MIL-OSI Europe: Answer to a written question – Threats to data protection and sovereignty owing to surveillance through the ‘EU Digital Travel App’, the Commission’s Trojan horse – E-002238/2024(ASW)

Personal data in the EU digital travel application will be protected through strong encryption methods, appropriate cybersecurity measures and consent rules.

The General Data Protection Regulation[1] and the Data Protection Regulation[2] for the EU institutions, bodies, offices and agencies will apply in full for the processing of personal data, within their respective scope of application.

The Commission proposal[3] for a regulation establishing an application for the electronic submission of travel data stipulates that the use of digital travel credentials will remain voluntary for travellers.

Member States will be obliged to allow travellers to use digital travel credentials for the purpose of crossing external borders once the application is operational, but travellers will continue to be allowed to use their physical passports.

The division of competences between the EU and its Member States is laid down in the EU Treaties. The area of freedom, security and justice is an area where the EU and the Member States have a shared competence.

When taking measures in relation to border controls and security, the Commission acts in full respect of the division of competences and the principles of subsidiarity and proportionality.

• [1] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. OJ L 119, 4.5.2016, p. 1-88.
• [2] Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the EU institutions, bodies, offices and agencies and on the free movement of such data. OJ L 295, 21.11.2018, p. 39-98.
• [3] COM(2024) 670 final.