1. Controller information
The European Border and Coast Guard Agency (Frontex), as an EU agency, is the data controller who collects and further processes personal data in accordance with the provisions of Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (the “Data Protection Regulation”).
Controller’s contact information:
● Address: European Square 6, 00-844 Warsaw, Poland
● E-mail: frontex@frontex.europa.eu
2. Data Protection Officer
If you have any query relating to processing of your data you may at any time consult Frontex Data Protection Officer (dataprotectionoffice@frontex.europa.eu).
3. Data collection and processing purposes
We collect your personal data directly from you, when you are the person using the Quick Border Application and filling out the border check-in questionnaire.
We may also collect your personal data indirectly, when you are a “co-traveller” and another person, authorized by you, fills out the border check-in questionnaire in the Quick Border Application on your behalf.
As part of the Quick Border App Pilot project an operational phase will be done with real travelers. The purpose of processing for Frontex is for research i.e. to test the use of the newly developed app with real travelers. This includes
● provision of the traveler with an electronic service in the form of the Quick Border Application,
● confirmation of the identity of the traveler using a biometric assessment (liveness check),
● performance of automatic monitoring of user activity (such as performance of different modules in the Quick Border Application; for example, success rates for passport reading and liveness detection) and to prepare anonymized statistics for research purposes. The monitoring will be carried out with the use of a tool approved by the European Commission.
● to support the Schengen Area border check-in procedure at the Stockholm Arlanda Airport and to provide your personal data to the border authority - Polismyndigheten (the Swedish Police Authority)
During the pilot testing phase of the Quick Border Application, we will process personal data of passengers arriving at the Schengen Area at the Stockholm Arlanda Airport for the below listed specific purposes:
● to support the Schengen Area border check-in procedure at the Stockholm Arlanda Airport, including calculation of the duration of your authorised stay and to provide your personal data to the border authority - Polismyndigheten (the Swedish Police Authority) (legal basis: Article 5 par. 1 let. d of the Data Protection Regulation – your consent)
● to confirm your identity using a biometric assessment (liveness check) (legal basis: Article 10 par. 2 let. a of the Data Protection Regulation - your explicit consent)
● to provide you with an electronic service in the form of the Quick Border Application (legal basis: Article 5 par. 1 let. c of the Data Protection Regulation - the processing is necessary for the performance of a contract to which you are a party)
● to perform automatic monitoring of user activity (such as performance of different modules in the Quick Border Application; for example, success rates for passport reading and liveness detection) and to prepare anonymised statistics for research purposes. The monitoring will be carried out with the use of a tool approved by the European Commission - Dynatrace (legal basis: Article 5 par. 1 let. d of the Data Protection Regulation – your consent)
4. Third parties
Your personal data will be shared with the following recipients:
- Polismyndigheten (the Swedish Police Authority). The Swedish Police Authority will act as a separate controller and will provide you with a separate privacy notice relating to its processing of your personal data. The said privacy statement is available below.
- Provider of hosting services (as processor) which enables the functioning of the Quick Border Application - NetCompany Intrasoft.
- Providers of the biometric assessment services (liveness check) – Inverid and iProov, as processors.
5. Data transfers
With the exception in the following paragraph, your data will not be transferred outside the European Economic Area.
Authorised sub-processors (NetCompany Intrasoft, InverID and IProov) will process personal data in the UK. The UK is considered as providing adequate protection of personal data (Commission Implementing Decision (EU) 2021/1772).
6. Data subject rights
You, as a data subject, have the right to:
a) Access: You can request confirmation from us whether or not we are processing your personal data and information on purposes of processing, categories of personal data, the recipients of your personal data, the envisaged retention period, whether you can request rectification, erasure, restriction of processing or object to the processing of your personal data, the right to lodge a complaint with the European Data Protection Supervisor, the source of collection of data as well as whether there occurs automated decision-making, including profiling;
b) Rectify: You can request rectification of inaccurate personal data so that we possess the correct information about you;
c) Erase: In some circumstances, you can request that we erase your personal data that we collect and process, for example if your personal data is no longer necessary for achieving the purposes for which it is processed. You can delete your data from the Quick Border Application any time by deleting journey(s) from the Quick Border Application or removing the entire Quick Border Application from your mobile device. The data stored in Quick Border Application’s Backend are deleted after one (1) week since they are created;
d) Restrict: In some circumstances, you can request us to restrict the processing of your personal data, for example if you contest the accuracy of your personal data;
e) Data portability: In some circumstances, you can receive from us a copy of your personal data, that you have shared with us, in a structured, commonly used and machine-readable format so that you can use this information set for other purposes and, where technically feasible, to transmit those data to another controller. You may exercise this right by using “Export local data” function of the Quick Border Application under the “Settings” option and “Local data” submenu;
f) Withdraw consent: When we process your data based on your consent, you can withdraw your consent at any time by deleting journey(s) from the Quick Border Application or removing the entire Quick Border Application from your mobile device. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal (including transfer of your personal data to Polismyndigheten (the Swedish Police Authority). The withdrawal will result in immediate deletion of the data from your Quick Border Application, but the data stored in Quick Border Application’s Backend will be deleted in 7 days, and from the backup storage after another 7 days;
g) Lodge a complaint: You can lodge a complaint with a supervisory authority - the European Data Protection Supervisor.
7. Data retention
Your data is stored in your device until you delete them from the device or remove the Quick Border Application. Frontex will retain some data. mobile device ID, travel itinerary information; Information whether you have: a reception certificate or an accommodation reservation, sufficient means of subsistence for the planned stay and medical insurance valid for the entire duration of the trip; a scanned picture of your passport; NFC chip reading of your passport and live facial image) in the Quick Border Application’s Backend for no longer that one (1) week, and will delete them after this period irrespective of the fact that you submit your data to the border authority via the Quick Border Application or not.
8. Processed data categories
We will process the following data categories:
●
Mobile device ID,
● PIN code (user defined),
● Data
related to setup of the application (activation code; information on permission
to receive push notifications; fact of accepting the terms and conditions and
acknowledging the privacy notice; fact of enabling biometrics from the mobile),
● Technical information concerning the use of the
document verification service (such as data on the device and on service usage,
including the duration of the use of the service, activity in the service, IP
address, domain name, software and hardware attributes, general geographic
location (e.g. city, state, country)),
●
Travel itinerary information, such
as:
○
whether you are arriving in or
departing from the EU/Schengen Zone,
○
airport of arrival at the Schengen
Zone,
○
date of arrival or departure from the Schengen Zone,
●
Traveler information:
○
Information whether you possess a
visa / residence permit / you are
an EU national,
○
Information whether you have:
■
a reception certificate or an
accommodation reservation,
■
sufficient means of subsistence
for the planned stay,
■
medical insurance valid for the
entire duration of the trip,
○
A scanned picture of passport,
○
NFC chip reading of passport,
○
Passport information, including:
■
First name,
■
Middle name,
■ Last name,
■ Country issuing the passport,
■ Birthdate,
■ Country of birth,
■ Expiration date of the passport,
■ Nationality,
■ Passport number,
■ Gender information,
■ Document type,
■ Document subtype,
■ Image of biographical page (VIS
Image),
○
Live facial image.
9. Final provisions
The participation in the pilot project of the Quick Border Application and provision of personal data in it is voluntary. However, for the proper functioning of the Quick Border Application, you must provide at least one pin code, while a password will be provided by the app developer. In order to complete the Schengen Area border check-in procedure, it is necessary to perform the confirmation of your identity using a biometric assessment. If you do not wish to provide any of your data in the Quick Border Application, or you do not wish to submit your data to the border authority via the Quick Border Application, you will be able to complete the border check-in procedure at the airport.
10. Fundamental rights
If you believe that your fundamental rights has been affected by the use of the app, please, you can make a complaint following the Complaints Mechanism.