Article 10 · Commission Implementing Regulation (EU) 2022/1409

Contents

Article 10Registration with the authentication scheme#

1.Carriers referred to in Article 13(3) of Regulation (EU) 2017/2226 and Article 45c(1) of Regulation (EC) No 767/2008 operating and transporting passengers into the territory of the Member States shall be required to register prior to gaining access to the authentication scheme.

2.eu-LISA shall make available a registration form on a public website to be completed on-line. Submission of the registration form shall only be possible where all the fields have been correctly completed.

3.The registration form shall include fields requiring carriers to provide the following information:

(a)the legal name of the carrier as well as its contact details (email address, telephone number and postal address);

(b)the contact details of the legal representative of the company requesting the registration and of back-up points of contact (names, telephone numbers, email and postal addresses) as well as the functional email address and other means of communication that the carrier intends to use for the purposes of Articles 13 and 14;

(c)the Member State or third country that issued the official company registration referred to in paragraph 6 and any available registration number;

(d)where the carrier has attached, in accordance with paragraph 6, an official company registration issued by a third country, the Member States in which the carrier operates or intends to operate within the next year.

4.The registration form shall inform the carriers of the minimum security requirements. The carriers shall ensure compliance with the following objectives:

(a)identifying and managing security risks related to the connection to the carrier interface;

(b)protecting the environments and the devices connected to the carrier interface;

(c)detecting, analysing, responding to and recovering from cyber security incidents.

5.The registration form shall require carriers to declare:

(a)that they operate and transport passengers into the territory of the Member States or intend to do so within the next six months;

(b)that they will access and make use of the carrier interface in accordance with the minimum security requirements set out in the registration form, in accordance with paragraph 4;

(c)that only duly authorised staff will have access to the carrier interface.

6.The registration form shall require carriers to attach an electronic copy of their instruments of constitution, including, where applicable statutes, as well as an electronic copy of an extract of their official company registration from either at least one Member State, where applicable, or from a third country in, or officially translated into, one of the official Union or Icelandic or Norwegian. An electronic copy of an authorisation to operate in one or more Member States, such as an Air Operator Certificate, can substitute the official company registration.

7.The registration form shall notify carriers:

(a)that they are required to inform eu-LISA of any changes regarding the information referred to in paragraphs 3, 4 and 5 of this Article or in case of technical changes affecting their ‘system-to-system’ connection to the carrier interface that may require additional testing in accordance with Article 12 through specified contact details of eu-LISA to be used for this purpose;

(b)that they will be automatically deregistered from the authentication scheme if the logs show that the carrier has not used the carrier interface during a period of one year;

(c)that they may be deregistered from the authentication scheme in case of a breach of the provisions of this Regulation, the security requirements referred to in paragraph 4 or the technical guidelines, including in case of abuse of the carrier interface;

(d)that they are obliged to inform eu-LISA of any personal data breach that may occur and regularly review the access rights of their dedicated staff.

8.Where the registration form has been submitted correctly, eu-LISA shall register the carrier and notify the carrier that it has been registered. Where the registration form has not been submitted correctly, eu-LISA shall refuse registration and notify the carrier of the reasons.eu-LISA shall maintain an up-to-date register of registered carriers. Personal data contained in the registration of carriers shall be deleted at the latest one year after the carrier has been deregistered.