1.Each application file shall be stored in the ETIAS Central System for:
(a)the period of validity of the travel authorisation;
(b)five years from the last decision to refuse, annul or revoke the travel authorisation in accordance with Articles 37, 40 and 41. If the data present in a record, file or alert registered in one of the EU information systems, Europol data, the Interpol SLTD or TDAWN databases, the ETIAS watchlist, or the ETIAS screening rules giving rise to such a decision are deleted before the end of that five-year period, the application file shall be deleted within seven days from the date of the deletion of the data in that record, file or alert. For that purpose, the ETIAS Central System shall regularly and automatically verify whether the conditions for the retention of application files referred to in this point are still fulfilled. Where they are no longer fulfilled, it shall delete the application file in an automated manner.
2.For the purpose of facilitating a new application after the expiry of the validity period of an ETIAS travel authorisation, the application file may be stored in the ETIAS Central System for an additional period of no more than three years from the end of the validity period of the travel authorisation and only where, following a request for consent, the applicant freely and explicitly consents by means of an electronically signed declaration. Requests for consent shall be presented in a manner which is clearly distinguishable from other matters, in an intelligible and easily accessible form and using clear and plain language, in accordance with Article 7 of Regulation (EU) 2016/679.
Consent shall be requested following the automatic provision of information under Article 15(2). The automatically provided information shall remind the applicant of the purpose of the data retention in line with the information referred to in point (o) of Article 71 and of the possibility to withdraw consent at any time.
The applicant may withdraw his or her consent at any time, in accordance with Article 7(3) of Regulation (EU) 2016/679. If the applicant withdraws consent, the application file shall automatically be erased from the ETIAS Central System.
eu-LISA shall develop a tool to enable applicants to give and withdraw their consent. That tool shall be made accessible via the dedicated public website or via the app for mobile devices.
The Commission shall adopt delegated acts in accordance with Article 89 to further define the tool to be used by the applicants to give and withdraw their consent.
3.Upon expiry of its retention period the application file shall automatically be erased from the ETIAS Central System.
1.The ETIAS Central Unit and the ETIAS National Units shall have the obligation to update the data stored in the ETIAS Central System and ensure that it is accurate. The ETIAS Central Unit and the ETIAS National Units shall not have the right to modify data added to the application form directly by the applicant pursuant to Article 17(2), (3) or (4).
2.Where the ETIAS Central Unit has evidence that data recorded in the ETIAS Central System by the ETIAS Central Unit are factually inaccurate or that data were processed in the ETIAS Central System in contravention of this Regulation, it shall check the data concerned and, if necessary, amend or erase them without delay from the ETIAS Central System.
3.Where the Member State responsible has evidence that data recorded in the ETIAS Central System are factually inaccurate or that data were processed in the ETIAS Central System in contravention of this Regulation, its ETIAS National Unit shall check the data concerned and, if necessary, amend or erase them without delay from the ETIAS Central System.
4.If the ETIAS Central Unit has evidence to suggest that data stored in the ETIAS Central System are factually inaccurate or that data were processed in the ETIAS Central System in contravention of this Regulation, it shall contact the ETIAS National Unit of the Member State responsible within 14 days. If a Member State different from the Member State responsible has such evidence, it shall contact the ETIAS Central Unit or the ETIAS National Unit of the Member State responsible, also within 14 days. The ETIAS Central Unit or the ETIAS National Unit of the Member State responsible shall check the accuracy of the data and the lawfulness of its processing within one month and, if necessary, amend or erase the data from the ETIAS Central System without delay.
5.Where a third-country national has acquired the nationality of a Member State or has fallen under the scope of points (a) to (c) of Article 2(2), the authorities of that Member State shall verify whether that person has a valid travel authorisation and, where relevant, shall erase the application file without delay from the ETIAS Central System. The authority responsible for erasing the application file shall be:
(a)the ETIAS National Unit of the Member State that issued the travel document as referred to in point (a) of Article 2(2);
(b)the ETIAS National Unit of the Member State the nationality of which he or she has acquired;
(c)the ETIAS National Unit of the Member State that issued the residence card or residence permit.
6.Where a third-country national has fallen under the scope of point (d), (e), (f) or (l) of Article 2(2), he or she may inform the competent authorities of the Member State that issued that residence permit, uniform visa or national long-stay visa referred to in that Article that he or she has a valid travel authorisation and may request the deletion of the corresponding application file from the ETIAS Central System. The authorities of that Member State shall verify whether that person holds a valid travel authorisation. If it is confirmed that the person does hold such an authorisation, the ETIAS National Unit of the Member State that issued the residence permit, uniform visa or national long-stay visa shall delete the application file without delay from the ETIAS Central System.
7.Where a third-country national has fallen under the scope of point (g) of Article 2(2), he or she may inform the competent authorities of the Member State he or she next enters of this change. That Member State shall contact the ETIAS Central Unit within a time limit of 14 days. The ETIAS Central Unit shall check the accuracy of the data within a time limit of one month and if necessary, erase the application file from the ETIAS Central System without delay.
8.Without prejudice to any available administrative or non-judicial remedy, individuals shall have access to an effective judicial remedy to ensure that data stored in ETIAS are amended or erased.