nationals 76 . However, the current legal framework does not provide for the possibility for Member States to issue or use these documents in a digital format. Instead, EU law requires them to issue them in a physical form. Moreover, the legal framework concerning the issuance of documents and the carrying out of border checks does not acknowledge the existence of a digital travel credential or digital travel credential based on a physical travel document, i.e. the solution chosen by ICAO for its DTC. Any additional exploitation of digital data therefore would need to be based on purely national rules that have to comply with the existing acquis.

Finally, in the absence of a legally accepted standard for digital travel credentials in the area of international travel, the travel industry (e.g. carriers using any mode of transport, transport hub operators and accommodation providers) has no possibility to integrate such documents into their processes as there is no legal merit attached to them. This is relevant e.g. in the case of air and sea carriers in fulfilling their obligation to check the travel documents of passengers or establishments providing accommodation and their obligation to confirm identity of accommodated persons.

5.2.Description of the policy options

5.2.1.General definition and policy changes

The impact assessment evaluates three different policy options, with varying levels of EU intervention in the current processes concerning border checks and the validation of travel documents.

Option 1 (O1): Implement the ICAO DTC standard (optional) with travel facilitation, automated border control or manual booths (optional) and transition period. This option allows Member States to make available digital travel credentials and to facilitate the border checks of persons with such digital travel credentials. It would remove legal obstacles for Member States to use, at their discretion, digital travel credential data for border check purposes and would be based on existing international standards.

Option 2 (O2): Implement the ICAO DTC standard (mandatory) with travel facilitation, automated border control or manual booths (optional) and transition period. This option obliges Member States to make available digital travel credentials and allows them to implement measures at border crossing points for the use of such digital travel credentials. It would remove legal obstacles for Member States to use, at their discretion, digital travel credential data for border check purposes and would be based on existing international standards.

Option 3 (O3): Implement the ICAO DTC standard (mandatory) with travel facilitation, automated border control or manual booths (mandatory) and transition period. This option obliges Member States to make available digital travel credentials and to implement measures at border crossing points for the use of digital travel credentials. It would remove legal obstacles for Member States to use digital travel credential data for border check purposes, and it would establish a harmonised approach to the use of such digital documents across Member States.

Explanation of building blocks

All policy options have certain common building blocks or sub-elements. The legal instrument for all policy options should be a regulation, since they all entail amendments and additions to existing EU acquis, notably to the regulations concerning travel documents and border checks. A “soft law” approach (exchange of good practices, recommendations, training, workshops etc.) was ruled out from the outset as the current legal framework prevents the use of digital travel credentials for facilitating travel and for carrying out border checks.

Each policy option also proposes a transition period 77 . 

It should be noted that the policy options only pertain to the use of digital travel credentials in a border-crossing context and in the course of border checks. However, by establishing a uniform format for digital travel credentials, these documents could, in addition, be integrated into the processes concerning API data collection by air carriers, ETIAS and visa applications as well as possible third-party use cases (e.g. by air, land and sea carriers), in accordance with the applicable law and commercial relationships. Moreover, EU citizens’ digital travel credentials can cater for several additional use cases under national law (e.g. proving identity).

Moreover, all options consider the ICAO digital travel credential Type 1 as the preferred standard for reasons of global interoperability as well as technical maturity. It is an existing standard, endorsed by ICAO – the body responsible for setting international specifications and standards for travel documents – that will most likely become the go-to option also for non-EU and non-Schengen countries developing digital travel credentials.

According to this standard, the digital document is derived from an existing travel document by copying the data stored on the electronic chip (except for the fingerprints) into an application hosted on a device. This can be done using the mobile phone or e.g. a self-service system installed at border-crossing points or other dedicated locations. The copy (DTC) could also be created and submitted to the holder’s digital application by the travel document issuing authority, in conjunction with issuing a new physical travel document.

The policy choices are neutral as to how this creation or derivation of the credential is carried out for EU citizens, allowing Member States to choose from one or several methods, as long as these methods meet certain security requirements, e.g., including the verification of the authenticity of the original physical travel document and the verification of the person’s identity by matching their live facial image to the facial image stored in the chip of the travel document. For third country nationals, the creation or derivation of the digital travel credential would have to be centralised in a common EU solution (see below) as these third country nationals do not have Member State-issued digital identity wallets compliant with EU specifications.

The traveller can then submit the digital travel credential to the relevant authorities via an application. The competent border authorities receive the data and can carry out the necessary checks against databases and validate the authenticity of the travel document. For third country nationals, it can also verify the conditions of entry and stay before the person reaches the border-crossing point, meaning that checks can be done even before issuing a travel authorisation or visa, thus reducing the number of refusals of entry at the border. The necessary checks are done in advance and the accepted travellers can pass through the border-crossing point without needing to present their travel document to a border guard. They may continue directly to the automated border gates or manual booths supported by facial recognition capabilities, which will match the traveller’s face with the facial image submitted as part of the digital travel credential. At this point, and at least for border checks on entry, the chip of the physical travel document chip could be read at the gate to check whether the traveller carries the physical travel document. During this step, the device conducts active or chip authentication/clone detection of the travel document’s chip. This procedure brings down the inspection time from currently 6.2 seconds to 2.9 seconds per traveller 78 . There is no need to open a passport as the inspection device does not need to read the machine-readable zone to gain access to the contents of the chip, as is the case today. This phase could be skipped during border checks on exit. Moreover, additional time is saved since database checks may not necessarily need to be carried out at this point since they have already been done in advance.

ICAO DTC Types 2 and 3 differ from Type 1 notably with their lesser reliance on the underlying physical travel document. In Types 2 and 3, the virtual component, meaning the digital copy of the chip data of current travel documents remains the same. However, the physical component, whose verification ensures that the document is not a clone, takes another (e.g., mobile device) form. The physical component needs to have cryptographic and communication capabilities, just like the chip of a physical travel document does. In Type 2, the issuing authority still issues an underlying physical travel document on which the DTC type 2 is based, and that physical document acts as a back-up. In Type 3, the DTC is issued and digitally signed by the issuing authority as in Type 2, but without an underlying physical travel document. The physical component specifications needed for ICAO DTC Types 2 and 3 have not been finalised.

In addition to the ICAO DTC Types, industry has developed its own standards for digitalising several parts of the travel continuum, including leveraging the data on travel document chips (e.g., IATA OneID). These are often referred to also as “digital travel credentials” or alternatively “verifiable credentials”. The main added value of these standards for industry, such as airline carriers or airport operators, is the fact that they may cater for “selective disclosure”, which the ICAO DTC does not. In short, these verifiable credentials can be designed and used in a way that certain sensitive data that is not needed (e.g., social security number) is also not collected or submitted to the relying party.

Most stakeholders consulted across the board indicated that the ICAO DTC Type 1 is the most realistic option to implement digital travel credentials in the EU from a regulatory and technical perspective. However, the initiative should be drafted in a way so as to enable the transition from Type 1 to Type 2 once the technical standards evolve. During the targeted consultations, all respondents maintained that compliance with ICAO standards for digital travel credentials was essential in the context of external border management. Also, in all policy options, both EU citizens and third country nationals are included in the scope. By including third country nationals within the scope of the initiative, Member States could further improve the efficiency and effectiveness of checks on travel documents, facilitate bona fide travel and contribute increasingly to the security of the external borders and internal security of the Union.

At the same time, EU citizens and third country nationals should not be required to obtain and hold a digital travel credential. This option, too, has been ruled out from the start as being disproportionate to the objectives to be achieved. Also for reasons of inclusivity and non-discrimination, having a DTC should not be mandatory. Moreover, the results of the public consultation carried out in preparation of this impact assessment do not support making this a mandatory requirement, although according to the Special Eurobarometer, 68% of Europeans are in favour of using DTCs for international travel 79 . Therefore, in all policy options, it would be up to individual persons to choose whether they wish to obtain and use DTCs, acknowledging that there may be several reasons for a person not wanting or being able to use a DTC. In addition, steps should be taken to ensure that travel remains fully possible for persons not in possession of a DTC, even if they will not enjoy the facilitation resulting from the use of DTCs. 

With regard to the derivation of the DTC from the existing travel document and its submission to the competent authorities, all policy options envisage a central EU solution to ensure a harmonised level of security, integrity and convenience. Without a common technical solution, each Member State would be required to develop their own solutions and travellers would have to have and use multiple applications depending on the Member State responsible for carrying out the border check. Moreover, 66% of the Europeans and 76% of the Member State authorities surveyed would prefer having one single application at EU level. At the same time, none of the policy options entail a centralised database for storing digital travel credential data as the central EU solution would only act as a router, transferring the DTC submitted by the traveller to the competent authority, based on information provided by the traveller. In any event, existing IT infrastructure should be considered for reasons of technical feasibility, ease of implementation and financial costs. Taking into consideration the ongoing work of eu-LISA on developing several IT systems as well as their inter-dependencies that also impact this central EU solution, the Agency estimates that this DTC solution could enter into operation in 2029, which also supports the need for a reasonable transition period.

The central EU system should include the functionality to store the DTC (for EU citizens) in a digital identity wallet compliant with EU specifications.

The main difference in the three policy options therefore relates to the level of flexibility enjoyed by the Member States concerning 1) the possibility for citizens to have DTCs (as some have explicitly prohibited the access to the chip data) and 2) allowing travellers to use DTCs for cross-border travel. A combination of policy options could also be envisaged, i.e. allowing Member States to opt-in for a certain period (as in O1 or O2) before being obliged to do so (as in O3).

The following section describes the policy options, closely linking them to the drivers of the problems and the identified objectives.

Full reliance on physical documents

All options would enable Member States to leverage digital travel credential data, including biometric data, for verification purposes. They would equally allow Member States to digitalise parts of the border check process, notably the verification of the traveller’s identity, and of the authenticity and integrity of the travel document, as well as ensure a smoother travel experience by removing the requirement to inspect physical travel documents in detail at the border-crossing points. Each policy option would therefore allow EU citizens and third country nationals to use a digital travel credential when going through border checks, but with varying degrees of harmonisation. O1 would leave it up to Member States to decide if and where DTCs could be used while O2 would enable and O3 would oblige Member States to create separate lanes or otherwise dedicated traveller processing for users of DTCs.

Each policy option would also establish a uniform definition of a DTC at EU level. This would create the possibility of integrating the DTCs into existing immigration processes, like EES, ETIAS and visa applications or the collection of API data. This would also enable carriers and other stakeholders to develop integrations into their systems, where the DTC could be used for booking, ticketing, baggage reconciliation and other travel-related services. Currently, these services – each of which requires travel document data and verification of identity – are based on either manually inserted data or the physical scanning or inspection of the travel document.

However, despite creating an EU-wide framework for digital travel credentials, all policy options would require travellers to carry their physical travel document with them since certain checks may need to be carried out on it. Similarly, third countries are unlikely to accept travellers without a physical travel document – at least in the near future.

All policy options would support the general objectives of complementing the security of travel documents and enable governments to receive relevant data in advance to reinforce the effectiveness of border checks. Each policy option would also give travellers the opportunity for a more seamless travel experience and facilitate the exercise of the right to free movement when it involves the crossing of an external border of the Schengen area. The extent to which these goals are achieved by the respective options varies due to the differences in whether Member States are obliged to implement DTCs at the external borders or not.

Finally, in terms of investing in European digital capacities and shaping Europe’s digital transformation as well as ensuring global interoperability, all options would be based on the ICAO DTC technical standard. Countries worldwide already implement the ICAO standards for physical travel documents and will likely implement the ICAO DTC standards for digitalising travel documents for international travel purposes.

Increasing chances of errors in capturing and transmitting required data

Passenger data is collected and submitted at various touchpoints during international travel. Each policy option would enable the automatic and accurate capture and transmission of required travel document data based on the DTC. All options can therefore support the objectives of making the Schengen area more secure, improving the efficiency of integrated border management while making the travel journey for individuals more certain by eliminating errors and incompleteness of manually transcribed or self-declared passenger data.

Possible divergences in standards in the implementation of digital travel credentials

All policy options would essentially harmonise the standard for DTCs and the way in which they can be used in a border-crossing environment. The only difference between the options relates to whether Member States are allowed or obliged to do so.

Peaks in border crossings putting pressure on verification processes

O1 and O2 would potentially tackle the problem driver concerning peaks in border crossings, by allowing Member States to leverage the digital travel credential data through pre-checks and an easier passage of travellers using digital travel credentials, but without an obligation to do so. O3 entails mandatory facilitations for those using a DTC.

Each policy option would also enable the integration of DTCs and the pre-submission of certain data into existing migration and border processes, including the Entry/Exit System, therefore reducing the time spent by each traveller registering their data at border-crossing points. Under O3, these integrations would be mandatory (if the third country national chooses to use a DTC), while for O1 and O2, this would be up to the Member States’ discretion.

Varied levels of digital maturity among Member States in the area of border control

Each policy option would establish a uniform standard for the DTCs used for border crossing purposes in the Member States. However, O1 and O2 would merely allow Member States to implement DTCs at their external borders, which would likely lead to some Member States not implementing them, leading to further divergences. O3 would oblige them to do so, therefore reducing even further the varied levels of digital maturity or traveller confusion and ensure a harmonised application of the DTC use cases in the context of external borders.

5.3.Options discarded at an early stage

A “soft law” approach (exchange of good practices, recommendations, training, workshops etc.) was ruled out from the outset as the current legal framework prevents the use of digital travel credentials for facilitating travel and for carrying out border checks. Therefore, legislative changes are necessary.

Creating a new EU standard for digital travel credentials that is not ICAO-compliant has been excluded. ICAO already started its work in 2016 to digitalise travel documents with a view to facilitating air travel. All Member States currently use the ICAO standard for physical travel documents and it is the only standard that ensures global interoperability. 94% of Member States surveyed in the written consultation opined that a uniform approach across the EU is essential and all deemed that adherence to ICAO standards is very essential. If the EU created a new standard for digital travel credentials, such travel documents would not be interoperable with current systems deployed in the EU and globally.

Implementing the ICAO DTC standard and enabling border checks without automated border control or manual booths, i.e. relying fully on seamless biometric matching on the move using biometric corridors has also been excluded. Similar to e-gates or manual booths equipped with facial recognition hardware, biometric corridors use biometric data to authenticate travellers. However, instead of having to pass through an actual gate where the electronic identity document is read, biometric corridors allow travellers to walk straight through the border checks without presenting a document on the reader or without stopping to interact with a facial recognition camera. This is possible because travellers submit their DTC, including biometric data, prior to their arrival to the border authorities. As is the case with O1 to O3, the border authorities can verify the authenticity and integrity of the travel document in advance as well as carry out certain other checks in support of the border check process. Although the Commission has already funded research involving biometric corridors, allowing D4FLY 80 to develop a prototype of a biometric identity verification corridor which makes identity checks on the move possible 81 ,  the biometric corridor will not be assessed further in this impact assessment. It is currently technically, legally as well as operationally unfeasible to envisage biometric corridors for checking all travellers with a digital travel credential.

Finally, the option of obliging EU nationals and third country nationals to use a DTC when crossing external borders was excluded for reasons of inclusivity, non-discrimination as well as the opinions expressed in the public consultation.

6.What are the impacts of the policy options?

6.1.Economic impact

6.1.1.Impact on EU institutions and agencies

As regards the economic impact, each option would have an impact on eu-LISA that would need to establish a central solution for the creation of DTCs and their submission to the competent authorities.

An application enabling EU citizens and third country nationals to derive the DTC from an existing passport or identity card (for EU citizens only) and to submit it to the competent Member State would have to be developed and maintained centrally, in order to ensure interoperability across Member States and for reasons of cost-efficiency.

In order to submit the data to the competent Member State in a secure way, existing IT systems should be leveraged to the extent possible. Certain components of the API Router, as provided in the new API rules, could be re-purposed for allowing for a secure transfer of data entered by the individual traveller through the customer-facing application to the competent authority. For eu-LISA, it was estimated that an additional budget of around EUR 49.5 million (EUR 6 million under current MFF) would be needed for the development, maintenance and operations of the technical solution. Furthermore around 20 FTEs (full-time equivalents) will be required between 2027 and 2030 to ensure that eu-LISA has the necessary resources to perform the tasks attributed to it in developing the EU-wide application.

These costs for the development are more or less the same with all policy options. However, costs related to the maintenance and additional services, such as customer service and data centre capacity, grow incrementally from O1 to O3, in view of the increased uptake of DTCs by travellers in O2 and O3.

6.1.2.Impact on Member States

As regards the impact on Member States, in terms of administrative and IT costs, O1 and O2 would not entail any additional costs if they chose not to implement DTCs at their external borders. It they did, the additional costs would be essentially the same as in O3.

Since a central EU solution would be available for the derivation of DTCs, Member States would not need to invest in additional hardware or software for this component under any of the options. However, existing hardware and software would need to be updated to be able to handle DTCs at the external borders. Interviewed border authorities do not expect this to be associated with high costs, since existing systems are able to handle DTCs due to the backwards compatibility of the DTC standard. Expected one-off investments pertain to server and storage capacity to temporarily store DTCs submitted by travellers (EUR 250 000 82 ), an integration into existing national border management systems (EUR 300 000 to 700 000 per Member State 83 ), upgrade or procurement of hardware 84  to process DTCs and support facial recognition as well as training of personnel (EUR 30 000 per Member State). With the entry into operation of the EES, Member States should already have in place the necessary hardware and software for facial recognition at border crossing points. To account for changes in national setups, differences in technological maturity and capacities as well as for reasonable overhead, it is estimated that an average of EUR 2 million per Member State is required to implement DTCs at their external borders (see Annex 4 for more details).

Recurrent benefits for Member States include making checks on travel documents during travel authorisation and visa application processing and border crossings more efficient, improvements in the data quality as well as time saved for border guard personnel on each traveller. Upstreaming the checks on the travel document on the basis of the DTC and of persons against different databases significantly decreases the time it takes to check a traveller at the border, when comparing to checking travellers in the current border check process. Based on statistics from automated border control log data and statistics on border checks at manual booths at entry and exit, the average time varies between 30 seconds and 90 seconds, depending on the nationality 85 . For travellers using a DTC, the average time for the check at the actual border (verification of identity and proof of carrying the travel document) was 8.8 seconds 86 . If the reading of the physical travel document is skipped at exit, the average time for the border check at the actual border was between 2 and 4 seconds (verification of identity). Moreover, being able to pre-vet travellers using DTCs allows the border authorities to better focus on risk profiles and detect criminals, terrorists as well as victims of human trafficking more effectively. The time and correspondingly money saved by Member States depends on the level of uptake of DTCs. If 1 in 10 travellers used DTCs, the financial savings compared to the baseline scenario are 8%, whereas if 8 in 10 travellers used DTCs, the savings would add up to 63%. The economic impact can therefore be rated as positive, albeit it is impossible to accurately quantify this in financial terms (see Annex 4 for more details).

6.1.3.Impact on EU citizens

Under each option, the use of DTCs would be voluntary for EU citizens. The creation and use of a DTC with the central EU application would be free of charge. If Member States decided to integrate the creation of DTCs into the process of issuing new travel documents upon application, national law on application fees applies 87 . 

EU nationals would be able to reuse their DTCs for their travels, resulting in a one-time investment in terms of time spent for each individual travel document. Depending on the technical and organisational choices, it is estimated that for all policy options it would be no longer than 1-3 minutes to derive a DTC from an existing travel document 88 . Owing to the quicker processing of travellers using a DTC, also EU nationals who decide to continue using physical travel documents will benefit from the accelerated procedures through reduced waiting times at the border for those using a DTC. These beneficial impacts increase incrementally from O1 to O3.

With regard to the main concerns expressed by stakeholders in the public consultation and Eurobarometer survey, including risks associated with data security/protection, software failures and device problems 89 , each option addresses them in an adequate and similar way owing primarily to the requirement of common technical standards, the establishment of a common EU technical solution and the applicable rules on data protection (see point 6.2.2. on data protection for more details). Moreover, due to the voluntary nature of the use of DTCs and the fact that physical travel documents are still used, software or device failures will not negatively affect the traveller’s eligibility to cross external borders as they will have a physical travel document to fall back on. The risks associated with potential data leaks need to be addressed with high security standards and the use of technical methods for the secure transmission of personal data through the common EU technical solution.

6.1.4.Impact on third country nationals

Under each option, the use of DTCs would be voluntary for third country nationals. The creation and use of a DTC with the central EU application would be free of charge. This would also not have an effect on the fees concerning ETIAS or visa applications.

Similar to EU citizens, it is estimated that for all policy options it would be no longer than 1-3 minutes to derive a DTC from an existing travel document. Owing to the quicker processing of travellers using a DTC, also third country nationals who decide to continue using physical travel documents will benefit from the accelerated procedures. Due to the possibility of pre-enrolling additional data required by the EES, instead of enrolling those data at the border crossing point, additional time would be saved. These beneficial impacts increase incrementally from O1 to O3.

6.1.5.Impact on industry

Three types of enterprises could be affected by the implementation of DTCs, notably those involved in the production of travel documents, those involved in the provision of infrastructure, software and services for border management as well as transport hub operators and carriers. However, none of the options envisage any additional financial burden on them as the initiative does not impose any obligations on them concerning the introduction of DTCs in their workflows.

Several private enterprises are involved in the production of travel documents in the EU. The derivation of the ICAO DTC Type 1 would not change the current issuing process of physical travel documents.

There are some enterprises involved in the management of large border control points at airports and seaports 90 . There may also be cooperation with private enterprises regarding security and passenger flow control at the airport. No costs will arise from this initiative for enterprises in the field of security-related services and other services in the context of digital travel and border control management, unless individual Member States or authorities would choose to outsource some of the activities to such enterprises. This can, however, not be predicted at this stage and would, in any case, in turn have a positive financial impact on those enterprises.

Carriers 91 are currently involved in the collection and transmission of passenger data and conduct document checks, in line with their legal obligations under EU and national law.

At check-in, air carriers check passenger information and travel documents, create API and send it to border authorities. There are approximately 1000 air carriers who operate flights to, from and/or within the EU 92 . Under the revised rules on API 93 , air carriers will be obliged to collect the API data using “automated means”.

Air carriers are expected to benefit significantly from the improved data quality facilitated by the use of digitalised travel documents, both in terms of less administrative burden as well as less penalties for the submission of erroneous API data. In the context of the impact assessment for the proposal on the API Regulation(s), it was estimated that sanctions for non-compliance and transmission of erroneous API data correspond to a maximum amount of EUR 80 million per year.

At the same time, a standardisation (through this initiative) of the technical format to be used in that area is neither necessary nor advantageous, as the check-in and onboarding process goes, for the traveller, through the specific software of the carrier, and is not impacted by the technical solution for DTCs inspected at external borders.

During the consultation activities, industry representatives (IATA) underlined the importance of ensuring the peaceful co-existence of the ICAO DTC standard – for official/authority purposes – and industry standards, which commercial actors may rely on in engaging with their customers, while fulfilling their obligations both in relation to the collection and provision of data to competent authorities on the one hand, and to the respect of the right to data protection and privacy on the other.

It is already envisaged that air carriers could integrate into their mobile applications the possibility e.g., of optically scanning with a smartphone the machine-readable data of the travel document or retrieving the necessary data elements from the chip of the travel document or retrieving the necessary data from the travellers’ digital identity wallet that already contains an attribute with those data. Such methods of providing data could also be used by air carriers when implementing their obligations stemming from the API Regulations. While these features are not directly dependent on the ICAO DTC or this initiative, establishing a common EU standard (the ICAO DTC) could complement the API Regulations. The main focus of this initiative is on the creation of DTCs and their use for the purpose of crossing external borders and of carrying out border checks, but as it would standardise the use of DTCs at external borders in all Member States, including the possibility to store the DTC in the EUDIW, it would also enable and facilitate the use of DTCs for other purposes, e.g., the automated collection of API data.

Therefore, while not within the scope of this initiative here, Annexes 3 and 4 nevertheless look at potential impacts of any voluntary DTC implementations that have as an objective to allow for quicker and more accurate processing, in order to demonstrate in more detail how the DTC will be situated in the overall framework of already existing travel regulations.

There are no direct impacts for SMEs (outside of the travel domain). Despite time savings for individual travellers, including business persons, any indirect impact on SMEs, for whom these business persons might be travelling, is too remote to measure at this point.

Due to the difficulty to quantify in financial terms the possible indirect benefits to both large companies and SMEs, the ex-post evaluation should explore these benefits in more detail.

6.2.Social impact

6.2.1.Impact on security

O1 to O3 would introduce DTCs at the external borders with varying levels of obligation, and therefore, amount of uptake. The implementation of DTCs under each policy option would enable the border authorities to carry out advance checks on travel documents, reduce bottlenecks at border crossing points during peaks and plan their resources and operations more effectively. For land borders, the introduction of DTCs would allow authorities for the first time to know the identity of those travelling with DTCs in advance, as – contrary to air borders – there is currently no advance sharing of data on travellers crossing land borders. For sea borders, the DTC would expand the current scope of travellers known in advance, as in particular travellers on ferries are excluded from current systems on advance traveller information 94 . However, also air borders would benefit from each policy option, since border authorities are not obliged to carry out checks on the basis of API data received from air carriers. Similarly, they would not be obliged to do so on the basis of O1 and O2. With O3, border authorities at all types of border crossing points would be obliged to carry out advance checks against the pre-submitted DTC and travel data and to effectively ‘pre-clear’ or ‘pre-flag’ travellers for expedited entry/exit or a second line inspection.

The expected increased security brought by each policy option relies on the fact that several checks, including the verification of the authenticity and integrity of the travel document, can be carried out reliably in advance of travel. Traffic across border crossing points is not stable but is rather marked by troughs and peaks. Correspondingly, the shortcomings currently observed in Schengen evaluations that are often linked to the fact that border authorities lack the capabilities to carry out systematic checks on all travellers on the spot especially during peak times of travel could be remedied. With the introduction of DTCs, these checks can be carried out in advance, providing the authorities with more time to focus on risk profiles and carry out systematic checks on the travellers that did not submit their DTC, with varying degrees of uptake of DTCs per policy option. This is expected to bring benefits in terms of improved detection of cross-border criminal activities at all types of border crossing points.

O3 would have the biggest impact on these aspects as the Member States would be obliged to allow both EU national and third country national travellers to submit their DTCs for advance checks. O3 would distribute the benefits of the introduction of DTCs at the external borders to each Schengen country.

The risks associated with the use of DTCs remain the same as with the use of physical travel documents. Due to the cryptographic link between the DTC (Type 1) and the physical travel document on which it is based, authorities are able to detect clones. As long as the inspection systems deployed by authorities have the necessary certificates to validate the authenticity and integrity of travel documents, including digital ones, the main risk associated with their use pertains to look-alike fraud (impostor fraud). In addition to having facial images in travel documents and DTCs, travel documents issued by Member States continue to contain fingerprints, while DTCs under the ICAO DTC Type 1 standard do not. Fingerprints of third-country nationals will be collected and stored in the Entry/Exit system following its start of operations. An effective measure to counter look-alike fraud, is for border authorities to carry out a match of this additional biometric data against the live fingerprints of the person.

6.2.2.Protection of personal data

First, in terms of protection of personal data and the purposes of processing, it should be recalled that border authorities already process personal data of persons crossing the external borders, as do issuing authorities when issuing travel documents. Secondly, it should be stressed that the amount of personal data processed under each option does not change compared to the status quo. It is only the temporal element of data processing that changes, by upstreaming the verification of the authenticity and integrity of the travel document and the consultation of databases. Both the purposes of processing and the categories of personal data processed remain unchanged. For third country nationals, part of the assessment and verification of the entry conditions could similarly be done in advance of the person actually arriving at the border crossing point.

An overarching benefit of all three policy options is that they would improve the data quality and make it easier to identify travellers correctly.

Despite the use of a central EU solution under each option, the DTC would not be centrally stored nor would there be any new EU database on passports or identity cards. Once the credential is created/derived from an existing travel document, it would be stored on the person’s device. Data subjects therefore remain in control of their own data and choose if and when to use it. If the person chooses to use it for an advance check and facilitated travel, they can submit it via the application to the competent authorities. While it is difficult to ascertain the exact roles before the adoption of the proposal, it is likely that Member States would be considered joint controllers in the sense of Article 26 of Regulation (EU) 2016/679 (the General Data Protection Regulation, GDPR), while the EU agencies responsible for developing the IT infrastructure would likely be data processors in the sense of Article 3(12) of Regulation (EU) 2018/1725.

Appropriate safeguards, such as encryption of personal data and cybersecurity measures, should be employed to prevent data leaks and breaches and to protect against cyberattacks and software applications that run automated tasks.

The facilitated travel use case for both EU nationals and third country nationals under all options requires the temporary storage of the pre-submitted DTC submitted by the user in a local database in the competent Member State. This temporary database/gallery would be populated with the facial images that are contained in the pre-submitted DTCs. This is necessary to biometrically match the traveller to the pre-submitted DTC as he or she presents him/herself at the border crossing point. This entails a one-to-few match with a view to verifying the identity of the person, as opposed to a one-to-many biometric matching for identifying an individual. Once the border check has been carried out, the data should be deleted from the temporary database.

Under all options, the EU system would introduce uniform data processing practices that would apply to all Member States. However, under O1 and O2 it would be up to individual Member States to decide whether they allow persons to submit their DTC in advance and benefit from travel facilitations. O3 would oblige all Member States to do so. All options would nonetheless have the benefit of establishing a uniform format for the DTC in itself, ensuring its compatibility across the EU as well as the necessary security elements to the DTC and the EU-wide application, to protect the data from unlawful use, data leaks and cyberattacks.

The use of DTCs would be voluntary for individuals in all options. Therefore, in addition to border authorities having the legal basis under both EU and national law to process personal data, including biometric data, in the context of border checks, individual travellers would provide their consent to the processing and the temporary storage of their DTC in the local database of the competent authority. Consent may at any time be revoked without affecting the person’s right to travel or cross borders.

This issuance and creation of DTCs will lead to the processing of personal data (including biometric data, namely the facial image of the holder of the DTC). The obligation to include a facial image in the DTC issued on the basis of identity cards constitutes a limitation to both the right to respect for private life and the right to the protection of personal data 95 . Limitations on those rights must be provided for by law and must respect the essence of those rights. In addition, in compliance with the principle of proportionality, such limitations may be made only if they are necessary and genuinely meet objectives of general interest recognised by the Union or the need to protect the rights of others 96 .

In this context, the applicable EU legislation 97 , notably the provisions on the protection of personal data in the context of physical passports and identity cards, would apply. The limitations, as well as the conditions for application and scope of those limitations, will thus be laid down in EU legislation. The obligation to include the facial image of the holder does not adversely affect the essence of the fundamental rights enshrined in Articles 7 and 8 of the Charter, as the information provided by the facial image does not, in itself, make it possible to have an overview of the private and family life of data subjects 98 .

The inclusion of the facial image in the DTC is intended to enable the holder of that credential to be reliably identified by comparing their facial image to that in the DTC when the DTC is presented, and thus to combat document fraud, which is an objective of general interest recognised by the EU, as also confirmed by the Court of Justice 99 .

The inclusion of the facial image in the DTC is appropriate for attaining the general-interest objective of combating document fraud, as it is a means to reliably verify the identity of the holder of the DTC, and thereby to reduce the risk of fraud.

This is not called into question by the fact that DTCs do not, unlike physical passports or identity cards, include the fingerprints of the holder, because DTCs are used in combination with a physical document rather than replacing them. If they have doubts as to the authenticity of the DTC or the identity of the holder, competent authorities retain the possibility to use the fingerprints stored in the chip of the passport or identity card. There are currently no standards for the inclusion of fingerprints in DTCs, and due to the cryptographic protection of fingerprints, it is in any event not possible to extract them from the chip of the passport or identity card.

The inclusion of the facial image is also necessary to attain the general interest pursued. Without its inclusion, the DTC would only contain biographic data of the holder (such as name, date of birth, etc.), which is not a reliable and effective means of identification.

In addition, DTCs will not contain personal data that are not already contained in the chip of the passport or identity card on the basis of which it is issued. In fact, they will contain fewer personal data, given that the DTC does not contain the fingerprints of the holder.

As already noted by the Court of Justice in Landeshauptstadt Wiesbaden on physical identity cards 100 , the limitations resulting from the inclusion of such biometric data are not – having regard to the nature of the data at issue, the nature of the processing operations, the manner in which they are carried out and the safeguards laid down – of a seriousness that is disproportionate when compared with the significance of the objective pursued. Accordingly, such a measure must be regarded as being based on a fair balance between, on the one hand, those objectives and, on the other, the fundamental rights involved. As a result, the limitations on the exercise of the rights guaranteed in Articles 7 and 8 of the Charter are not contrary to the principle of proportionality.

Under all options, the necessity to carry out a data protection impact assessment should be carefully considered by the competent authorities, in light of Article 35 of the GDPR.

None of the options envisage international data transfers within the meaning of the GDPR.

6.2.3.Protection of fundamental rights

In terms of impacts on fundamental rights other than the right to privacy and the protection of personal data, none of the options would affect the protection of fundamental rights negatively. O1 to O3 would make the use of DTCs voluntary for individuals, therefore allowing people to choose between having or not a DTC and between using it or not. Some persons may be unwilling or unable to use a DTC due to personal reasons, low IT literacy, disabilities or e.g. not owning a device necessary for its use. Each policy option would allow persons to undergo border checks within the current framework and they too would potentially benefit from shorter waiting times, due to the fact that others have opted in to use the DTC, freeing up capacities and shortening queues at border crossing points. Therefore, the principles of non-discrimination and inclusivity are respected in each policy option.

With regard to EU citizens and their exercise of the right to free movement, O3 would oblige Member States to facilitate the travel of DTC users, while O1 and O2 would leave it up to individual Member States to decide. Overall, all options are expected to have a positive impact on the practical exercise of the right to free movement, albeit to a varying extent.

Similarly, regarding the detection of cross-border crime and of crimes like child abduction, O3 would enable border authorities to carry out several checks in advance of persons arriving at the border crossing point and to be better prepared to deal with those cases, while in O1 and O2, the use of DTCs would be dependent on the Member State.

Any possible negative outcome regarding the use of DTCs under the options, e.g. concerning refusal of entry at the border, data breach or unlawful use of the DTC would be subject to the already applicable remedies under EU and national law.

6.3.Environmental impact

No significant environmental impacts are expected from this initiative. The initiative is not expected to have an impact on the volume of travel as none of the policy options would have an impact on the availability of travel e.g., by virtue of an increased frequency of scheduled routes, lower prices or lesser immigration-related requirements. The identified policy options will as such not affect the emissions of greenhouse gases in the atmosphere by transport operators, or the anticipated demand for passenger transportation. DTCs under O2 and O3 will not fully replace physical travel documents. Despite some additional digital data processing, the identified policy options will not as such affect the emissions of greenhouse gases in the atmosphere. Moreover, ensuring a centralised solution for the creation and submission of DTCs, as envisaged under all policy options, will lead to lesser data centre capacity needs than the sum of all capacities the Member States would need to secure individually.

7.How do the options compare?

To determine the preferred option, the policy options have been assessed and compared against the baseline scenario in the light of the following criteria:

§Effectiveness, i.e., to what extent the option meets the policy objectives;

§Efficiency, i.e., the relative weight of the costs and benefits of the option;

§Coherence, i.e., the complementarity, overlaps and gaps in the proposed policy options with regard to existing initiatives and systems;

§Proportionality, i.e., the extent to which each policy option is limited to what is necessary to achieve the objectives.

7.1.Effectiveness

For each policy option, an assessment was carried out of the expected effectiveness in achieving the policy objectives compared to the baseline scenario, addressing the advantages and disadvantages with a scoring of -3 to +3, ranging from very negative impact to very positive impact. The different criteria are assessed in how they help attain the general and specific objectives. The uptake percentages on the use of DTCs per policy option is projected based on the availability or not of DTCs (ranging from a few to all Member States making DTCs available along with the associated travel facilitations) and the results of the stakeholder consultations.

Given that all policy options contain similar characteristics with varying combinations of voluntary and mandatory implementation, the effectiveness of the options vary in degree when compared against the baseline. However, all options entail an improvement compared to the baseline by ensuring, at least, under O1, that the same (global) standard is used if Member States decide to implement DTCs (limited positive impact 0.5). With mandatory implementation under O2 and O3, i.e. creating the availability for all EU citizens to have a DTC, both options are effective in their contribution to digital development across the EU and for fostering trust between the Member States through a harmonised framework. However, only O3 would ensure a fully harmonised approach to the use of DTCs at the external borders, bringing the most added value, effectiveness and consistency (positive impact 1.5) as opposed to O2 with voluntary use of DTCs at external borders (medium positive impact 1.0).

For O1 and O2, travel facilitation provisions with the use of DTCs is voluntary for the Member States. Without the commitment to undertake the facilitation for travel with DTCs, the outcome would be fragmented, leading to only limited security and facilitation benefits in practice, due to an only partial implementation of the measures at the external borders. If only a handful of Member States implement DTCs at their external borders, the objective of smoother travel is severely hampered, which potentially will have a negative impact on the overall uptake of DTCs among travellers, since there will be less reason to “opt-in”.

Table 1: Overview of the effectiveness assessment

7.2.Efficiency

This section compares the estimated costs and benefits of the policy options for the different stakeholders. Not all potential costs or benefits are quantifiable. For example, cumulative savings in time for the authorities carrying out border checks ultimately means more efficient resource management and increased security. However, it is nearly impossible to quantify these savings in money due to differences between the responsible national authorities in organisational setups and in staff costs, and due to the nature of the recurrent benefits, particularly regarding increased security through better detection of cross-border crime and document fraud. Similarly, the possible procurement of infrastructure to process DTCs for border crossing points would vary from one Member State and from one border crossing point to the next, depending on existing capabilities, contractual relationships and choice of technical implementation. Also in this respect, it is therefore not possible to provide absolute amounts (see Annexes 3 and 4).

An assessment was carried out of the expected efficiency of each policy option, addressing the advantages and disadvantages with a scoring of -3 to +3, ranging from very negative impact to very positive impact. In terms of additional investments for border-crossing points, O1 and O2 would not oblige any since Member States could opt-in and allow the use of DTCs for crossing external borders. In fact, O1 and O2 would not envisage any additional costs for Member States, as while the ‘issuance’ of DTCs would be voluntary in O1 and mandatory in O2, even in the latter, Member States would only have to allow persons to have DTCs (i.e. legally allow them to do so), but there would be no requirement to integrate them into technical procedures operated by the Member States, like border checks. O3 would envisage the greatest implementation costs for Member States owing to its mandatory nature, i.e. obliging Member States to ensure that their border crossing points are capable of handling DTCs and building the necessary integrations into the central EU system. On the other hand, O3 also bears the highest recurrent benefits for Member States with the highest uptake of DTC use and economies of scale.

For eu-LISA, all policy options are similar in terms of financial impact. The level of maintenance and data centre capabilities may need to be adjusted as the user volume increases, which also mean incrementally higher costs from O1 to O3. Despite the costs associated with the development and maintenance of such an application at EU level, it is highly likely that the costs would be significantly higher if individual Member States were to create local solutions, not to mention the difficulties with regard to interoperability and user experience if travellers need multiple applications depending on the Member State of travel.

Table 2: Overview of the efficiency assessment

7.3.Coherence

The different policy options were designed to improve, harmonise and facilitate travel to and from the Schengen area. More specifically, they aim to ensure a smoother, more secure and reliable journey for travellers, border authorities and ultimately the whole Schengen area. The integration of the measures envisaged under the different policy options with existing systems (legal framework, technical systems, operational implementation) at international, EU and national level is therefore essential for effectively developing this policy area. This section on coherence considers the extent of complementarity, overlaps and gaps relative to existing systems relevant for this impact assessment.

Coherence at international level

Given the global use of as well as the dependence on ICAO standards and specifications for travel documents, all policy options rely on the already existing ICAO standards for DTCs, making them compatible with existing international travel documents. The verification of DTCs relies on the same technology, notably public key infrastructures, as is the case for physical travel documents. Outside the EU, the ICAO DTC standards have already been employed in international pilot projects, e.g. in Canada and Aruba.

O1, consisting of a voluntary introduction and voluntary use of DTCs, bears the risk that Member States will not follow the international trend of digitalisation in this sphere, leading to a low uptake of the DTC in the Schengen area overall, as the benefits for travellers are limited. This would, in the longer run, be likely to create a divergence in the level of digitalisation as well as travel facilitation between the Schengen area and third countries. O2, while ensuring that people can have DTCs that are digitally compatible, bears the risk that, due to limited advantages linked to the use in some Member States, again a gap in acceptance and use between the situation in the Schengen area and that at international level with appear in the longer run. O3, obliging Member States to accept DTCs in international travel, ensures compatibility in the area of digitalisation of travel documents and travel facilitation, makes it the most coherent policy option in relation to the international level.

Finally, with the inclusion of TCNs in the scope of all policy options, all options significantly contribute to the acceptance of use of DTCs globally. Being the first to adopt legislation on the use of DTCs in international travel, the EU can moreover set an example for other countries that intend to implement digital identity and digital travel credential schemes for international travel purposes, and has thus the chance to shape future internationally used solutions.

Coherence at European level

The coherence of the policy options at European level is assessed from a legal and technical perspective. The legal framework in this context involves Council Regulation (EC) No 2252/2004 (the Passport Regulation), Regulation (EU) 2019/1157 on identity cards 101 and Regulation (EU) 2016/399 (the Schengen Borders Code). The assessment from the technical perspective will consider existing and planned EU initiatives in the area of external borders and digital identity.

All policy options remain largely interoperable with existing legislation as they assume the introduction of the ICAO DTC standard. However, it would be necessary to amend or complement existing EU law on passports and identity to provide for the issuance, technical standards, verification and use of DTCs for official purposes, such as in the context of border checks. Therefore, for O1, the legislation should include an obligation that if Member States decide to the creation and/or use of DTCs, it must be an ICAO-compliant DTC. For O2-O3, the legislation would need to oblige the Member States to provide, upon request, ICAO-compliant DTCs to their nationals.

For O1 and O2 it would be voluntary, and for O3 mandatory to facilitate external border crossings with the use of DTCs. Therefore, each policy option would require a targeted amendment of the Schengen Borders Code to enable border authorities to carry out pre-arrival border checks based on the DTC data submitted by travellers, and to acknowledge the legal nature of DTCs in that context (“may” vs “shall” clause). As a well-functioning Schengen area relies on uniform criteria on controls on entry and exit at the common external borders, O3 provides the most coherence, as it would facilitate the crossing of the external borders for all travellers using DTCs throughout the entire Schengen area.

From a technical perspective, all options can support the implementation of several existing or planned initiatives in the space of digital identity and border management. The EUDIW requires electronic attestations (e.g., e-prescriptions, mobile driving licence) for it to bring value – otherwise it is an empty wallet. The DTCs of EU nationals could be stored on the EUDIW, making them accessible and convenient to use across the EU, owing to the mandatory and EU-compatible nature of the EUDIW. All policy options are coherent with the Digital Identity Regulation, but the intensity in the use of DTCs varies between the three options. O1 assumes a voluntary introduction of DTCs, generating the least synergy of the three policy options. O2 assumes a mandatory introduction of DTCs, i.e. that any citizen can have one, bears a larger uptake of DTCs and more synergies with the digital identity framework. O3, in addition to assuming the mandatory introduction of DTCs, would also create a legally sound and harmonised use case of DTCs (the pre-arrival border check and facilitated travel), therefore increasing their uptake and generating the greatest synergies with the proposed European identity framework across all Member States.

The immigration procedures at EU level, notably consisting of travel authorisations, visas and residence permits, as well as the large-scale IT systems that support the implementation of the EU acquis in the area of borders and immigration, rely on physical travel document data. During various data collection and application phases, data is manually entered. By integrating DTCs into the workflows concerning visa or ETIAS applications, pre-registration of data for EES or collection of API data, the collection of travel document data can be further automated, ensuring its accuracy and integrity. Moreover, with the use of DTCs in these processes, the validity and authenticity of travel documents can be checked in advance, which is currently not the case. For example, visa applicants who are already known to the authorities (previous visa history and record in VIS) could potentially apply for a subsequent visa even with a new passport without appearing in person to present it, which is not the case envisaged under the Commission proposal on the digitalisation of the visa procedure. There is an already existing (mobile and desktop) application for submitting ETIAS applications and Frontex is currently developing a pilot application for the purpose of pre-registering data for EES. The functionality of deriving the DTC from an existing travel document can be added to those applications with relative ease.

The ranking of the options is similar as above in relation to the Digital Identity Regulation, with O3 offering the most coherence from a technical perspective. It would allow travellers with DTCs to interact with these existing (or planned) processes in a more effective and efficient way, reducing the number of physical touchpoints and interactions and ensuring a harmonised approach across the Member States. O1 and O2 would lead to situations where one Member State would accept a TCN traveller’s DTC for the purpose of pre-registering data for EES while another would not, creating wide discrepancies as well as confusion.

Coherence at national level

From a national perspective, the introduction of DTCs does not require any major legislative changes at the national level. Some Member States have restricted the access to the chip data of travel documents to certain categories of persons or for certain purposes only. From a legal perspective, O1 would be most coherent as it would leave it up to Member States to decide whether or not to introduce DTCs in the first place, while O2 and O3 would require at least some changes at national level. O3 would be least coherent with the national legislative framework since it envisages the most amendments of all policy options, owing to its mandatory nature.

The introduction and use of DTCs has technical implications for Member States, in particular with regard to adjusting border checking equipment and systems to cater for DTCs. However, as stated above in relation to financial impacts, these changes are not major due to the interoperability of DTCs with current inspection devices, and therefore all policy options can be considered coherent with the existing infrastructure. More technical and operational changes are however envisaged for the reception of DTC data submitted via the EU application and their processing (pre-arrival border checks). Technically, O1 would be most coherent with the status quo as no changes are forced on Member States. O2, presuming the mandatory introduction of DTCs and their voluntary use (depending on Member State) at the external borders does not entail any mandatory changes to the national border systems either, making it more coherent with the current situation than O3, requiring the most changes out of all policy options.

Despite the impact on national systems, 65% of Member States surveyed answered that it should be mandatory to accept DTCs, and 71% responded that it should be mandatory to enable the use of DTCs for facilitated travel.

The following table summarises the advantages and disadvantages of each policy option compared to the baseline with respect to the coherence assessment.

Table 3 Coherence of the Policy options

7.4.Proportionality

Under this criterion, the aim is to assess the extent to which each policy option is limited to what is necessary to achieve the objectives of the initiative. This includes determining whether the scope of the option targets aspects that could not be achieved without EU intervention, establishing if the option would be sufficiently effective and estimating whether the option would be as simple as possible to achieve the objectives.

If the EU does not implement any of the policy options, the problems described above in detail will continue to exist. The current processes rely on checks at physical BCPs only once travellers arrive, without the possibility for advance checks to pre-clear travellers. The lack of a common approach to this issue – allowing pre-arrival checks and smoother travel – hampers the effective management of the common external borders. This applies to all policy options.

Compared to the baseline scenario, all options are considered better. Implementing the ICAO DTC standard is crucial for global interoperability and for contributing to the specific objectives. However, O2 and O3 with the mandatory introduction of DTCs would strengthen the harmonised framework on controls at entry and exit and promote trust between Member States, while O1 may result in weaker measures and limited gains in terms of security and facilitation benefits. O3 offers a more holistic and coordinated approach owing to its mandatory nature, maximising both border security and facilitation benefits, therefore being the most effective of the options in attaining the objectives of the initiative.

As to the simplicity of the solution, O2 is estimated to have the highest degree of ambiguity associated with its implementation. The inconsistency between the mandatory implementation of DTCs (everyone can have one) and voluntary facilitation of DTC users (you can only use a DTC in some Member States), can create confusion and wide discrepancies in travel. Both O1 and O2 would lead to a fragmented legal situation across the EU. However, when comparing O1 and O3 against the baseline scenario, O1 is the simplest in that it allows Member States to opt in or out. O3 would require the most changes in terms of legislative, technical and operational aspects, warranting also a proportionate transition period to allow all Member States to have the necessary technological maturity to integrate the use of DTCs in their national systems and legal frameworks. O1 can be considered the simplest option from a regulatory perspective.

The table below summarises the advantages and disadvantages of each policy option with respect to proportionality.

Table 4: Overview of the proportionality assessment

7.5.Summary of assessment

Based on the more detailed assessment of each criterion, the table below presents the scores for each policy option per criterion. All criteria were given the same weight (1) in this evaluation.

Table 5: Summary table of the assessment

8.Preferred option

The preferred option is eventually O3 after a suitable transition period, while allowing Member States to ‘opt-in’ as in O2 during that transition period, namely a) enabling EU citizens and third country nationals to derive their DTCs from existing ICAO-compliant travel documents; b) allowing them to use DTCs for the purposes of crossing the external borders in the Member States that choose to implement DTCs during a transition period; and c) allowing them to use DTCs for the purposes of crossing the external borders in all Member States after a reasonable transition period and once the common EU technical solution is ready. Before the start of operations of the common EU technical solution, and during the transition period, Member States could, based on national implementations, enable travellers to create and submit DTCs for external border management purposes. The preferred option of combining O2 and O3 would therefore remove legal obstacles for the early adopter Member States to start implementing DTCs at their borders immediately. However, for reasons of ensuring a single technical gateway in the longer term, a common EU technical solution should be used by all Member States, also for the benefit of individual travellers, once it is operational.

Consequently, the preferred option obliges Member States to allow their citizens to use the chip data in their national passports and identity cards for this purpose, and first enables and then obliges them to put in place legal, technical and operational measures for carrying out pre-arrival border checks for all persons using a DTC. The preferred option would also mandate eu-LISA to develop technical solutions allowing individuals to derive the DTC and to submit it to the competent Member State. It should be noted that the preferred option will not replace physical travel documents with digital ones and that physical travel documents will continue to co-exist. Finally, it should also be borne in mind that the preferred option does not entail the most far-reaching intervention from the options initially considered, since the option of fully seamless travel (biometric verification on the move) was excluded.

8.1.Benefits of the preferred option for the digitalisation of travel documents and facilitation of travel

The preferred option brings the most benefits in terms of facilitated travel across the external Schengen borders as well as increased security in the EU. The combined effect of allowing persons to have and to use DTCs across the Member States, after a transition period, ensures a coherent and systematic approach, promoting high standards and mutual trust among the Member States. The preferred option contributes to the highest possible uptake of DTCs, while maintaining their voluntary nature for travellers, and therefore ensures highest synergies with existing and planned initiatives, such as the EES, ETIAS, API and migration processes. Similarly, this higher uptake also leads to more significant gains in terms of shorter waiting times as more travellers can be pre-cleared, resulting in higher accumulative savings as well as more accurate data. These elements in terms of increased security as well as the ability to better manage external borders and facilitate travel contribute most to the general objectives related to a safer area of freedom, security and justice (General Objective 1), EU policy on integrated border management (GO2) and the facilitated free movement of persons (GO3). The preferred option is also most suitable for increasing and ensuring an adequate level of digital maturity across the Member States (SO1).

The standardisation of the DTC and its use for external border management across the Member States would also bring further benefits, such as increased efficiency for carriers on a voluntary basis as they could integrate DTCs into their current workflows on passenger management, contributing to the facilitated free movement of persons (GO3) and allowing for a smoother and faster border crossing for travellers (SO2). However, it would not oblige carriers or other third parties to process DTC data or to invest in hardware/software for doing so. The preferred option would merely enable them to do so, e.g. fulfilling their obligations under carrier liability by inspecting a DTC instead of a physical travel document and by using a DTC for fulfilling their obligation under the revised API rules on the automatic collection of API data.

The preferred option also enables further use cases of DTCs for EU citizens, by establishing an attribute for the digital identity wallet that can be used for e.g. proving one’s identity within the EU, and possibly abroad, depending on the acceptance by third countries. As compared to the other options, the preferred option would guarantee that citizens of the EU and Schengen Associated Countries have a right to obtain a DTC based on their travel document that is accepted throughout the EU and Schengen Associated Countries in particular when exercising free movement rights (GO3 and SO2).

8.2.Potential disadvantages of the preferred option

The preferred option envisages some potential disadvantages, owing to its eventual mandatory nature. It bears the highest cost of implementation for Member States and the most intensive legislative and technical intervention at Member State level, while the financial impact for the EU institutions is more or less the same under each policy option. Despite the higher degree of interference with the legal and technical frameworks at national level, the preferred option ensures the highest level of coherence with the EU legal framework, enabling the integration of DTCs into several flows. Some of the potential disadvantages, such as implementation costs and technical complexity of integrating DTCs into national border management systems, can be offset or mitigated by granting appropriate transition periods.

8.3.Application of the ‘one in, on out’ approach

The preferred option has the potential to significantly improve the border check processes, by upstreaming the checks on persons and their travel documents. This benefits both border authorities as well as individual travellers. In terms of adjustment costs and administrative costs for businesses and citizens, the preferred option does not entail any. While the preferred option would oblige Member States competent authorities to put in the place the required technical capabilities for processing DTCs in their border management processes, no obligations are envisaged for individual businesses or citizens.

8.4.REFIT (simplification and improved efficiency)

According to the Commission’s Regulatory Fitness and Performance Programme (REFIT), all initiatives aimed at changing existing EU legislation should aim to simplify and deliver stated policy objectives more efficiently (i.e., by reducing unnecessary regulatory costs). The proposal, based on this impact assessment, will consist of new legislation amending existing procedures, in order to carry out border checks and the technical specifications of travel documents issued by Member States. It will be implemented by amending Regulation (EU) 2016/399, Council Regulation (EC) No 2252/2004 and Regulation (EU) 2019/1157.

While this initiative has not been subject to the REFIT initiative, it will reduce the overall burden on Member States by increasing the effectiveness and efficiency of external border management as referred to in Chapter 7. The introduction of a uniform format for DTCs will moreover create opportunities e.g. to carriers, and alleviate their administrative costs and burden.

9.How will actual impacts be monitored and evaluated?

The Commission will ensure that necessary measures are in place to monitor the functioning of the proposed measures and to evaluate them against the policy objectives of this initiative. Since the measures for using DTCs under the preferred option would be mandatory for Member States after a transition period, collecting data on their use and added value would be facilitated.

The specific objectives against which the measures will be evaluated pertain to 1) increased security of the Schengen area and increased efficiency of external border management, and 2) a smoother and facilitated travel experience for all travellers. Monitoring and evaluating the attainment of these objectives as well as the general objectives will include the following indicators:

-Number of DTCs derived from existing travel documents;

-Number of travellers using DTCs/number of pre-arrival border checks;

-Average time per border check after the implementation of DTCs (from the border authority and traveller perspective);

-Number of security breaches (especially cases of identified counterfeit and forgery; and cases of identified trans-border crimes);

-Number of errors found in travel document data;

-Number of flights delayed or cancelled/refused border crossings or boardings due to peak times and long processing times or data errors;

-Level of digital maturity across Member States: ability to process DTCs at external borders and leveraging DTCs for border management;

-Costs for Member States and eu-LISA associated with implementation;

-Cost savings for authorities;

-Use of DTCs by other stakeholders, including by carriers for business management purposes and for collection of API data;

-Feedback satisfaction surveys.

In addition to data provided by Member States, the IT tools to be developed at EU level that enable the creation and submission of the DTCs should support the monitoring and evaluation by collecting statistics on the basis of log data (no personal data), disaggregated at EU and Member State levels. The customer-facing application should also allow the collection of feedback from users. These data would feed into a separate ex-post evaluation and report that the Commission would present to the European Parliament and the Council five years after the entry into force of the regulation. Furthermore, the Schengen Handbook (Practical Handbook for Border Guards 102 ) should be updated to address the changes in the legal framework and provide relevant guidelines/recommendations to Member States on the implementation of DTCs in the context of external border management.

The implementation of the measures under this initiative, including data protection aspects, would also be monitored and evaluated in the context of the Schengen evaluation and monitoring mechanism. Similarly, the implementation of the initiative would be addressed in the annual State of Schengen Reports as well as the accompanying tools, such as the Schengen Barometer and the Schengen Scoreboard. At the same time, the Commission should closely monitor global developments in travel and the digitalisation of travel documents to ensure interoperability, reciprocity and competitiveness.

Annex 1: Procedural information

1.Lead DG, Decide Planning/CWP references

The lead DG is the Directorate-General for Migration and Home Affairs (DG HOME) for the preparation of this initiative and the work on the impact assessment. The agenda planning reference is PLAN/2022/860. The Directorate-General for Justice and Consumers (DG JUST) is associated to the initiative concerning the digitalisation of identity cards. The initiative is listed in the Commission Work Programme 2023.

2.Organisation and timing

The inter-service steering group for the impact assessment was set up in August 2022, with participation of the following Directorates-General: Secretariat-General (SG), Justice and Consumers (JUST), Mobility and Transport (MOVE), Communications Networks, Content and Technology (CNECT), Internal Market, Industry, Entrepreneurship and SMEs (GROW) and Budget (BUDG). The call for evidence, launching this impact assessment, was published on 8 September 2022. In the Schengen strategy of 2021, the Commission announced its intention to adopt a legislative proposal on the digitalisation of travel documents and facilitation of travel in 2023.

3.Consultation of the RSB

On 15 November 2023, DG HOME submitted the present impact assessment report to the Regulatory Scrutiny Board. Following a written procedure in December 2023, the Regulatory Scrutiny Board issued a positive opinion on the report on 15 December 2023.

4.Evidence, sources and quality

This impact assessment is notably based on the study on the digitalisation of travel documents and facilitation of travel, carried out by Deloitte as external contractor for the Commission, and on the multiple consultations and interviews conducted in that context. The external study assessed the problems related to security risks and challenges to efficient border control and to smooth and facilitated travel across the external borders. The goal was to consider the optimal way to make travel experiences smoother and border management more secure by leveraging digital tools to respond to increasing traveller volumes and current challenges in the domain of border checks at external borders.

The data already collected in the context of the still ongoing, EU (co)-funded pilot projects on digital travel credentials implemented by the Netherlands, Finland and Croatia have also been used to exemplify the benefits of digital solutions as well as the elements that need to be addressed, e.g. regarding technical implementation as well as fundamental rights guarantees.

A special Eurobarometer survey was carried out in 2023 to collect public views on the initiative. Finally, data from previous studies and Commission reports, including impact assessments and Schengen evaluations have also been used in this impact assessment.

Annex 2: Stakeholder consultation (Synopsis report)

This annex provides a synopsis report of all stakeholder consultation activities undertaken in the context of this impact assessment.

1.Consultation strategy

The objective of the consultation activities was to gather data and stakeholders’ views in the context of preparations of the legislative proposal on the digitalisation of travel documents and facilitation of travel. The consultation activities aimed at collecting views on several issues and the suggested EU intervention, as well as opinions, ideas and concerns about the various available options, solutions and impacts. The activities also sought to collect objective data, information and evidence on how the proposed solutions would impact the relevant stakeholders. As part of their study on the digitalisation of travel documents and facilitation of travel, Deloitte conducted several consultation activities, feeding into this impact assessment.

The consultation process included:

§Consultations with Member States’ relevant authorities, several Commission services and EU agencies as well as industry and international organisations through surveys, questionnaires and interviews

§Public consultation on a possible legislative initiative on the digitalisation of travel documents and facilitation of travel

§A Special Eurobarometer survey on the digitalisation of travel documents and facilitation of travel

2.Consultation activities

This section provides an overview of the different consultation activities carried out and their main findings. The analyses of the various activities and further details can be found in the Deloitte study as well as the Special Eurobarometer 536 Report 103 .

2.1.Strategic interviews with key decision makers and key experts

Seven strategic interviews were conducted with representatives of DG HOME, DG JUST, DG MOVE, DG CNECT and DG GROW in a semi-structured format. These interviews served to develop the initiative and obtain more information about the needs, priorities, challenges and objectives of this EU policy initiative. An overview of the key stakeholders at national, EU and international level was also shaped during these interviews. These interviews supported the identification of relevant issues and problem drivers affecting each set of stakeholders.

2.2.Targeted consultations

Targeted consultations were conducted to obtain in-depth insights about the different aspects of the proposed policy options and to discuss the impacts of those options.

Written questionnaires were sent to Member States’ representatives in the Council Frontiers Working Party as well as the Article 6 Committee and Free Movement Expert Group. The aim of the written questionnaire was to collect information on individual persons’ and Member States’ views on current practices with regard to biometric passport issuance and inspection, participation in digital identity schemes, the potential of DTC as well as readiness and willingness to implement DTCs for external border checks.

All respondents said it was very essential to ensure adherence to international (ICAO) standards on digital travel credentials. 65% of respondents said that it should be mandatory to accept DTCs in the EU, while 71% thought that it should be mandatory to facilitate the travel of persons with a DTC.

As to the creation of DTCs, 77% opined that this should be done under a common EU technical solution. Finally, 94% of respondents thought their Member State would be successful in introducing DTCs for external border-crossings if a gradual transition period were to be provided for.

2.3.In depth-interviews

In depth-interviews were organised with several Commission officials, EU agencies (Frontex, eu-LISA and the Fundamental Rights Agency), national travel document issuing authorities, national border control and border policy authorities, international organisations and associations (International Civil Aviation Organization, International Air Transport Association and World Travel and Tourism Council) as well as experts from the private industry and Canada Border Services Agency. Interviewees were selected based on a match between the expertise or practical experience of the person and the information needs for carrying out the study and the impact assessment.

In particular, the interviews gathered crucial information to conduct the feasibility assessment and the multi-criteria assessment. For example, the interviews with the individual Member States provided information on the size of the effort to adjust the current border management equipment, the percentage of errors contained in submitted passenger information and the average waiting time of third country nationals. The countries interviewed were: Croatia, Estonia, Finland, Germany, Greece, the Netherlands, Poland, Spain, Sweden (and France – from the ICAO perspective).

The interviews with the European agencies provided important insights on the technical feasibility of introducing DTCs and how this initiative could synergise with other (ongoing) initiatives such as ETIAS, EES and the EUDIW. The EU agencies particularly highlighted the importance of including privacy and data considerations from the design phase onwards.

Lastly, during the interviews with the international organisations, most of the considerations in the problem tree about the potential of DTCs in the fields of improved security and seamless travel were confirmed.

Other topics such as ongoing initiatives and/or pilot projects in certain countries, organisations and associations were also discussed.

2.4.Public consultation

The survey was available from 5 April to 28 June 2023 and received 6 754 replies in total. The survey aimed at collecting information on the proposed digitalisation of travel credentials and travel facilitation. The survey included questions on different aspects, e.g. the advantages and disadvantages of digitalising travel documents and of facilitating the travel process, the potential main obstacles/drawbacks, as well as the protection of personal data.

The number of responses per country were: AT: 573, BE: 123, BG: 22, CH: 37, CY: 7, CZ: 37, DE: 3 920, DK: 12, EE: 7, EL: 38, ES: 114, FI: 26, FR: 472, HR: 37, HU: 24, IS: 0, IE: 36, IT: 300, LI: 0, LT: 10, LU: 35, LV: 5, MT: 4, NL: 74, NO: 6, PL: 72, PT: 41, RO: 45, SE: 26, SK: 524, SI: 6. Additionally, individuals from several other countries replied to the survey as well, including Turkey (3 respondents), India (4 respondents), and the United States (9 respondents).

The majority of respondents were EU citizens, with some individuals working in companies/business associations, one in an environmental organisation, and ten others in non-governmental organisations. Of the respondents, some worked in academia, whilst others were active in the trade or environment sectors.

Campaigning and sentiment analysis

Given the large number of responses, predominantly from Germany, Austria, and Slovakia with respectively 58%, 8% and 8% of the replies, the likelihood of a targeted campaign to influence the outcome of the public consultation was assessed.

The analysis showed that the time of submission of the answers to the survey was spread over a long period, with a consistent increase in answers over the 3-month duration of the public consultation. A saturated window of submission could indicate a campaign, but there was no such window indicated, as replies came in consistently over the entire runtime of the survey.

Based on the indicators utilised, it was hard to determine whether the public consultation was targeted by a campaign, or whether the topic of the digitalisation of travel documents and the facilitation of travel is merely a topic that sparks a lot of debate. As a result, it was impossible to rule out the possibility of a campaign or that some responses were part of one. If there was a campaign, the source of the campaign could not at this point be identified.

DG HOME received a considerable number of letters by post with replies to the questions of the public consultation which were all provided on the same form where only the address had to be inserted.

Keeping these elements in mind, a sentiment analysis was carried out for the open-ended questions (questions 15 and 22), in order to more accurately assess the input received by EU citizens and organisations on the matter given the vast number of replies. The answers to some questions were also analysed without the Austrian and German responses, to further assess the possibility of campaigning and potentially correct the results. Both approaches nevertheless revealed a rather general negative sentiment overall. However, the results of the Special Eurobarometer, targeting a wider audience, produced vastly different results to very similar questions.

Summary of results

The opinions of the respondents to the public consultation were largely negative with regard to the use of DTCs, and their willingness to use DTCs when crossing external borders. 83% of respondents thought that the possibilities of using DTCs were not important or not at all important, while 12% said they were either very important or important. When asked about whether DTCs could facilitate the border check procedure, 72% answered negatively. Similarly, 58% of the respondents indicated that it would not be at all useful to be able to leverage digital passports for other administrative procedures, with another 19% indicating that this would not be useful. Only 12% of respondents would consider using a DTC if it were available, while 6% said they would consider this under certain conditions. As motivations for the lack of uptake, respondents highlighted primarily data protection and privacy concerns, as well as an overall satisfaction with the current processes. Concerning travel habits, 85% of respondents had travelled outside the Schengen area in the last five years, most frequently for tourism (51%), visiting family and friends (12%) and for professional purposes (11%). With regard to ownership of a mobile device that is less than five years old and that could be used for travel purposes, 56% of respondents responded to having one. The challenges associated with the benefits of introducing DTCs were not seen as important by a majority of respondents. For example, long waiting times were not challenging at all or not challenging for 78% of respondents and inconvenient travel experience due to physical checks were not challenging at all or not challenging for 81%.

The call for evidence was open for feedback between 8 September and 6 October 2022 and attracted 360 responses. A majority of the opinions expressed were largely negative, mirroring the results and reasons of the later public consultation.

2.5.Special Eurobarometer

The special Eurobarometer survey EBS 539 was carried out between 10 May and 5 June 2023 and covered 26 358 interviews in the 27 EU Member States. The total EU results were weighted according to the size of the population of each country. The survey explored EU citizens’ views and perceptions of travel policies related to travel facilitation, including the introduction and use of DTCs. It also provided a snapshot of Europeans’ extra-Schengen travel habits.

While some divergence could be observed between individual Member States, the results were overall positive. Similarly, socio-demographic data showed consistent answer patterns on most questions. Main discrepancies could be observed on the perceptions of DTCs.

Most Europeans considered that it is important to accelerate border procedures and to enhance cooperation between the EU and its Member States on extra-Schengen travel. 77% of Europeans supported the idea of the EU taking action to mitigate obstacles for extra-Schengen travel and for accelerating border procedures.

Having been given the description of DTCs and how they can be used, two thirds (67%) of Europeans had a positive perception about DTCs and among those, 22% thought very positively about them. On the opposite, one quarter (26%) of Europeans had a negative opinion about them. Opinions were most positive amongst younger respondents, students, managers and other white-collar workers, frequent travellers and those who have a positive view of the EU in general. On the other side, perceptions were least positive amongst those who hold a negative view about the EU, who do not travel and those who left full-time education at the age of 15 or before. Nonetheless, 68% of Europeans were in favour of using digital travel credentials for extra-Schengen travel, while 28% opposed their use. While support among older respondents was lower, still 54% of respondents aged 55 or more, and 50% of retirees were in favour of using DTCs for extra-Schengen travel.

From the various concerns mentioned, almost half (49%) of Europeans considered that software failures were the most important concern related to the use of digital travel credentials. Concerns regarding data protection, device problems and cyberattacks were also raised.

The positive results of the survey are interesting in view of the largely negative feedback collected in the public consultation, also taking into account the larger and more representative sample population and the fact that the survey is more immune to campaigning as it targets people at random.

3.Conclusions

In regard to the overall digitalisation of travel documents, most consulted stakeholders throughout the impact assessment and study expressed a positive sentiment towards the initiative, as highlighted during the strategic interviews, written questionnaire, and in-depth interviews as well as the Special Eurobarometer survey. Solely the sentiment expressed by citizens and other stakeholders within the Public Consultation was negative, and this is contradicted by the Special Eurobarometer results on the same matter. Across the consulted stakeholders, opinions whether the implementation of DTCs should be mandatory or voluntary were mixed. The consensus was nevertheless that the uptake and use by citizens should be voluntary at all times.

The assessment of the added value of the digitalisation of travel documents was generally positive as well across the different consultation activities, apart from - again - the Public Consultation. Key elements referred to included the improved data quality and the implementation of seamless travel associated with DTCs.

Generally, most stakeholders across the board indicated that ICAO’s Type 1 DTC is the most realistic option to implement digital travel credentials in the EU from a regulatory and technical perspective, although a significant number of stakeholders across the different consultation activities noted some downsides with the solution as well.

For the facilitation of travel and the implementation of measures to facilitate the use of DTCs, most stakeholders were generally positive about the facilitation in their Member States. Nevertheless, it should be noted that a significant number of stakeholders across the different consultation activities expressed a relatively low level of digitalisation in existing border check procedures, lowering the readiness to implement required measures in the short-term. Nearly all stakeholders indicated the need for a transition period if DTCs would be implemented. Mirroring the sentiment towards the implementation of DTCs, the consulted stakeholders were also divided on the mandatory or voluntary facilitation of travel, with a majority in favour of mandatory acceptance.

Annex 3: Who is affected and how?

1.Practical implications of the initiative

The initiative primarily benefits individuals, Member States’ authorities and society at large by facilitating cross-border travel and free movement and by improving security at the external borders and the internal security of the EU.

1.1.Individuals

The initiative would enable individual travellers (both EU citizens and third country nationals) to use DTCs for external border crossing purposes. This brings benefits in terms of less time spent at border crossing points and less hassle due to misspelled or incorrect manually declared data. Errors in self-declared data can lead to additional waiting time or even refusals of entry or a refusal to board a transport vehicle.

As the initiative would establish a legal standard for the DTC, its uses could be incorporated into national systems, particularly with the rollout of digital identity and the EUDIW. EU citizens could better leverage the chip data in their passport or identity card for secure identification in both online and physical transactions.

A clear impact of the initiative on waiting times at the border was difficult to ascertain, but based on results from the ongoing DTC pilot projects, the processing time of pre-cleared DTC travellers (EU citizens) decreased significantly from between 30 and 90 seconds to less than 9 seconds per traveller. This impact is multiplied with the eventual uptake of DTCs, resulting in shorter queuing times even for those travellers that will not use the DTC themselves, but whose monetary value is at this point impossible to evaluate.

The initiative will also benefit individuals, if carriers (e.g., airlines, coaches, trains and ships) integrate the processing of DTCs into their booking and check-in systems. This could allow passengers to undergo certain checks – that are currently done physically at transport hubs, e.g., during check-in, baggage drop or boarding – fully remotely and save additional time with less hassle, too.

Since the use of a DTC would be voluntary and free of charge for individuals, no financial costs are envisaged. The only investment required from individuals would relate to the time it takes to derive a DTC from the traveller’s existing passport or identity card, which could be done remotely.

In terms of the initiative’s implications on personal data and privacy of DTC users, the amount and extent of processing of personal data remains unchanged. The time of processing the personal data of travellers would be upstreamed in the context of advance checks, as opposed to the border authorities processing that same personal data once the traveller arrives at the physical border crossing point. Owing to the voluntary nature of the use of DTCs and the possibility to undergo border checks as they are currently carried out ensures inclusivity and non-discrimination. Finally, the remedies in place for refusals of entry, data breaches or other unlawful activity remain unchanged and governed by existing EU and national law.

1.2.Member States’ national authorities

1.2.1.Border management authorities

The initiative would benefit mostly the authorities competent for carrying out border checks at external borders. Receiving DTC data, and certain additional data for third country nationals, upfront, would enable the authorities to verify the authenticity and integrity of travel documents as well as consult the relevant databases before the traveller arrives at the border crossing point more efficiently than today. This would allow better management of resources and better detection of high-risk travellers and fraudulent documents, since several travellers would have been pre-cleared and quickly processed at the border crossing point.

1.2.2.Visa, ETIAS and other authorities

While the initiative focuses on the use of DTCs for crossing external borders, the introduction of a legal definition for DTC could also serve to benefit authorities responsible for processing visa and ETIAS applications and enable them to verify the authenticity and integrity of travel documents (remotely) used by applicants. This also applies to e.g. immigration authorities processing residence permit applications submitted by third country nationals in a third country.

1.3.eu-LISA

The European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) will be involved in the development and maintenance of a common customer-facing mobile application for the derivation of the DTC and for pre-registering certain data that is required for entry or exit, depending on the profile of the traveller (EU citizen, TCN family member of an EU citizen, visa-free TCN, visa-required TCN etc.). eu-LISA will also develop and maintain the services related to the customer-facing mobile application (e.g. facial recognition, liveness check and presentation attack detection, verification of authenticity and integrity of document) as well as the central EU-level components to streamline the transmission of the DTC data by individual users of the application to the Member State he or she intends to cross the external border in. The development of these technical components should seek to build upon existing capabilities already set up at EU level by eu-LISA to the extent possible.

If the legislative changes were to be adopted by 2025, eu-LISA would start working on the preparation and development of these technical components as of 2026, to ensure the entry into operation in 2029.

1.4.Other entities

The initiative would not oblige e.g. carriers or security operators in airports, seaports or other transport hubs to process DTCs. However, the initiative would enable them to do so, bringing multiple benefits. The automated collection of API data, as provided for in the API proposal, could be based on a DTC. This would allow carriers to ensure the authenticity and integrity of the travel document used by travellers, resulting in fewer refusals of entry and subsequent costs in terms of returning persons whose entry has been refused or due to fines under carriers’ liability. Transport operators can also leverage the DTC data in their check-in systems, reduce the amount of physical transactions with passengers and better manage their personnel. Similarly, by obliging Member States to allow individuals to have a DTC, it creates countless opportunities for other entities offering services, where identification/verification of identity is absolutely necessary (e.g., banking, purchase of age-controlled goods, registering at a municipality).

2.Summary of costs 104 and benefits

The overview of benefits and costs of the preferred option is indicated below.

(1) Estimates are gross values relative to the baseline for the preferred option as a whole (i.e. the impact of individual actions/obligations of the preferred option are aggregated together); (2) Please indicate in the comments column which stakeholder group is the main recipient of the benefit;(3) For reductions in regulatory costs, please describe in the comments column the details as to how the saving arises (e.g. reductions in adjustment costs, administrative costs, regulatory charges, enforcement costs, etc.;);.

(*) Net administrative burdens = INs – OUTs;

(**) Adjustment costs falling under the scope of the OIOO approach are the same as reported in Table 2 above. Non-annualised values;

(***) Total administrative burdens = Net administrative burdens for businesses + net administrative burdens for citizens.

3.Relevant sustainable development goals

Annex 4: Analytical methods

1.Introduction

This annex provides a summary of the methodological approach taken to estimate the financial costs of the preferred option presented in this impact assessment. Since the initiative and the preferred option only cause costs for Member States and eu-LISA, other stakeholders are not considered in this annex, although they will have the possibility to leverage DTCs in their processes (e.g., airlines using DTCs to collect API data by automated means or to facilitate check-in or baggage reconciliation and more generally individual service-providers for verifying identity in any context).

The underlying assumptions are based on data collection from individual Member States currently carrying out pilot activities to test the implementation of DTCs. Further assumptions with regard to the central technical solution to be developed by eu-LISA are based on a high-level requirements mapping exercise.

It should be noted that the cost estimates presented in this impact assessment report vary from the estimates presented in the external study that attempted to, among other things, quantify the savings associated with a quicker throughput of travellers through borders and increased security and better management of resources. The external study also considered as relevant the costs for carriers in integrating DTCs in their respective processes, while none of the options entail any costs for them, neither directly nor indirectly. Moreover, the external study was done before the DTC pilot projects were operational and before the high-level requirements of the central EU application were drafted. Therefore, several assumptions made in the study are no longer relevant.

2.Member State authorities

Member States authorities competent for border management already carry out border checks at external borders. However, there is no reliable data about how much a single border check transaction costs. Such costs include staff costs (salaries, payroll taxes), border management infrastructure/hardware investments and maintenance (like e-gates, manual booths, inspection devices), software licences and general property management (whether rented or owned).

In the course of the EU (co)-funded DTC pilot projects, Croatia and Finland have estimated certain costs relevant for the implementation of DTCs in a full-production mode as opposed to a pilot setting. While the available funding from the Border Management and Visa Instrument (BMVI) was EUR 2.3 million (95% of total cost) for these pilots, this amount is not in itself accurate to evaluate the actual costs associated with the implementation of DTCs on a larger “production” scale.

Based on data from previous projects and experiences with integrating systems into the national border management application, Croatia and Finland estimated the cost of integrating DTCs into their national systems at between EUR 300 000 and EUR 575 000. To account for possible differences in Member States’ systems, the one-off cost for this integration is estimated at EUR 700 000.

Furthermore, server capacity may need to be upgraded at Member States’ level in order to temporarily store DTCs/facial images. Again, technical implementation decisions at the national level (e.g. centralised server and storage vs. decentralised storage at each border crossing point) may significantly impact the costs associated with the one-off investment for increasing server capacity. According to the Finnish Border Guard, a centralised implementation of additional server capacity to host DTCs and to process facial images could cost EUR 250 000. Depending on the traffic, border crossing points may need more or less capacity.

Most border crossing points should already be equipped with facial recognition capabilities with the soon entry into operation of the EES. Most Member States have already installed and used automated border control systems and e-gates at their external borders for border check purposes. As such, no additional costs are necessarily expected from the implementation of DTCs, but again, individual implementation choices will have a significant impact on possible investment needs. For example, if a Member State chooses to establish separate processing lanes for travellers with DTCs with dedicated equipment, the costs may be lower compared to adapting all lanes and refitting them with DTC capabilities. For the Finnish DTC pilot project, the cost of establishing one dedicated lane was EUR 2 500, including a PC, facial recognition capabilities and a NFC reader. However, the cost of a single new e-gate is around EUR 40 000. Due to the near impossibility of providing an accurate estimate of the costs for equipping lanes with DTC capabilities, the one-off cost per Member State is set at EUR 1 million 106 , while it should be highlighted that the costs will differ widely between Member States due to the amount of border crossing points, traveller volume and implementation choices.

Training personnel on how to handle and accept DTCs is not expected to be a significant cost factor for Member States. Based on the costs for training border management personnel to learn about the EES (which is more complicated than Digital Travel Credentials), the maximum cost for developing training materials (e.g. an e-learning tool) is estimated at EUR 30 000 per Member State.

Based on the above, and to factor in differences in the national systems and to account for a reasonable overhead, the one-off cost per Member State is evaluated at approximately EUR 2 million.

However, those costs will be offset by the recurring benefits associated with increased security and a more efficient use of resources for carrying out border checks.

The following tables present scenarios based on uptake of DTCs (percentage of persons crossing the external borders with a DTC at 0% 10%, 35%, 60% and 80%) as well as time and money saved annually according to average EU hourly labour costs in 2022 107 of EUR 30.5. The percentages representing the uptake of DTCs by travellers progress from status quo (0%) and (10%) pessimistic to very optimistic (80%), motivated by the results of the public consultation and Eurobarometer survey. The scenarios only consider EU citizens due to the multiplicity of factors that impact the average border check time on third country nationals 108 . The scenarios also optimistically consider that only 65% of border checks are carried out at manual booths (1 booth one border guard), while the remaining 35 % of border checks are carried out with e-gates (allowing a single border guard to supervise the operation of up to four e-gates at once). The duration of a border check at a manual booth is set at 30 seconds, at e-gate at 25 seconds and a check with DTC at 8.8 seconds. Since checks on exit with a DTC can exclude the physical check of the travel document, the duration of a DTC check goes down to 2-4 seconds. Taking a conservative approach, and considering that the share of checks on exit and entry in the scenarios is 50/50, the average time for a border check with a DTC is then set at 6.4 seconds (50% at 8.8 seconds upon entry and 50% at 4 seconds upon exit). This means that the introduction of DTCs should lead to a reduction of the time needed for a border check at the airport between 8 and 63% on average depending on the uptake of DTCs, as shown in the two tables.

Finally, all scenarios below focus on border checks at air borders due to the more controlled environment as well as the fact that the pilot projects have been carried out at airports. Border checks at sea and land borders are subject to more variability due to the different setups as well as the differences in infrastructure and take more time than checks at air borders in the current setup. Use of DTCs also by TCNs and at all types of border crossing points should therefore lead to even greater cost savings than those presented below.

The first table represents the situation at a medium-sized airport where 7 million border checks are carried out annually, 4.55 million at manual inspection lanes and 2.45 million at e-gates.

The second table represents the scenario based on 2022 where approximately 360 million border checks were carried out at external air borders, 234 million at manual lanes and 126 million at e-gates 109 .

While the times and costs estimated above only relate to the activity of carrying out border checks actively on persons, and exclude time spent e.g. on training, patrolling and other activities carried out in between flights and passenger flows, the tables provide a general idea about the cumulative savings that can be achieved as the uptake of DTCs increases.

The estimates of the time savings presented above are therefore based on the interim results of the pilot projects using the DTC at airports. Since 65% of the border crossings in 2023 were at air borders, it can be expected that this type of border crossing point also represents the highest uptake of DTCs. However, the time savings at both sea (4% of crossings) and land borders (31% of crossings) are expected to be similar or even greater than those at air borders. Sea borders with frequent traffic, similar to air borders, are generally controlled environments and are set up indoors with multiple lanes with either manual booths or e-gates for carrying out border checks. The actual border check process is moreover the same for all types of border crossing points, but for land borders, may include added complexity. Drivers, their passengers and bus patrons may be required to exit their vehicles for border control, especially following the entry into operation of the Entry/Exit System for third-country nationals to enrol their personal data (passport data, facial image, fingerprint, travel data and entry questionnaire). If DTCs were introduced to these flows, allowing travellers to pre-enrol several pieces of data required for the system, additional time will be saved as they would not necessarily need to exit the vehicle and enrol their data at a self-service system (kiosk) or at the manual booth. This is due to the fact that they have successfully pre-submitted their DTC along with the necessary travel information to the border guards, and a simple verification of the identity of traveller would be sufficient at the actual time of crossing the border.

Based on the above, the cumulative effects of the time saved at sea borders can be expected to be similar to that of air borders, but even greater for land borders. However, before the entry into operation of the Entry/Exit System and before DTCs have been piloted particularly at land borders, it is not possible to provide precise estimates of the potentially increased time savings at land borders. These recurrent benefits should be examined in detail in the ex-post evaluation.

3.eu-LISA

The methodology for eu-LISA’s cost estimate for the development and maintenance of the mobile application for creating and transmitting DTCs is based on a high-level requirements mapping, that sets out the basic functionalities of the application.

Table 1 – High-level requirements for the “EU Digital Travel application”

In addition to the high-level requirements, several assumptions were made to facilitate the cost estimate:

§No more than 200 000 users per day with peaks of 10 per second;

§Travel EU app will be based on the API Router components re-use for transmission;

§The user will not be able to update the request, but can re-send a submission;

§The validation of the DTC is based on ICAO standards;

§The content of the FAQ will not be managed by eu-LISA;

§The legislative act will be adopted in 2025 so that preparation can begin in 2026.

eu-LISA based its estimations on prior experience with the EES/ETIAS Web Services project, on which the API Router will be based. The Travel EU app will also rely on the API Router for the transmission part. As estimated by eu-LISA, the total cost for the Agency to develop the EU Digital Travel application is estimated at EUR 49.5 million, with additional staff needs of 2 FTE for 2027, 17.5 FTE for 2028, 19 FTE for 2029 and 20 FTE for 2030 and 2031. It is envisaged that the profiles will be recruited in phases according to the business needs:

For the first year after adoption, limited support may be provided to the Commission in the development of implementing acts for the technical specifications.

For the technical design, build & development phase, key resources will be needed combining expertise in IT architecture, business analysis, testing, security, project & programme management, infrastructure/network/application management). They will work on the elaboration of specifications / requirements solicitation as well as on all analysis and design tasks in close cooperation with the contractors. They will perform the necessary assessments, will kick off all projects (work packages) and ultimately conclude this part of implementation with the production of the detailed design of the solution.

A combination of transversal resources (procurement, finance, HR, business relationship and stakeholders’ management, communication, security, corporate IT) is also included. In order to deliver a “fit for purpose “and tailored solution, significant pressure will be put on this phase and knowledge of experts in the domain is highly recommended. Particular security requirements to build the EU Digital Travel application with hosting services in the cloud, reusing also API router components for the transmission, can be only met by skilled security officers and experienced architects and test engineers.

Specifically, for the business relations management profiles, it has to be taken into consideration that they will provide continuous support during the ‘analysis and design’ phase, as well as during the testing, deployment and throughout the whole governance with all involved stakeholders’ phases until the entry into operations (EiO). More specifically, they are required for business analysis, requirements and demand management, consultancy and coordination with all involved internal and external stakeholders. The profiles will in particular be responsible for analysis of the business and its interdependencies across all involved domains, elicitation and analysis of the business / stakeholders requirements, coordination with internal / external stakeholders and the governance, follow-up and validation of deliverables / artefacts and continuous internal / external guidance. They need to master the topic, have concrete knowledge, years of experience in business analysis, certifications, experience in the involved business and capable at analysing numerous interdepended legal documentations, especially in the JHA domain. They must have the ability to explain in detail and thus provide the expected high quality structured advice to all involved stakeholders and governance, as well as work closely with the internal teams to determine acceptable technological solutions which will comply with high quality standards.

For the Operations phase, on top of the expertise and combination of skills in the areas of infrastructure, network, security and testing, eu-LISA will require resources, adding expertise on service management and first and second level support, complementing the resources already acquired in the previous phase, in development, test and deployment of the final solution. These resources will properly monitor, operate and debug the system, in order to meet the agreed level of the required SLAs and respond to intense monitoring and security requirements. The requested mix of profiles will ensure that best practices from project management as well as ITIL frameworks will be properly applied.

Especially for the test management profiles, the proposed level of seniority is needed as there is increased complexity on maintaining several mobile app products, that requires senior level of experience to conduct efficiently the tasks. Moreover, very specific Public Key Infrastructure (PKI) and biometric expertise is necessary to test the functionalities of the product, when reading chip data and performing biometric matching / detecting morphing probability.

Regarding product management profiles, it has to be emphasised that the EU Digital Travel application should not be seen as an extension of already developed systems. There are new parameters introduced in the equation making this implementation stand as a separate product, within the domain of the systems developed by eu-LISA.

Regarding security profiles, in order to ensure the provision of proper security services for the EU Digital Travel application and support the transversal delivery model setup, an assessment against current allocated resources for the EES/ETIAS WS development (Carrier Interface) as well as the API Router was performed.

In more detail, the same resources will be needed for both phases i.e., development & operation/maintenance. For example, the profile for security testing will be performing tasks during development and continue to test under operations and maintenance on a recurrent basis. In practice, the same profile will serve both phases chronologically. Moreover, business continuity as well as protective security profiles are also needed, in order to properly support the increased physical and personnel security needs.

Regarding infrastructure management profiles, the rationale is to have in 2027 the profiles to work on the design phase of the platforms, then in 2028 they will be working on the design and documentary reviews as well as on build & deployments. From 2029 and onwards the indicated resources will be needed to properly operate and maintain the system.

Concerning the network management profiles, the resources are considered necessary for both phases, as the services to be provided (hosting lines installation and operational management, DDOS installation and operational management, network infrastructure installation and monitoring, etc.) require the associated expertise and knowledge for the relevant installation as well as operational tasks. Concerning functions in support to operations (1st and 2nd level support), it is necessary to plan resources that allow 24/7 operation. While the tasks related to the operational support may constitute a fraction of 1 FTE and be added as an additional task to the current staff, ensuring a full shift-work cycle is necessary.

Table 2 – eu-LISA’s estimated staff needs

Annex 5: Competitiveness check

1.Overview of impacts on competitiveness 

The preferred option has no or at best negligible impacts on the different dimensions of competitiveness. Therefore, the competitiveness check is not relevant for this initiative.

2.Synthetic assessment 

N/A

Annex 5: Summary of the pilot project in Finland and Croatia

1.Introduction

In order to support the Commission’s legislative initiative on the digitalisation of travel documents and facilitation of travel, EU-funded pilot projects were launched to trial the use of digital travel credentials in a border-crossing environment. This annex reports on the interim results from the project undertaken jointly by Finland and Croatia, which was awarded EU funding under the Border Management and Visa Instrument (BMVI). The pilot project tests the development and use of a Digital Travel Credential (DTC) for border checks at air borders and tests the creation and verification of a digital residence permit. Following a description of the general objectives of the project, the outcomes are presented according to the project work package, some legal and practical considerations are raised, and interim conclusions are put forward.

2.Project objectives

The primary goal of this project is to design, develop and field-test an IT solution that implements the DTC (type 1) standard published by the International Civil Aviation Organization (ICAO), the global body responsible for ensuring the interoperability of travel documents. Data collected during the project can also be used as an evidence base for assessing further stages of digitalisation. A secondary goal, for the participants in Finland, is to explore the potential of a digital residence permit as an alternative or a complement to the physical residence permit in credit-card format (TD1 format).

Regarding the DTC, the project trials the feasibility of using a DTC – created using biographical and biometric data derived from a passport with a chip – to allow a passenger to submit travel details to border authorities in advance of travel, and to process a passenger through border control using biometric data (the facial image) contained in the DTC. The project seeks to collect data on waiting and processing times per traveller at the physical border-crossing point, to determine if clearance is faster when border authorities have more time to process individual travellers who submit a DTC in advance.

Finland is testing and analysing chip-reading software that identifies flaws in genuine documents and corrects them before the verification process is carried out, so that no 'unnecessary' warnings have to be shown to the inspector.

Regarding the digital residence permit, the project (in Finland only) seeks to examine the possibility to embed biometric data (the facial image) of sufficient output quality to be integrated into a 2D-barcode. The aim of the study is to harmonise the findings with the ICAO data-structure for barcodes standard to enable global interoperability.

3.Project implementation and outcomes

The project is structured into eight work packages, consisting of one project governance package and seven substantive packages incorporating system development, roll-out and field testing.

3.1 Governance work package

A project steering committee was set up in January 2023 to define the scope of the project, specify the solution requirements, and establish a project schedule. The steering committee also coordinates the work among all project participants, including reporting to the Commission and financial monitoring.

3.2System development work package

3.2.1 System development (Croatia)

The aim of this work is to test the use of the existing digital identity wallet, developed by Certilia for users of Croatian digital identity services, at Croatian border control, once the app is upgraded to include additional functionality to handle a DTC.

The Croatian participants developed a digital identity wallet solution for mobile Android and iOS devices with a functionality to import and submit a DTC to border officials for advance processing. In parallel, they developed a system in a secure environment that creates and stores a DTC derived from the data in the chip of a passport. Users who register to participate in the pilot project can request the creation of a DTC to be imported into their digital wallet on a mobile device. The system was available to receive requests for a DTC as from September 2023 for Android users and as from December 2023 for iOS users.

The IT equipment required to process a passenger holding a DTC was installed and tested in September 2023 at the border-control point in Zagreb Airport. The system includes document inspection system software to read the DTC and perform a facial biometric match comparing a live photo with the photo contained in the DTC submitted in advance.

3.2.2System development (Finland)

This work aimed to deliver a solution which includes:

·a digital identity wallet with the ability to import a DTC and submit it prior to travel;

·a kiosk for registering participants with pseudonymised personal data (for GDPR-compliance);

·a portal to receive the DTC submitted by users in advance,

·a DTC inspection system at the airport border-crossing point, supporting facial biometric matching, as well as clone detection performed on the passport chip.

The initial version of the digital wallet app (Android and iOS) was released in July 2023. The digital wallet has advanced security features, including mobile device authentication, encrypted data storage, and mandatory participant registration at the kiosk to enable the wallet to receive the encrypted DTC.

In July 2023 a registration kiosk was set up at Helsinki Airport, where participants in the trial present their passport to a border control officer. Using the kiosk, the officer scans the passport, enabling the kiosk to perform security checks on the passport chip and verify the data used to create the DTC, which the kiosk then sends to the digital identity wallet in encrypted form.

A submission portal was deployed in July 2023. The portal functions as the system’s data processing hub, as it receives the DTC submitted by a passenger for advance processing and communicates with a border control officer who screens the participant using the existing systems and workflow. The officer either clears or rejects the passenger, and enters the result of this pre-screening, recording a reason in the case of a rejection.

A DTC document inspection system was installed in July 2023 at an existing manual passport control booth. The inspection system periodically connects with the submission portal to download the approved DTCs submitted by passengers crossing the border in the next 24 hours, stores them locally, and extracts the facial biometric from the DTC for matching. When a passenger approaches the booth, the inspection system camera takes a live photo and matches it to a photo stored locally, thereby retrieving the passenger’s DTC. The inspection system then verifies the DTC, and the e-passport chip, allowing the officer to clear the passenger and open the border gate. Should the process fail at any point, the officer processes the passenger using the existing systems and in the normal workflow.

3.3System integration work package

3.3.1System integration (Croatia)

Integration between the submission portal and the inspection systems at the border-crossing point was fully achieved. Passengers are able to submit a DTC directly from their digital wallet app to the submission portal for advance border screening.

The objective of integrating the system with external systems was only partially achieved. Integration between the submission portal for creating and storing DTCs and the Ministry of Interior system for retrieving available travel locations was implemented in September 2023. However, integration with Finland, or any other country, for submission and receipt of each other’s DTCs was not achieved. This non-integration prevents any full end-to-end testing of the DTC systems during a single trip between Helsinki and Zagreb (as opposed to testing only locally in Helsinki and locally in Zagreb).

3.3.2System integration (Finland)

This work aimed at integrating various components of the DTC system so they could communicate with each other (for instance, registration kiosk with back-office approval system, submission portal with inspection system). The possibility of also integrating with selected external systems used during the passenger travel continuum was explored.

The only integrations successfully executed were between the registration system (kiosk) and the submission portal (advance border approval), on the one hand, and the submission portal and the inspection system, on the other. Full integration of these subsystems was completed in August 2023. Integration with external systems such as airline check-in or communication with Croatian systems for mutual submission and receipt of DTCs were not carried out. Similarly, integration between the submission portal and the existing Finnish Border Guard secure network running border control applications was not possible due to data security regulations and the available time.

3.4Field test work package

3.4.1Pilot field test (Croatia)

The aims of the field test included recruiting and informing participants, training border control staff, deploying the systems and infrastructure at Zagreb Airport, executing the live trial and collecting data about the results.

Potential participants were invited to take part in the pilot during several large-scale events and conferences in Zagreb, as well as via media interviews with project team members. The required infrastructure and systems were in place at Zagreb Airport from early October 2023, while border control officers received training on the new DTC border application by end-September 2023.

The field test is currently running since October 2023, with statistics (number of DTCs created, number of travel submissions to border control, number of border crossings using the DTC) collected in real time, with participation by users of the Android mobile app since the start, and iOS users from end-December 2023.

By December 2023, around 6200 DTCs were created and stored in digital wallets, 223 travel announcements were submitted to border control, while 58 border crossings using a DTC were recorded.

3.4.2Pilot field test (Finland)

The aim of this work was to prepare the ground for a live trial run – through participant registration, training of border staff, and installation of a dedicated DTC passenger lane – and then proceed to live testing of DTC processing at Helsinki airport.

Preparatory tasks involved training airport staff (registration kiosks) and border officers (advance screening and onsite DTC inspection), drafting reference manuals for the various functions, and communications outreach via online media and press.

The live trial started on 28 August 2023 when registrations opened, with the first DTC being used for a flight to London on 1 September 2023. Initially, the trial tested DTC border crossings for Finnair outbound flights to London, Manchester and Edinburgh. Due to the Russian hybrid influence during autumn 2023, the pilot had to be temporarily suspended at Helsinki Airport. A substantial part of the DTC-trained control staff had to be deployed to support the eastern border-crossing points. Customers were informed of the suspension.

The DTC piloting resumed on 19 December 2023 by training the entire border control staff in the use of the DTC system. In this context, the inspection lines were moved to a new location where both EU citizens and DTC passengers are checked at the same point with DTC passengers having priority. The temporary suspension of the pilot had some impact on the number of DTC checks. According to estimates, during the suspension, approximately 150 DTC checks were missed.

In December, DTC use was enabled for all Finnair outbound flights from Helsinki Airport involving a border check (extra-Schengen).

The trial results as of 30 November include: 292 registered DTC users, 203 border checks, with the average border-crossing time under eight seconds (compared with e-gates, at 20 to 25 seconds).

3.5Digital residence permit work package

The objective of this work is to specify some requirements for a fully digital (dematerialised) residence permit, including minimum data requirements for a facial biometric which is usable for identification but also encodable in a digitally signed 2D barcode small enough to fit feasibly on a mobile device.

Analysis showed that facial images held in the Finnish Immigration database were captured in a wide variety of file formats and data quality, some uncompressed (lossless) and others compressed (lossy). The study established the minimum requirements for an input facial image in order to achieve an output compressed image of sufficient quality to be used for automated biometric facial comparison.

The minimum requirements for an input image of a digital residence permit were established to have to be lossless and of high resolution. Otherwise, the output image would not meet the requirements for manual visual comparison or automated facial comparison. Technical specifications determining the criterions and processing of facial images is in preparation. The specifications will include a model of a mobile application enabling reading the residence permit 2D-barcode.

The analysis also determined that compression yielded the best results when the input image is lossless and captured at high resolution.

These results point to the need for a high-resolution capture and storage in RAW format of images to be used in travel documents. A technical specification is in preparation for input images that are well suited for automated facial recognition, as well as for compression to encode in a 2D barcode.

4.Noteworthy observations and questions raised

Several questions and observations were raised during the planning and execution of the pilots, some of which require policy choices at Union level:

4.1Digital wallet ownership and liability — who bears liability in the event of damages due to non-performance of the mobile digital wallet app?

4.2DTC encryption — DTC data is currently stored encrypted in the digital wallet, due to concerns raised by data protection authorities. As a result, the DTC is not interoperable, since the key to decrypt the DTC data is held by the submission portal, meaning the user cannot decrypt their data for submission to a foreign border authority.

4.3Airline passenger data — the DTC system is not integrated with airline check-in systems. Consequently, the passenger is required to do two things rather than one – flight check-in, then DTC submission – introducing a risk of error, and the obvious reduced facilitation. Airlines show reluctance to integrate their systems due to uncertainty about GDPR compliance, and how far their responsibility for passenger data extends.

4.4Secure messaging — the pilot demonstrated a need for a standardised secure message transmission protocol, to allow the DTC to be interoperable and hence submittable to a foreign border authority.

4.5Various IT and process issues arose during the live trials that needed to be resolved. For example, the image quality of a passenger photo captured at registration was initially poor, due to lighting causing shadows on the face. A low-quality image impacts the facial recognition phase of the procedure. Similarly, light reflecting off the screen of the kiosk computer caused problems reading the QR codes.

4.6The mobile app experienced compatibility issues with different brands and models of mobile phones. For example, the app would not work properly if the phone’s access control (via PIN, biometric or on-screen pattern) was disabled. Following a version update, the app worked on all phones used in the pilot, but in a wider scale global roll-out, full functionality of the app on all phones might not be guaranteed. Likewise, the mobile app functionality includes a messaging service, which was used to send surveys to customers, but the app does not have language support for Finnish or Swedish.

4.7The pre-screening of a DTC passenger is done on the submission portal, but legally required background checks (record checks) had to be performed manually for each DTC passenger. This was because the system as built for the pilot project is not integrated with the existing border control application, due to security regulations and available time. Had the system been integrated with the existing border-control application, background checks could have been automated.

4.8A survey of the Finnish user experience of the pilot project showed that use of the DTC is widely perceived as positive and efficient. 65% of respondents “fully agree” that the DTC border check was smooth and fast.

4.9A significant time saving was observed when using a DTC during border checks, compared to the usual manual document inspection — and also with automatic e-gates. Trial results show the average border-crossing time is under eight seconds using a DTC. In a sample of 100 passengers of all types (solo travellers, group travellers, flight crew, etc.) the average time for manual border checks was 30 seconds per person, while the average e-gate check for an EU citizen was 20 to 25 seconds.

4.10Some users reported that they were unable to use their DTC at the border control checkpoint in Zagreb Airport where usage of DTC was enabled. For some of these cases, the reason was an inability to use the QR code generated in the mobile wallet at the border check, while other cases related to the DTC inspection system application at the border not being operational.

4.11When asked whether users would continue to use the DTC to travel, during the collection of feedback in the Finnish project, 82% fully agreed.

5.Conclusions

The key finding of this summary based on an interim project report by Finland and Croatia is that the DTC is in a league of its own as regards the speed of border check procedures, whether compared to a normal border check at a booth or at an e-gate. It saves time for the traveller and frees up staff to focus on other border-control tasks.

An additional benefit of using the DTC is that any necessary identity and travel eligibility checks can be performed remotely and securely in advance, before the traveller arrives at the airport.

Some issues that still need to be addressed include: how to securely transfer DTC data from country of origin to country of destination, and how to transfer any travel restrictions recorded in a physical passport to the DTC.

This pilot project trialled the use of a “type-1” DTC, as established by the ICAO standard. It should be underlined that implementation of a type-2 or type-3 DTC can be expected to result in even more benefits to travellers.

The DTC could maximise its potential if used throughout the travel continuum, by carriers, airport operators and border authorities. Travel facilitation is clearly enhanced by streamlining border-control procedures, but other touchpoints in the journey could also benefit from the use of DTC, for example: baggage drop-off, security screening, boarding at the gate.

(1)

IATA, “Air Passenger Market Analysis”, June 2022, available online at:

https://www.iata.org/en/iata-repository/publications/economic-reports/air-passenger-monthly-analysis/

(2)

Within this report, the term ‘external borders’ refers to the external borders of the EU Member States as well as internal borders where the lifting of internal border controls has not yet been finalised. It therefore includes the borders between a Schengen Member State and Bulgaria, Romania and Cyprus as well as the borders between Schengen Member States and non-Schengen EU Member States.

(3)

Statistics provided by the European Border and Coast Guard Agency (Frontex).

(4)

See https://commission.europa.eu/strategy-and-policy/coronavirus-response/safe-covid-19-vaccines-europeans/eu-digital-covid-certificate_en .

(5)

See e.g. IATA OneID.

(6)

 See e.g. iMARS (image Manipulation Attack Resolving Solutions), https://cordis.europa.eu/project/id/883356 , https://imars-project.eu/ ; D4FLY (Detecting Document Fraud and Identity on the Fly), https://cordis.europa.eu/project/id/833704 , https://d4fly.eu/ ; and METICOS (A Platform for Monitoring and Prediction of Social Impact and Acceptability of Modern Border Control Technology), https://cordis.europa.eu/project/id/883075 , https://meticos-project.eu/ .

(7)

The obligation to include fingerprints in the passport chip entered into force in 2009.

(8)

Situation in July 2023 according to a study by Inverid. https://www.inverid.com/blog/countries-epassports#:~:text=Currently%20(July%202023)%2C%20171,adoption%20of%20ePassports%20almost%20universal.

(9)

The first version of the ICAO Digital Travel Credential (ICAO-DTC) standard is already finalised. This standard relies on travellers having the physical passport with them even if a digital travel credential is used. Digital Travel Credentials – Virtual Component Data Structure and PKI mechanisms, Release 1.2, October 2020: https://www.icao.int/Security/FAL/TRIP/PublishingImages/Pages/Publications/Digital%20Travel%20Credential%20%28DTC%29.pdf .

(10)

 See e.g. communication-shaping-europes-digital-future-feb2020_en_4.pdf (europa.eu) .

(11)

  Europe’s Digital Decade: digital targets for 2030 | European Commission (europa.eu) .

(12)

Communication from the Commission to the European Parliament and the Council "A strategy towards a fully functioning and resilient Schengen area", 2 June 2021, COM(2021) 277 final.

(13)

Commission work programme 2023, COM(2022) 548.

(14)

Assembly 41st session, Executive Committee, Agenda Item 13: Facilitation programmes – Establishing a resolution on high-level principles for the future of passenger journey, A41-WP/77, Presented by Czechia on behalf of the European Union (EU) and its Member States, the other Member States of the European Civil Aviation Conference (ECAC), Singapore, Brazil, Chile, Costa Rica, Uruguay, Venezuela (Bolivarian Republic of) and the European Organisation for the Safety of Air Navigation (EUROCONTROL)).

(15)

Regulation (EU) 2017/2226 of the European Parliament and of the Council of 30 November 2017 establishing an Entry/Exit System (EES) to register entry and exit data and refusal of entry data of third country nationals crossing the external borders of the Member States and determining the conditions for access to the EES for law enforcement purposes, and amending the Convention implementing the Schengen Agreement and Regulations (EC) No 767/2008 and (EU) No 1077/2011.

(16)

Regulation (EU) 2017/2225 of the European Parliament and of the Council of 30 November 2017 amending Regulation (EU) 2016/399 as regards the use of the Entry/Exit System, OJ L 327, 9.12.2017, p. 1–19.

(17)

Regulation (EU) 2018/1240 of the European Parliament and of the Council of 12 September 2018 establishing a European Travel Information and Authorisation System (ETIAS) and amending Regulations (EU) No 1077/2011, (EU) No 515/2014, (EU) 2016/399, (EU) 2016/1624 and (EU) 2017/2226.

(18)

Third country nationals who are family members of EU citizens exercising free movement rights under Directive 2004/38/EC and who have a residence card of a family member of an EU citizen as provided for in that Directive and in Regulation (EU) 2019/1157 of the European Parliament and of the Council of 20 June 2019 on strengthening the security of identity cards of Union citizens and of residence documents issued to Union citizens and their family members exercising their right of free movement should not be registered in ETIAS.

(19)

Regulation (EC) No 767/2008 of the European Parliament and of the Council of 9 July 2008 concerning the Visa Information System (VIS) and the exchange of data between Member States on short-stay visas (VIS Regulation, L 218/60, 13. August 2008.

(20)

VIS is operational since 2011 for short-stay visas. With the adoption of the revised VIS Regulation, the scope of the VIS has been extended to include data on long-stay visas and residence permits. The data for the start of operations of the revised VIS has not yet been adopted.

(21)

Regulation (EU) 2021/1134 of the European Parliament and of the Council of 7 July 2021 amending Regulations (EC) No 767/2008, (EC) No 810/2009, (EU) 2016/399, (EU) 2017/2226, (EU) 2018/1240, (EU) 2018/1860, (EU) 2018/1861, (EU) 2019/817 and (EU) 2019/1896 of the European Parliament and of the Council and repealing Council Decisions 2004/512/EC and 2008/633/JHA, for the purpose of reforming the Visa Information System, OJ L 248, 13.7.2021, p. 11.

(22)

Regulation (EU) 2018/1862 of the European Parliament and of the Council of 28 November 2018 on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation and judicial cooperation in criminal matters, amending and repealing Council Decision 2007/533/JHA, and repealing Regulation (EC) No 1986/2006 of the European Parliament and of the Council and Commission Decision 2010/261/EU.

(23)

Regulation (EU) 2019/817 of the European Parliament and of the Council of 20 May 2019 on establishing a framework for interoperability between EU information systems in the field of borders and visa and amending Regulations (EC) No 767/2008, (EU) 2016/399, (EU) 2017/2226, (EU) 2018/1240, (EU) 2018/1726 and (EU) 2018/1861 of the European Parliament and of the Council and Council Decisions 2004/512/EC and 2008/633/JHA, OJ L 135, 22.5.2019, p. 27.

(24)

Regulation (EU) 2019/1157 of the European Parliament and of the Council of 20 June 2019 on strengthening the security of identity cards of Union citizens and of residence documents issued to Union citizens and their family members exercising their right of free movement, OJ L 188, 1 July 2019, p. 67.

(25)

Agreement on the European Economic Area (OJ L 1, 3.1.1994, p. 3). As a result, the Regulation does not apply to Switzerland.

(26)

Judgment of 21 March 2024, C-61/22, Landeshauptstadt Wiesbaden, ECLI:EU:C:2024:251.

(27)

COM(2024) 316 final.

(28)

 Regulation (EU) 2024/1183 of the European Parliament and of the Council of 11 April 2024 amending Regulation (EU) No 910/2014 as regards establishing the European Digital Identity Framework (OJ L, 2024/1183, 30.4.2024, ELI: http://data.europa.eu/eli/reg/2024/1183/oj ).

(29)

Council Directive 2004/82/EC on the obligation of carriers to communicate passenger data, to repealed and replaced by Proposal for a Regulation of the European Parliament and of the Council on the collection and transfer of advance passenger information (API) for enhancing and facilitating external border controls.

(30)

Proposal for a Regulation of the European Parliament and of the Council amending Regulations (EC) No 767/2008, (EC) No 810/2009 and (EU) 2017/2226 of the European Parliament and of the Council, Council Regulations (EC) No 1683/95, (EC) No 333/2002, (EC) No 693/2003 and (EC) No 694/2003 and Convention implementing the Schengen Agreement, as regards the digitalisation of the visa procedure, COM/2022/658 final.

(31)

The obligation to consult the SIS, SLTD and national databases of all persons crossing the external borders was introduced in 2017.

(32)

 European Travel Commission, “European Tourism: Trends & Prospects Quarterly Report (Q2/2024)”, July 2024, available online at: ETC-Quarterly-Report-Q2-2024_Public.pdf (etc-corporate.org)

(33)

IATA, “Air Passenger Market Analysis”, June 2022, and IATA, “Air Passenger Market Analysis”, July 2023, available online at :

https://www.iata.org/en/iata-repository/publications/economic-reports/air-passenger-monthly-analysis/ and https://www.iata.org/en/iata-repository/publications/economic-reports/air-passenger-market-analysis-july-2023/ .

(34)

European Travel Commission, “European Tourism 2022 – Trends & Prospects (Q1/2022)”, May 2022, available online at:   https://etc -corporate.org/reports/European-tourism-2022-trends-prospects-q1-2022/

(35)

SWD(2022) 422 final, p. 3 (Impact assessment on API).

(36)

Digital Economy and Society Index (DESI): The Digital Economy and Society Index (DESI) | Shaping Europe’s digital future (europa.eu) .

(37)

Assessment of the implementation of Regulation (EU) 2017/458 amending Regulation (EU) 2016/399 as regards the reinforcement of checks against relevant databases at external borders, February 2020.

(38)

Research Monitoring Report, eu-LISA, “Enabling Seamless Travel to the European Union“, December 2022, p.39, available online at: https://www.eulisa.europa.eu/Publications/Reports/eu-LISA%20-%20Seamless%20Travel%20Report%202022.pdf

(39)

Raja Rajavartiolaitos, “Finland and Croatia are testing digital travel credentials in external border traffic in a DTC Pilot project”, 03.02.2023, available online at : https://raja.fi/-/suomi-ja-kroatia-kokeilevat-digitaalisen-matkustusasiakirjan-kayttoa-ulkorajaliikenteessa-dtc-pilottiprojektissa?languageId=en_US

(40)

Europa, “Schengen Area”, European Commission, available online at: https://home-affairs.ec.europa.eu/policies/schengen-borders-and-visa/schengen-area_en . In terms of border checks, although the general rule enables any person, irrespective of their nationality, to cross the internal borders without being subjected to border checks, the competent national authorities can still perform police checks as long as such checks are not equivalent to border checks (objective and non-systematic conditions). Also, only when there is a serious threat to public policy or internal security, border control at internal borders of a Schengen country may exceptionally and temporarily be reintroduced as a measure of last resort. 

(41)

Europa, “Schengen Area”, European Commission, available online at: https://home-affairs.ec.europa.eu/policies/schengen-borders-and-visa/schengen-area_en

(42)

Europa, “Schengen Area”, European Commission, available online at: https://home-affairs.ec.europa.eu/policies/schengen-borders-and-visa/schengen-area_en

(43)

To note that under the new API rules, soon to be adopted, air carriers will be obliged to collect API data by automated means.

(44)

Assessment of the implementation of Regulation (EU) 2017/458 amending Regulation (EU) 2016/399 as regards the reinforcement of checks against relevant databases at external borders, February 2020, p. 76.

(45)

Assessment of the implementation of Regulation (EU) 2017/458 amending Regulation (EU) 2016/399 as regards the reinforcement of checks against relevant databases at external borders, February 2020, p. 77.

(46)

Article 7 of Regulation (EC) No 562/2006 of the European Parliament and of the Council of 15 March 2006 establishing a Community Code on the rules governing the movement of persons across borders (Schengen Borders Code), OJ L 105, 13.4.2006, p. 1.

(47)

The EES applies to third country national travellers who cross the external borders of the Schengen area and are subject to a visa requirement, including those exempted from it and admitted for a short stay of up to 90 days in a 180-day period.

(48)

European Border and Coast Guard Report on Simulations – Findings for the Entry/Exit System, BCPs analyses 2020-2022.

(49)

Third country nationals holding a short-stay visa are subject to EES but they may not need to use self-service systems for the enrolment of data (exceptions for those whose visas are issued at the border) as their biometric data were collected when they applied for a visa.

(50)

McK Studie, Customer insights data analysis.

(51)

Based on data reported by the European Border and Coast Guard Agency. Fraudulent documents is an umbrella term covering forged documents, counterfeit documents as well as authentic documents used by a person other than the rightful holder (impostor/lookalike fraud). Counterfeit documents refer to documents that were unlawfully produced from scratch to closely imitate an authentic document. Forged documents refers to documents that were issued by a legitimate authority, but were unlawfully altered in some way, e.g. by substitution of photo, pages, altered data or attacks on entry/exit stamps. In addition to passports and identity cards, the figures include residence permits, visas.

(52)

Other types of detected documents include: pseudo/fantasy/camouflage documents, stolen blank documents and uncategorised.

(53)

ICAO, Doc Series, “Doc 9303 Machine Readable Travel Documents”, available online at: https://www.icao.int/publications/pages/publication.aspx?docnum=9303  

(54)

Council Regulation (EC) No 2252/2004 of 13 December 2004 on standards for security features and biometrics in passports and travel documents issued by Member States.

(55)

Regulation (EU) 2019/1157 of the European Parliament and of the Council of 20 June 2019 on strengthening the security of identity cards of Union citizens and of residence documents issued to Union citizens and their family members exercising their right of free movement.

(56)

See ICAO Doc 9303, Parts 9-12.

(57)

In 2020, 10 Member States also collected API data for sea borders and four for land borders.

(58)

Second subparagraph of Article 8(2), second subparagraph of Article 8(3)(a)(i) and second subparagraph of Article 8(3)(g)(i) of the Schengen Borders Code.

(59)

This has been observed in several recent Schengen evaluations.

(60)

Deficiencies have also been observed in the physical inspection of travel documents in several Member States during Schengen evaluations. This may be due to insufficient capacities particularly during peak times, lack of training as well as lack of inspection equipment.

(61)

European Parliament Think Tank, “EU policies – Delivering for citizens: Digital transformation”, June 2019, available online at: https://www.europarl.europa.eu/thinktank/en/document/EPRS_BRI(2019)633171  .

(62)

IATA, Global Passenger Survey 2023, press release available online at: https://www.iata.org/en/pressroom/2023-releases/2023-10-25-01/.

(63)

Europa, European Commission, “Shaping Europe’s digital future”, 06.1.2023, available online at: https://digital-strategy.ec.europa.eu/en/policies/desi .

(64)

Annex to the Commission Recommendation establishing a common "Practical Handbook for Border Guards (Schengen Handbook)" to be used by Member States' competent authorities when carrying out the border control of persons and replacing Recommendation (C (2019) 7131 final), C(2022) 7591, 28.10.2022, p.79, available online at: https://home-affairs.ec.europa.eu/system/files/2022-11/Practical%20handbook%20for%20border%20guards_en.pdf  .

(65)

See Article 8(2a) of the SBC.

(66)

Assessment of the implementation of Regulation (EU) 2017/458 amending Regulation (EU) 2016/399 as regards the reinforcement of checks against relevant databases at external borders, February 2020, p. 42.

(67)

See Article 9 of the SBC.

(68)

Hits can pertain e.g. to having an alert on refusal of entry and stay, being wanted for judicial processes or having a travel document that is reported as lost or stolen.

(69)

Assessment of the implementation of Regulation (EU) 2017/458 amending Regulation (EU) 2016/399 as regards the reinforcement of checks against relevant databases at external borders, February 2020, p. 54.

(70)

TFEU, Article 77(1)(c).

(71)

See Eurobarometer survey on the digitalisation of travel documents and facilitation of travel, 2023. According to SITA, Passenger IT insights 2023, 48% out of 6448 respondents experienced long waiting times and congestion at airports.

(72)

Digital Europe, work programme 2021-2022, C(2021) 7914 final, 10 November 2021, p.3.

(73)

According to IATA’s Global Passenger Survey 2023, 36% of travellers have been discouraged from travelling due to immigration requirements and 65% of respondents considered that the process complexity is the main deterrent.

(74)

   Judgment of 21 March 2024, Landeshauptstadt Wiesbaden, C-61/22, ECLI:EU:C:2024:251, paragraph 54.

(75)

Regulation (EU) 2225/2017.

(76)

Article 4(3) of Directive 2004/38/EC of the European Parliament and of the Council of 29 April 2004 on the right of citizens of the Union and their family members to move and reside freely within the territory of the Member States amending Regulation (EEC) No 1612/68 and repealing Directives 64/221/EEC, 68/360/EEC, 72/194/EEC, 73/148/EEC, 75/34/EEC, 75/35/EEC, 90/364/EEC, 90/365/EEC and 93/96/EEC (Text with EEA relevance), OJ L 158, 30.4.2004, p. 77.

(77)

94% of Member States surveyed responded that their Member State would be successful in introducing DTCs for travel facilitation with a gradual transition period.

(78)

Testing times for demonstrations reported by the editor of the ICAO DTC Technical Report. Further testing is carried out by the Netherlands, Finland and Croatia with real passengers in a real border-crossing context.

(79)

Special Eurobarometer 536, Digitalisation of travel documents and facilitation of travel, report published 27 September 2023.

(80)

 D4FLY, Detecting Document Fraud and Identity on the Fly, available online at: https://d4fly.eu/ .

(81)

CORIDS EU research result, “Smart tools streamline identity verification at border crossing points“, (2022) available online at: https://cordis.europa.eu/article/id/442740-smart-tools-streamline-identity-verification-at-border-crossing-points .  

(82)

Estimated cost according to the Finnish Border Guard for a centralised implementation of additional server capacity to host DTCs and process facial images.

(83)

In the context of the DTC pilot project, Croatian authorities estimated an integration cost of EUR 300 000. The Finnish Border Guard estimated such an integration to cost EUR 575 000, based on costs of previous integrations into national border control applications.

(84)

E.g. a single NFC reader needed to read the chip in a travel document costs no more than EUR 300.

(85)

Statistics provided by the Finnish Border Guard in the context of the DTC pilot project. The cohorts included EU citizens (the majority being Finnish nationals) and visa-exempt third country nationals using both manual booths and e-gates. The times for e-gates include entering the e-gate, reading of the passport and its validation, facial recognition as well as the consultation of the various databases. The timer stops when the person has passed through the e-gate. The duration is also impacted by external factors such as slow movement of some persons, lack of rapid access to the travel document (e.g. passport at the bottom of the traveller’s bag) and border checks for minors. These average times only take into account the cases where no issues were encountered during the document check or verification of identity as they would dramatically increase and distort the average times.

(86)

Statistics provided by the Finnish Border Guard in the context of the DTC pilot project. This cohort includes Finnish nationals.

(87)

 According to Passport-collector.com, the price of EU and Schengen Associated Country passports vary between EUR 22 and EUR 264. https://www.passport-collector.com/global-passport-fees/  

(88)

For example, in the Finnish DTC pilot project, DTC users are required to register with the police for deriving their DTC from their passport. This takes a maximum of 2-3 minutes. In the Dutch and Croatian DTC project implementations, users can derive their DTC unsupervised and remotely, taking only about a minute to complete.

(89)

See Annex 2 for more details.

(90)

In the Netherlands, at the largest border control point (Amsterdam Airport Schiphol), there are several public private partnerships with the airport, for example for the implementation of the Entry/Exit System (EES).

(91)

Air carriers are obliged to collect and transmit advance passenger information according to the API Directive and the future API Regulation; maritime carriers are required to provide information on passengers to the European Maritime single window in accordance with Regulation (EU) 2019/1239 of the European Parliament and of the Council of 20 June 2019 establishing a European Maritime Single Window environment and repealing Directive 2010/65/EU, OJ L 198, 25.7.2019, p. 64 and the Schengen Borders Code. Some Member States require, under national law, land carriers to submit passenger information. Under the rules on carrier liability, air and sea carriers are required to check that the travellers have the necessary travel documents.

(92)

Commission Staff Working Document Impact Assessment Report Proposal for a Regulation of the European Parliament and of the Council on the collection and transfer of advance passenger information (API) for enhancing and facilitating external border controls SWD(2022) 422 final, 13 December 2022.

(93)

The envisaged entry into force of the new API Regulation(s) is 2027.

(94)

Maritime carriers are required to provide information on passengers to the European Maritime single window in accordance with Regulation (EU) 2019/1239 of the European Parliament and of the Council of 20 June 2019 establishing a European Maritime Single Window environment and repealing Directive 2010/65/EU, OJ L 198, 25.7.2019, p. 64. This does not apply e.g. to ferries.

(95)

Judgment of 21 March 2024, C-61/22, Landeshauptstadt Wiesbaden, ECLI:EU:C:2024:251, paragraphs 73 to 74.

(96)

Judgment of 21 March 2024, C-61/22, Landeshauptstadt Wiesbaden, ECLI:EU:C:2024:251, paragraph 76.

(97)

 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1, ELI: http://data.europa.eu/eli/reg/2016/679/oj ) and Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89, ELI: http://data.europa.eu/eli/dir/2016/680/oj ).

(98)

See also judgment of 21 March 2024, C-61/22, Landeshauptstadt Wiesbaden, ECLI:EU:C:2024:251, paragraphs 80 to 81.

(99)

Judgment of 21 March 2024, C-61/22, Landeshauptstadt Wiesbaden, ECLI:EU:C:2024:251, paragraph 87 and case-law cited.

(100)

   Judgment of 21 March 2024, C-61/22, Landeshauptstadt Wiesbaden, ECLI:EU:C:2024:251, paragraphs 106-125.

(101)

As well as its possible future replacement, following the Commission’s proposal for a new Regulation, COM(2024) 316 final.

(102)

  https://home-affairs.ec.europa.eu/system/files/2022-11/Practical%20handbook%20for%20border%20guards_en.pdf .

(103)

  https://europa.eu/eurobarometer/surveys/detail/2967 .

(104)

All cost estimates for Member States are based on general estimates provided by Member States in the context of the DTC pilot projects and are therefore approximate only and not necessarily directly applicable to other Member States. The final costs depend on the existing infrastructure and software and technical implementation choices at the level of individual border crossing points. For eu-LISA, the cost estimations are based on prior experience with EES/ETIAS Web Services projects. Moreover, it is important to emphasise that while there is no legislation in place, the precise technical functionalities and therefore actual costs may vary, taking also into account fluctuations in prices, inflation etc.

(105)

Assessment of the implementation of Regulation (EU) 2017/458 amending Regulation (EU) 2016/399 as regards the reinforcement of checks against relevant databases at external borders, February 2020, p. 91. The time costs to passengers with additional waiting time were calculated based on 1) incremental waiting time per passenger, 2) the total number of passengers and 3) the value of time per passenger. The value of time refers to the money travellers would be willing to pay to avoid waiting that time when travelling or the compensation they would require having to wait that time while travelling. The optimistic scenario considered an additional waiting time of one minute per traveller, while the pessimistic scenario considered an additional waiting time of 13 minutes per traveller.

(106)

EUR 1 million would allow a Member State to procure and install up to 25 new e-gates or re-fit several existing ones to handle DTCs.

(107)

Employee compensation including wages, salaries in cash and in kind, employer’s social security contributions, vocational training costs, other expenditure costs such as recruitment costs, spending on work clothes and employment taxes regarded as labour costs, minus any subsidies received. Total labour cost divided by corresponding number of hours worked. Source: Eurostat: https://ec.europa.eu/eurostat/web/products-eurostat-news/w/DDN-20230330-3 .

(108)

E.g., whether persons enjoy free movement rights, whether persons are subject to EES, whether they are already registered in EES or not, whether there are additional queries to be made with regard to entry conditions etc.

(109)

However, as stated above, it should be noted that this is a highly optimistic scenario as several Member States had not yet deployed e-gates and the share of border checks at e-gates was in reality significantly lower. Moreover, under this scenario, 100% of travellers are processed in the EU nationals’ workflow.