1 E Brouwer, ‘Large-scale databases and interoperability in migration and border policies: The nondiscriminatory approach of data protection’ (2020) EPL 71; T Quintel, ‘Connecting Personal Data of Third Country Nationals: Interoperability of EU Databases in the Light of the CJEU’s Case Law on Data Retention’ (University of Luxembourg Working Paper 002–2018) 1; N Vavoula, ‘Interoperability of EU Information Systems: The Deathblow to the Rights to Privacy and Personal Data Protection of Third-Country Nationals?’ (2020) EPL 131.
2 D Ozkul, ‘Automating immigration and asylum: The uses of new technologies in migration and asylum governance in Europe’ (AFAR Report, 2023); N Vavoula, ‘Artificial Intelligence (AI) at EU Borders: From Automated Processing to Algorithmic Profiling and Facial Recognition in the Era of Techno-Solutionism’ (2021) European Journal of Migration Law 457.
3 A Karaiskou and N Vavoula, ‘Contesting the unknown: Algorithm-assisted decision-making and access to justice in the cases of ETIAS and VIS’ (2025) German Law Journal (forthcoming).
4 Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024.
5 M Busuioc, ‘Accountable artificial intelligence: Holding algorithms to account’ (2020) Public Administration Review 825; J Kroll, J Huey, S Barocas, E Felten, J Reidenberg, D Robinson and H Yu, ‘Accountable Algorithms (2017) UpaLRev 633.
6 S Wachter, B Mittelstadt and C Russell, ‘Counterfactual Explanations Without Opening the Black Box: Automated Decisions and the GDPR’ (2018) Harvard Journal of Law & Technology 841.
7 L McGregor, D Murray and V Ng, ‘International human rights law as a framework for algorithmic accountability’ (2019) ICLQ 309.
8 U Agudo, Liberal K, Arrese M and Matute H, ‘The impact of AI errors in a human-in-the-loop process’ (2024) Cognitive Research: Principles and Implications 1; S Alon-Barkat S and M Busuioc, ‘Human–AI interactions in public sector decision making: From “automation bias” and “selective adherence” to algorithmic advice’ (2023) Journal of Public Administration Research and Theory 153.
9 Regulation (EU) 2019/817 of the European Parliament and of the Council of 20 May 2019 and Regulation (EU) 2019/818 of the European Parliament and of the Council of 20 May 2019.
10 Communication COM(2005) 597 final from the Commission of 24 November 2005 on improved effectiveness, enhanced interoperability and synergies among European databases in the area of Justice and Home Affairs 3.
11 P De Hert and S Gutwirth, ‘Interoperability of police databases within the EU: An accountable political choice?’ (2006) International Review of Law Computers & Technology 21, 22.
12 Communication COM(2016) 205 final from the Commission of 6 April 2006 on stronger and smarter information systems for borders and security 3–4.
13 Statewatch, Database delays: new timetable for interoperable EU policing and migration systems by 2027 www.statewatch.org.
14 Proposal COM(2017) 793 final from the Commission of 12 December 2017 for a Regulation of the European Parliament and of the Council on establishing a framework for interoperability between EU information systems (borders and visa) and amending Council Decision 2004/512/EC, Regulation (EC) No 767/2008, Council Decision 2008/633/JHA, Regulation (EU) 2016/399 and Regulation (EU) 2017/2226; Proposal COM(2017) 794 final from the Commission of 12 December 2017 for a Regulation of the European Parliament and of the Council on establishing a framework for interoperability between EU information systems (police and judicial cooperation, asylum and migration) 1.
15 Proposal COM(2017) 793 final cit.; Proposal COM(2017) 794 final cit. 15.
16 Regulation (EU) 2024/982 of the European Parliament and of the Council of 13 March 2024.
17 E Kindt, Privacy and Data Protection Issues of Biometric Applications: A Comparative Legal Analysis (Springer 2013) 98.
18 Art. 32 Interoperability Regulations cit.
19 Regulation (EU) 2017/2226 of the European Parliament and of the Council of 30 November 2017, art. 63; Regulation (EU) 767/2008 of the European Parliament and Council of 9 July 2008, art. 17; Regulation (EU) 2018/1240 of the European Parliament and of the Council of 12 September 2018, art. 84; Regulation (EU) 2018/1861 of the European Parliament and of the Council of 28 November 2018, art. 60; Regulation (EU) 2018/1860 of the European Parliament and of the Council of 28 November 2018, art. 16.
20 Art. 39(1) Interoperability Regulations cit.
21 Commission Delegated Regulation (EU) 2021/2223 of 30 June 2021.
22 Art. 1(2) Delegated Regulation 2021/2223 cit.
23 Art. 1(3) Delegated Regulation 2021/2223 cit.
24 Proposal COM(2021) 206 final from the Commission of 21 April 2021 for a Regulation of the European Parliament and of the Council laying down harmonised rules on Artificial Intelligence (Artificial Intelligence Act) and amending certain Union legislative act.
25 art. 33(1) Regulation 2018/1240 cit. and art. 9(j)(1) Regulation (EU) 2021/1134 of the European Parliament and of the Council of 7 July 2021.
26 C Derave, N Genicot and N Hetmanska, ‘The risks of trustworthy artificial intelligence: The case of the European Travel Information and Authorisation System’ (2022) European Journal of Risk Regulation 389
27 T Zandstra and E Brouwer, ‘Fundamental rights at the digital border: ETIAS, the right to data protection, and the CJEU’s PNR judgment’ (24 June 2022) Verfassungblog verfassungsblog.de.
28 A Karaiskou, ‘Immigration and Algorithmic Discrimination in Europe’ (Ph.D. Thesis, European University Institute).
29 Eu-LISA, ‘AI in CSSR in the context of ETIAS and the revised VIS’ (Report 2022).
30 Europol and EBCG Agency, ‘Future group on travel intelligence and border management’ (Report 2021) 65.
31 Para. 7(b) Annex III Regulation 1689/2024 cit.
32 Art. 9 Regulation 1689/2024 cit.
33 Art. 14 Regulation 1689/2024 cit.
34 Art. 17 Regulation 1689/2024 cit.
35 Art. 72 Regulation 1689/2024 cit.
36 Art. 49 in conjunction with art. 72 Regulation 1689/2024 cit.
37 Art. 49(4) Regulation 1689/2024 cit.
38 Art. 49(4) in conjunction with Annex VIII Regulation 1689/2024 cit.
39 Eu-LISA, ‘Artificial intelligence in the operational management of large-scale IT systems’ (Report 2020).
40 Directorate-General for Migration and Home Affairs of the European Commission and Deloitte, ‘Opportunities and challenges for the use of Artificial Intelligence in border control, migration and security’ (Report 2020).
41 N Vavoula, ‘Artificial Intelligence (AI) at EU Borders: From Automated Processing to Algorithmic Profiling and Facial Recognition in the Era of Techno-Solutionism’ cit.
42 Ibid.
43 Regulation (EU) 2018/1861 of the European Parliament and of the Council of 28 November 2018, art. 33(4).
44 art. 33(4) Regulation 2018/1861 cit.
45 Directorate-General for Migration and Home Affairs of the European Commission and Deloitte, ‘Opportunities and challenges for the use of Artificial Intelligence in border control, migration and security’ cit. 63.
46 Eu-LISA, ‘Artificial intelligence in the operational management of large-scale IT systems’ cit.
47 Eu-LISA, Schengen Conference Session 8 AI but also Interoperable and Automated + Conclusion of the Conference – Intervention by Luca Tagliaretti, Deputy Executive Director of Eu-LISA www.youtube.com.
48 Eu-LISA, ‘Artificial intelligence in the operational management of large-scale IT systems’ cit.
50 N Menéndez González, ‘The impact of facial recognition technology empowered by artificial intelligence on the right to privacy’ in D Bielicki (ed) Regulating artificial intelligence in industry (Routledge 2022) 21–35.
51 Preetha S and Sheela S, ‘Analysis of Fingerprint Biometric Authentication Using CNN’ (2021) Social Science Research Network papers.ssrn.com.
52 B Sumer, ‘The AI Act’s exclusion of biometric verification: Minimal risk by design and default?’ (LAILEC Research Colloquium, Leuven, 7 June 2024).
56 Commission Delegated Regulation (EU) 2023/333 of 11 July 2022.
57 Para. 2 Annex II Commission Delegated Regulation 2023/333 cit.
58 F Tassinari, ‘The external reach of the interoperability of large-scale IT systems in the AFSJ’ (PhD Thesis, University of Granada, 2022) 429
59 Para. 7(b) Annex III AI Act cit.
60 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016
61 Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016
62 Para. 7(d) Annex III AI Act cit.
63 Proposal COM(2017) 793 final cit. and Proposal COM(2017) 794 final cit. 7
64 Charter of Fundamental Rights of the European Union [2012].
65 Case C-518/07 European Commission v Federal Republic of Germany ECLI:EU:C:2010:125; Case C-320/03 European Commission v Republic of Austria ECLI:EU:C:2005:684; Case C-808/18 European Commission v Hungary ECLI:EU:C:2020:1029.
66 S Tas, ‘Overseeing supervision - Europol’s processing and exchanges of personal data’ (PhD Thesis, European University Institute, 2023) 58.
67 O Lynskey O, ‘The “Europeanisation” of data protection law. Cambridge Yearbook of European Legal Studies’ (2017) CYELS 252, 283.
68 S Tas, ‘Overseeing supervision - Europol’s processing and exchanges of personal data’ cit. 68–70.
69 EDPS, Our Role as an Advisor www.edps.europa.eu.
70 Art. 55(2) Regulation 2018/1861 cit.; Regulation (EU) 2018/1862 of the European Parliament and of the Council of 28 November 2018, art. 69(2); Regulation (EU) 2008/767 of the European Parliament and of the Council of 9 July 2008, art. 41(2) and art. 51(3) Interoperability Regulations cit.
71 Art. 55(2) Regulation 2017/2226 cit.; art. 66(4) Regulation 2018/1240 cit. and Regulation (EU) 2019/816 of the European Parliament and of the Council of 17 April 2019, art. 28(2).
72 Regulation (EU) 2024/1358 of the European Parliament and of the Council of 14 May 2024, art. 46(2).
84 Case C-817/19 Ligue des droits humains ASBL v Conseil des ministres ECLI:EU:C:2022:491.
85 Ligue des droits humains cit. para. 212.
86 P De Hert and S Gutwirth, ‘Data protection in the case law of Strasbourg and Luxembourg: Constitutionalisation in action’ in S Gutwirth S, Y Poullet, P Hert, C Terwangne and S Nouwt (eds), Reinventing Data Protection (Springer 2009) 24–31.
87 Case C-524/06 Heinz Huber v Bundesrepublik Deutschland ECLI:EU:C:2008:724.
88 Huber cit. para. 66.
89 R Gellert and S Gutwirth, ‘The legal construction of privacy and data protection’ (2013) Computer Law & Security Review 522–530.
90 Case C-817/19 Ligue des droits humains ASBL v Conseil des ministres ECLI:EU:C:2022:65, opinion of AG Pitruzzella, para. 229.
92 Report COM(2016) 0731 – C8-0466/2016 – 2016/0357A(COD) of the European Parliament on the proposal for a regulation of the European Parliament and of the Council establishing a European Travel Information and Authorisation System (ETIAS) and amending Regulations (EU) No 515/2014, (EU) 2016/399 and (EU) 2016/1624 42–43.
93 Art. 3(26) AI Act cit.
94 Regulation (EU) of the European Parliament and of the Council of 20 June 2019, art. 3(3)
